Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
84s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
11/07/2023, 01:25
Static task
static1
Behavioral task
behavioral1
Sample
MF xfxs world.exe
Resource
win7-20230703-en
Behavioral task
behavioral2
Sample
MF xfxs world.exe
Resource
win10v2004-20230703-en
General
-
Target
MF xfxs world.exe
-
Size
226.5MB
-
MD5
ecd69c0475152a756ef45ad06cd932fe
-
SHA1
22c06183d98d5d659e0e0d7e02a06fac8bb84ad9
-
SHA256
27d6f51d20512e8da2e6e119be1ed618c29f961455402cba70bda91a365a8c65
-
SHA512
08d5b193d4de5dcc1ba280e1f4788d390f8eed652ea4af70238604e6b1a1c6deec31fabac58bb60db463e72c9bbc1783ba08440f290a92b3cdeb3c936891785c
-
SSDEEP
6291456:4nImUPZLCWvaAtfsZewpRdiuek67HJ9CZEC0HycjFhSIgfcTn3:2UP5lSeEkwpRAue/j/UP0DjFhce3
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 3644 stdrt.exe -
Loads dropped DLL 20 IoCs
pid Process 3644 stdrt.exe 3644 stdrt.exe 3644 stdrt.exe 3644 stdrt.exe 3644 stdrt.exe 3644 stdrt.exe 3644 stdrt.exe 3644 stdrt.exe 3644 stdrt.exe 3644 stdrt.exe 3644 stdrt.exe 3644 stdrt.exe 3644 stdrt.exe 3644 stdrt.exe 3644 stdrt.exe 3644 stdrt.exe 3644 stdrt.exe 3644 stdrt.exe 3644 stdrt.exe 3644 stdrt.exe -
Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\Videos\Captures\desktop.ini svchost.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString svchost.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3011986978-2180659500-3669311805-1000\{127B83FC-77C6-494B-904C-9EEE68F16727} svchost.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3644 stdrt.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: 33 1116 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1116 AUDIODG.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3644 stdrt.exe 4704 OpenWith.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1560 wrote to memory of 3644 1560 MF xfxs world.exe 92 PID 1560 wrote to memory of 3644 1560 MF xfxs world.exe 92 PID 1560 wrote to memory of 3644 1560 MF xfxs world.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\MF xfxs world.exe"C:\Users\Admin\AppData\Local\Temp\MF xfxs world.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\mrt9D98.tmp\stdrt.exe"C:\Users\Admin\AppData\Local\Temp\mrt9D98.tmp\stdrt.exe" /SF "C:\Users\Admin\AppData\Local\Temp\MF xfxs world.exe" /SO3942402⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3644
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x40c 0x49c1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1116
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
PID:4704
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
PID:3968
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
182B
MD58e2887f54ee40cdbca2fd076d012359e
SHA16e99a470118514cf9848b0a5482d52624baa444d
