Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
130s -
max time network
77s -
platform
windows7_x64 -
resource
win7-20230703-en -
resource tags
arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system -
submitted
09/07/2023, 17:01
Static task
static1
Behavioral task
behavioral1
Sample
b9eae9250c31acexeexeexeex.exe
Resource
win7-20230703-en
Behavioral task
behavioral2
Sample
b9eae9250c31acexeexeexeex.exe
Resource
win10v2004-20230703-en
General
-
Target
b9eae9250c31acexeexeexeex.exe
-
Size
288KB
-
MD5
b9eae9250c31acb967c38beefa3e61a0
-
SHA1
cf274797fc25243cc2eb67b375847a7710f18027
-
SHA256
4580b172af2daef110ed5ae23849ff3a43f8a704c5ddb75f7f5739f45ba83cfe
-
SHA512
5a1fc87bc1792aee844c0c77261b99e58006f0450e258fbff65aba2a11ea56d1078a7fbaccb0487de1a41e506a3409ec1fcb06ad4c154907b88973ae49554f53
-
SSDEEP
6144:OQ+Tyfx4NF67Sbq2nW82X45gc3BaLZVS0mOoC8zbzDie:OQMyfmNFHfnWfhLZVHmOog
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 3044 winit32.exe 2192 winit32.exe -
Loads dropped DLL 3 IoCs
pid Process 1352 b9eae9250c31acexeexeexeex.exe 1352 b9eae9250c31acexeexeexeex.exe 1352 b9eae9250c31acexeexeexeex.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 28 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000_CLASSES\haldriver\shell b9eae9250c31acexeexeexeex.exe Key created \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000_CLASSES\haldriver\shell\runas\command b9eae9250c31acexeexeexeex.exe Set value (str) \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000_CLASSES\.exe\DefaultIcon\ = "%1" b9eae9250c31acexeexeexeex.exe Set value (str) \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000_CLASSES\.exe\shell\open\command\IsolatedCommand = "\"%1\" %*" b9eae9250c31acexeexeexeex.exe Key created \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000_CLASSES\haldriver\DefaultIcon b9eae9250c31acexeexeexeex.exe Set value (str) \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000_CLASSES\haldriver\DefaultIcon\ = "%1" b9eae9250c31acexeexeexeex.exe Key created \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000_CLASSES\.exe\shell\runas\command b9eae9250c31acexeexeexeex.exe Set value (str) \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000_CLASSES\.exe\shell\runas\command\ = "\"%1\" %*" b9eae9250c31acexeexeexeex.exe Set value (str) \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000_CLASSES\.exe\shell\runas\command\IsolatedCommand = "\"%1\" %*" b9eae9250c31acexeexeexeex.exe Set value (str) \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000_CLASSES\haldriver\ = "Application" b9eae9250c31acexeexeexeex.exe Set value (str) \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000_CLASSES\haldriver\shell\open\command\IsolatedCommand = "\"%1\" %*" b9eae9250c31acexeexeexeex.exe Set value (str) \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000_CLASSES\.exe\ = "haldriver" b9eae9250c31acexeexeexeex.exe Key created \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000_CLASSES\.exe\shell\open b9eae9250c31acexeexeexeex.exe Key created \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000_CLASSES\haldriver\shell\open\command b9eae9250c31acexeexeexeex.exe Key created \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000_CLASSES\haldriver\shell\runas b9eae9250c31acexeexeexeex.exe Key created \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000_CLASSES\.exe\shell\runas b9eae9250c31acexeexeexeex.exe Key created \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000_CLASSES\.exe\shell b9eae9250c31acexeexeexeex.exe Key created \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000_CLASSES\haldriver\shell\open b9eae9250c31acexeexeexeex.exe Set value (str) \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000_CLASSES\haldriver\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Sys32\\winit32.exe\" /START \"%1\" %*" b9eae9250c31acexeexeexeex.exe Set value (str) \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000_CLASSES\haldriver\shell\runas\command\ = "\"%1\" %*" b9eae9250c31acexeexeexeex.exe Set value (str) \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000_CLASSES\haldriver\shell\runas\command\IsolatedCommand = "\"%1\" %*" b9eae9250c31acexeexeexeex.exe Key created \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000_CLASSES\.exe b9eae9250c31acexeexeexeex.exe