SHA25697a34553d12d66f64fc4e47a7f94184abf0b1fc60ece91fa6a3f675b1f13a9de
SHA512dc9f02ae16b81b6cbf4dc6fcf97e130276b4c62a372c71ff996fada08b13c2fe13d80e938ddc635a61c3cd7d8a18e1a9b1e526cb0501f5552d276d50378675de
-
Filesize
121KB
MD5457476f41768b31ebdc83264e281a039
SHA1b6829cef9a7a6a3d2ee39ac186c8c867b7208eae
SHA2567693c525f35260f5100f031fdf55dec5e4871b94ca53d2603437401974aaf02b
SHA512794ad61b9ae2b3233624fe7938204c7d455906e6ce634c83bb42b0cbf27df4b02a5d17c1bfd118e339fc312d7fda27e617face67fb56c8b45c28df0f6b9e7725
-
Filesize
121KB
MD5457476f41768b31ebdc83264e281a039
SHA1b6829cef9a7a6a3d2ee39ac186c8c867b7208eae
SHA2567693c525f35260f5100f031fdf55dec5e4871b94ca53d2603437401974aaf02b
SHA512794ad61b9ae2b3233624fe7938204c7d455906e6ce634c83bb42b0cbf27df4b02a5d17c1bfd118e339fc312d7fda27e617face67fb56c8b45c28df0f6b9e7725
-
Filesize
459KB
MD54cf7bb74d8104280b7e986f4df21109d
SHA1edc21a43136afddbf4786593e84b934d40591b74
SHA256c0d56cefb509e5600ac6b430adcaf53b81881d3fff4e62b7ede158d66d826622
SHA5122bbac48354657659795697e67508d777ee595348e1fb3d4b6c65d8618c346b3be0052b1e2e2fe669dcca19c3c00d59d1833acc21d88a97efbde2694935e3c292
-
Filesize
265KB
MD5b4a747c10e04c2ccb675990341872d2c
SHA19024a5b3f1256159188ea0efd00a2613d506750c
SHA256ce4b4d9136711f263372dd4adcee610c16ed681cdf2727b4d800b388837bfffc
SHA51237a073e14b49a883f26c048f431fe3718b97fd3f908470527e20a080670d8bfa29fd618b30c4bde02cb322e1e6c56c0c7b9bd63840435814ac2f4ea3d5e19350
-
Filesize
265KB
MD5b4a747c10e04c2ccb675990341872d2c
SHA19024a5b3f1256159188ea0efd00a2613d506750c
SHA256ce4b4d9136711f263372dd4adcee610c16ed681cdf2727b4d800b388837bfffc
SHA51237a073e14b49a883f26c048f431fe3718b97fd3f908470527e20a080670d8bfa29fd618b30c4bde02cb322e1e6c56c0c7b9bd63840435814ac2f4ea3d5e19350
-
Filesize
64KB
MD5a20165b7e7dfee46a59e48c175523af0
SHA16ed627806753d11e1a121689369668294d15be74
SHA256cba1c0fa69bc6b106408d06878390a5699cd2b25adfed1a2610ee01ae2524cbe
SHA512a9295b814fe77aa4ba4dec5cbed790858852f775799fe9da01bf07d67fa294d4ca1c5a68c9255c3fb716d0dbeb8b5a5ea38b8ec72263f40957beafe7bf323cd4
-
Filesize
64KB
MD5a20165b7e7dfee46a59e48c175523af0
SHA16ed627806753d11e1a121689369668294d15be74
SHA256cba1c0fa69bc6b106408d06878390a5699cd2b25adfed1a2610ee01ae2524cbe
SHA512a9295b814fe77aa4ba4dec5cbed790858852f775799fe9da01bf07d67fa294d4ca1c5a68c9255c3fb716d0dbeb8b5a5ea38b8ec72263f40957beafe7bf323cd4
-
Filesize
64KB
MD5a20165b7e7dfee46a59e48c175523af0
SHA16ed627806753d11e1a121689369668294d15be74
SHA256cba1c0fa69bc6b106408d06878390a5699cd2b25adfed1a2610ee01ae2524cbe
SHA512a9295b814fe77aa4ba4dec5cbed790858852f775799fe9da01bf07d67fa294d4ca1c5a68c9255c3fb716d0dbeb8b5a5ea38b8ec72263f40957beafe7bf323cd4
-
Filesize
44KB
MD5ceb8b2e522d0aaaecdf69b3bcc89a530
SHA1c1cf769a96a9612f7fd0c1965413f4a57e4907e1
SHA2563407eb12f6bacec5ebd4df96ff3fd34741a3919fd46c2ec527364c5f1e753a65
SHA5123c46743c635eb96351e6a82490cececb24e6a104433c962f263ec01cf78fa9747d4f56d05c3085c0a18eff7c180b145df5e8e74bc008fe2f617f7f4c24be0331
-
Filesize
44KB
MD5ceb8b2e522d0aaaecdf69b3bcc89a530
SHA1c1cf769a96a9612f7fd0c1965413f4a57e4907e1
SHA2563407eb12f6bacec5ebd4df96ff3fd34741a3919fd46c2ec527364c5f1e753a65
SHA5123c46743c635eb96351e6a82490cececb24e6a104433c962f263ec01cf78fa9747d4f56d05c3085c0a18eff7c180b145df5e8e74bc008fe2f617f7f4c24be0331
-
Filesize
112KB
MD5074beb9e3152e95f59130cddd47ac139
SHA17a8f7cd2ba58000bbc7bb52ba34ea8fe796d79c0
SHA256a7b4174cfa2b167519abfc6232c018835e983fb9d787c582d0b5b439bd2203f4
SHA512b8c2c3b8efb2d36c71d8730cff3587ecc4eae7348262131669926ede983233501c8bde625eaf0c2b62535f242117a64cefe91edf3ba0686509b1e7b5439f9223
-
Filesize
112KB
MD5074beb9e3152e95f59130cddd47ac139
SHA17a8f7cd2ba58000bbc7bb52ba34ea8fe796d79c0
SHA256a7b4174cfa2b167519abfc6232c018835e983fb9d787c582d0b5b439bd2203f4
SHA512b8c2c3b8efb2d36c71d8730cff3587ecc4eae7348262131669926ede983233501c8bde625eaf0c2b62535f242117a64cefe91edf3ba0686509b1e7b5439f9223
-
Filesize
112KB
MD5074beb9e3152e95f59130cddd47ac139
SHA17a8f7cd2ba58000bbc7bb52ba34ea8fe796d79c0
SHA256a7b4174cfa2b167519abfc6232c018835e983fb9d787c582d0b5b439bd2203f4
SHA512b8c2c3b8efb2d36c71d8730cff3587ecc4eae7348262131669926ede983233501c8bde625eaf0c2b62535f242117a64cefe91edf3ba0686509b1e7b5439f9223
-
Filesize
32KB
MD5e0cdbe134b5b60c920eda184853e32b2
SHA14370e12c54a4ce0a563dfd2212aec9d705cb1133
SHA256c229b36ce4e3cf824844931c0dfce165da22c234397cb1e8258d05f86decd053
SHA5121c88267b0e26dfaac0eacdf6d6e20c336b1d4cf6ba38ed1c46b4c8f8881174364404a138f2ae6851e2968bd2f22b31724edc7598c61d620b27e58af53a4dd0f1
-
Filesize
32KB
MD5e0cdbe134b5b60c920eda184853e32b2
SHA14370e12c54a4ce0a563dfd2212aec9d705cb1133
SHA256c229b36ce4e3cf824844931c0dfce165da22c234397cb1e8258d05f86decd053
SHA5121c88267b0e26dfaac0eacdf6d6e20c336b1d4cf6ba38ed1c46b4c8f8881174364404a138f2ae6851e2968bd2f22b31724edc7598c61d620b27e58af53a4dd0f1
-
Filesize
36KB
MD555d486fc27c48ca0fdc5884e88b03328
SHA1fa60040768ab771e4278e4a618d33200a1089a6d
SHA256078791005076d62c0bd25678577045ef9f67b683b84f942eb9c6af09a4738c46
SHA5127bac2e151bce223adfe810e8fd409545c8b169711add24c6d5a4c5c2d58caef2f196ca4aaedeb80dcbfa8307d79e85c43601e8c18d318a34283457946671b573
-
Filesize
36KB
MD555d486fc27c48ca0fdc5884e88b03328
SHA1fa60040768ab771e4278e4a618d33200a1089a6d
SHA256078791005076d62c0bd25678577045ef9f67b683b84f942eb9c6af09a4738c46
SHA5127bac2e151bce223adfe810e8fd409545c8b169711add24c6d5a4c5c2d58caef2f196ca4aaedeb80dcbfa8307d79e85c43601e8c18d318a34283457946671b573
-
Filesize
28KB
MD55522465eba7c81f1fb67d6ad1a5df233
SHA10ec415bfaa9db6984cf922d5503d9fde67d0b3e2
SHA25682c4f5af3c25a8daf60185833d3d61f2e8e2851ad640b59af54060eab6bc859e