Key created \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000_CLASSES\.exe\DefaultIcon b9eae9250c31acexeexeexeex.exe Key created \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000_CLASSES\haldriver b9eae9250c31acexeexeexeex.exe Set value (str) \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000_CLASSES\haldriver\Content-Type = "application/x-msdownload" b9eae9250c31acexeexeexeex.exe Key created \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000_CLASSES\.exe\shell\open\command b9eae9250c31acexeexeexeex.exe Set value (str) \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000_CLASSES\.exe\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Sys32\\winit32.exe\" /START \"%1\" %*" b9eae9250c31acexeexeexeex.exe Set value (str) \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000_CLASSES\.exe\Content-Type = "application/x-msdownload" b9eae9250c31acexeexeexeex.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 3044 winit32.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1352 wrote to memory of 3044 1352 b9eae9250c31acexeexeexeex.exe 29 PID 1352 wrote to memory of 3044 1352 b9eae9250c31acexeexeexeex.exe 29 PID 1352 wrote to memory of 3044 1352 b9eae9250c31acexeexeexeex.exe 29 PID 1352 wrote to memory of 3044 1352 b9eae9250c31acexeexeexeex.exe 29 PID 3044 wrote to memory of 2192 3044 winit32.exe 30 PID 3044 wrote to memory of 2192 3044 winit32.exe 30 PID 3044 wrote to memory of 2192 3044 winit32.exe 30 PID 3044 wrote to memory of 2192 3044 winit32.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\b9eae9250c31acexeexeexeex.exe"C:\Users\Admin\AppData\Local\Temp\b9eae9250c31acexeexeexeex.exe"1⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1352 -
C:\Users\Admin\AppData\Roaming\Microsoft\Sys32\winit32.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Sys32\winit32.exe" /START "C:\Users\Admin\AppData\Roaming\Microsoft\Sys32\winit32.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Users\Admin\AppData\Roaming\Microsoft\Sys32\winit32.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Sys32\winit32.exe"3⤵
- Executes dropped EXE
PID:2192
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
288KB
MD5448919024dbf74040f0e423dd9f8f45a
SHA179b52bdaf35aef7989479da5a6ec9b8b476b6660
SHA2566577ba614fe627ce0ac672f03d90e2d982d7768722afb31c273aab470978287b
SHA5120a2303f4251c0816a65b794ced4a81e32b13b1e182605052b7a019a94d60bdf038d127602d79f1393a0b0c6878d45eeae2b1796e84b5b96d980e36c88164844b
-
Filesize
288KB
MD5448919024dbf74040f0e423dd9f8f45a
SHA179b52bdaf35aef7989479da5a6ec9b8b476b6660
SHA2566577ba614fe627ce0ac672f03d90e2d982d7768722afb31c273aab470978287b
SHA5120a2303f4251c0816a65b794ced4a81e32b13b1e182605052b7a019a94d60bdf038d127602d79f1393a0b0c6878d45eeae2b1796e84b5b96d980e36c88164844b
-
Filesize
288KB
MD5448919024dbf74040f0e423dd9f8f45a
SHA179b52bdaf35aef7989479da5a6ec9b8b476b6660
SHA2566577ba614fe627ce0ac672f03d90e2d982d7768722afb31c273aab470978287b
SHA5120a2303f4251c0816a65b794ced4a81e32b13b1e182605052b7a019a94d60bdf038d127602d79f1393a0b0c6878d45eeae2b1796e84b5b96d980e36c88164844b
-
Filesize
288KB
MD5448919024dbf74040f0e423dd9f8f45a
SHA179b52bdaf35aef7989479da5a6ec9b8b476b6660
SHA2566577ba614fe627ce0ac672f03d90e2d982d7768722afb31c273aab470978287b
SHA5120a2303f4251c0816a65b794ced4a81e32b13b1e182605052b7a019a94d60bdf038d127602d79f1393a0b0c6878d45eeae2b1796e84b5b96d980e36c88164844b
-
Filesize
288KB
MD5448919024dbf74040f0e423dd9f8f45a
SHA179b52bdaf35aef7989479da5a6ec9b8b476b6660
SHA2566577ba614fe627ce0ac672f03d90e2d982d7768722afb31c273aab470978287b
SHA5120a2303f4251c0816a65b794ced4a81e32b13b1e182605052b7a019a94d60bdf038d127602d79f1393a0b0c6878d45eeae2b1796e84b5b96d980e36c88164844b
-
Filesize
288KB
MD5448919024dbf74040f0e423dd9f8f45a
SHA179b52bdaf35aef7989479da5a6ec9b8b476b6660
SHA2566577ba614fe627ce0ac672f03d90e2d982d7768722afb31c273aab470978287b
SHA5120a2303f4251c0816a65b794ced4a81e32b13b1e182605052b7a019a94d60bdf038d127602d79f1393a0b0c6878d45eeae2b1796e84b5b96d980e36c88164844b
-
Filesize
288KB
MD5448919024dbf74040f0e423dd9f8f45a
SHA179b52bdaf35aef7989479da5a6ec9b8b476b6660
SHA2566577ba614fe627ce0ac672f03d90e2d982d7768722afb31c273aab470978287b
SHA5120a2303f4251c0816a65b794ced4a81e32b13b1e182605052b7a019a94d60bdf038d127602d79f1393a0b0c6878d45eeae2b1796e84b5b96d980e36c88164844b