SHA51230d0ed91bf072e7b7367a708eb6a7d92cc0f326249ffdd44a0d94c3b8feb37b38387141c88add61a578393a186e9fb379d42ab0018aa14e917705e4344233f6a
-
Filesize
28KB
MD55522465eba7c81f1fb67d6ad1a5df233
SHA10ec415bfaa9db6984cf922d5503d9fde67d0b3e2
SHA25682c4f5af3c25a8daf60185833d3d61f2e8e2851ad640b59af54060eab6bc859e
SHA51230d0ed91bf072e7b7367a708eb6a7d92cc0f326249ffdd44a0d94c3b8feb37b38387141c88add61a578393a186e9fb379d42ab0018aa14e917705e4344233f6a
-
Filesize
1.1MB
MD522284d6bb382967ff72363f828050e13
SHA15c98e25d24aacafffded9353c9526be0128c6dbd
SHA2569eaa342059785bd584df956574c637e6d0e6016a099221a56e0397f8c86cd93f
SHA5122e5a5bf115b1d2a07d0647b6f4925ab84301ca6354e3f3beb8d44f51900ff21b06b97b23128160fd94dfd33116d03094ca47c49143ae98473eaaed441f9705b2
-
Filesize
1.1MB
MD522284d6bb382967ff72363f828050e13
SHA15c98e25d24aacafffded9353c9526be0128c6dbd
SHA2569eaa342059785bd584df956574c637e6d0e6016a099221a56e0397f8c86cd93f
SHA5122e5a5bf115b1d2a07d0647b6f4925ab84301ca6354e3f3beb8d44f51900ff21b06b97b23128160fd94dfd33116d03094ca47c49143ae98473eaaed441f9705b2
-
Filesize
459KB
MD54cf7bb74d8104280b7e986f4df21109d
SHA1edc21a43136afddbf4786593e84b934d40591b74
SHA256c0d56cefb509e5600ac6b430adcaf53b81881d3fff4e62b7ede158d66d826622
SHA5122bbac48354657659795697e67508d777ee595348e1fb3d4b6c65d8618c346b3be0052b1e2e2fe669dcca19c3c00d59d1833acc21d88a97efbde2694935e3c292
-
Filesize
139KB
MD5ebbba2f177015b76b067b210f6af1133
SHA1dfa2216650cc076c69bee22be17a16946957d93e
SHA25618e45ef9724251583a74970c0d7bb4dbcb7ed7a0d94fecc023517a757007844c
SHA5126cd20461981b4acb8b0682e536864258b098f80d4d9b72e177217e77a61b0009799f1f5c7e5ff8d900250e2a29a4e03f840ff097569f04ab4d47c0cedd8d05e4
-
Filesize
139KB
MD5ebbba2f177015b76b067b210f6af1133
SHA1dfa2216650cc076c69bee22be17a16946957d93e
SHA25618e45ef9724251583a74970c0d7bb4dbcb7ed7a0d94fecc023517a757007844c
SHA5126cd20461981b4acb8b0682e536864258b098f80d4d9b72e177217e77a61b0009799f1f5c7e5ff8d900250e2a29a4e03f840ff097569f04ab4d47c0cedd8d05e4
-
Filesize
139KB
MD5ebbba2f177015b76b067b210f6af1133
SHA1dfa2216650cc076c69bee22be17a16946957d93e
SHA25618e45ef9724251583a74970c0d7bb4dbcb7ed7a0d94fecc023517a757007844c
SHA5126cd20461981b4acb8b0682e536864258b098f80d4d9b72e177217e77a61b0009799f1f5c7e5ff8d900250e2a29a4e03f840ff097569f04ab4d47c0cedd8d05e4
-
Filesize
24KB
MD57beafd3ec0c36a1422387c43c49f68ff
SHA1240e7d8534ed25dffb902a969826f4300a88dde6
SHA256cd5bd7cc59eaf42bc0edf418ce6f077f9db369d5e3c414107b82492a877a6176
SHA51244101803bd757bb7a84577aa1c087472a619da732dcdb3947b683cd7a7df30931e4c9973e06532859f9654c4ad3635db205e41fc7214a0f52537be91e87b2734
-
Filesize
24KB
MD57beafd3ec0c36a1422387c43c49f68ff
SHA1240e7d8534ed25dffb902a969826f4300a88dde6
SHA256cd5bd7cc59eaf42bc0edf418ce6f077f9db369d5e3c414107b82492a877a6176
SHA51244101803bd757bb7a84577aa1c087472a619da732dcdb3947b683cd7a7df30931e4c9973e06532859f9654c4ad3635db205e41fc7214a0f52537be91e87b2734
-
Filesize
24KB
MD57beafd3ec0c36a1422387c43c49f68ff
SHA1240e7d8534ed25dffb902a969826f4300a88dde6
SHA256cd5bd7cc59eaf42bc0edf418ce6f077f9db369d5e3c414107b82492a877a6176
SHA51244101803bd757bb7a84577aa1c087472a619da732dcdb3947b683cd7a7df30931e4c9973e06532859f9654c4ad3635db205e41fc7214a0f52537be91e87b2734
-
Filesize
130KB
MD5e925b7e0be07bc86cb8042168077bb04
SHA1233c160b5264e1fa4f3b3ad6464207c09f698d26
SHA256848d266c7676a5f59e66386d76679b97d2934166a8d829d5d000b217ab7a34cf
SHA5120063b350116bfa478ecda081ae364e08c84cb97a337ff0b6e0d442653976c2663b8b2b430cca694f1a75fd93414d264b46da1331e7aadc2cdd424d69db27c31a
-
Filesize
130KB
MD5e925b7e0be07bc86cb8042168077bb04
SHA1233c160b5264e1fa4f3b3ad6464207c09f698d26
SHA256848d266c7676a5f59e66386d76679b97d2934166a8d829d5d000b217ab7a34cf
SHA5120063b350116bfa478ecda081ae364e08c84cb97a337ff0b6e0d442653976c2663b8b2b430cca694f1a75fd93414d264b46da1331e7aadc2cdd424d69db27c31a
-
Filesize
130KB
MD5e925b7e0be07bc86cb8042168077bb04
SHA1233c160b5264e1fa4f3b3ad6464207c09f698d26
SHA256848d266c7676a5f59e66386d76679b97d2934166a8d829d5d000b217ab7a34cf
SHA5120063b350116bfa478ecda081ae364e08c84cb97a337ff0b6e0d442653976c2663b8b2b430cca694f1a75fd93414d264b46da1331e7aadc2cdd424d69db27c31a
-
Filesize
1018KB
MD5c3a0f519ddff61547f46b535989dbff4
SHA1d30687e9fa01b78b48b1dd5042655021cdb1893b
SHA2565712cd73560028c1c16e85af009b9e7fb63064e7550effcf1ff8d22d18bfc113
SHA512eb3184822359a8934552813134c005598989e9273a552e49fecf314772972f4377c8070f1c9c9734be20c043ca5e985a1c6498ee468f26cbaff8cbdfe400edb4
-
Filesize
1018KB
MD5c3a0f519ddff61547f46b535989dbff4
SHA1d30687e9fa01b78b48b1dd5042655021cdb1893b
SHA2565712cd73560028c1c16e85af009b9e7fb63064e7550effcf1ff8d22d18bfc113
SHA512eb3184822359a8934552813134c005598989e9273a552e49fecf314772972f4377c8070f1c9c9734be20c043ca5e985a1c6498ee468f26cbaff8cbdfe400edb4
-
Filesize
8KB
MD5f76739536860a0bdb4a7e3bbb0c06d08
SHA1b21581aa36eda87db8845caf58c668749e26b29f
SHA25641136b09b033a20b9acc430620ea095ff76afbdc7aebe7f26f7d2b4315afddef
SHA5126e65f23a4c1e3b0068b190f9aaaedcfa0466b0185cd6bbafa5f6f6940c8bc332e7c8c611d1b3b63bb2c5fcda48bbe2a678d81a3819940ecc0c701d6fec4194c7
-
Filesize
8KB
MD5f76739536860a0bdb4a7e3bbb0c06d08
SHA1b21581aa36eda87db8845caf58c668749e26b29f
SHA25641136b09b033a20b9acc430620ea095ff76afbdc7aebe7f26f7d2b4315afddef
SHA5126e65f23a4c1e3b0068b190f9aaaedcfa0466b0185cd6bbafa5f6f6940c8bc332e7c8c611d1b3b63bb2c5fcda48bbe2a678d81a3819940ecc0c701d6fec4194c7
-
Filesize
8KB
MD5f76739536860a0bdb4a7e3bbb0c06d08
SHA1b21581aa36eda87db8845caf58c668749e26b29f
SHA25641136b09b033a20b9acc430620ea095ff76afbdc7aebe7f26f7d2b4315afddef
SHA5126e65f23a4c1e3b0068b190f9aaaedcfa0466b0185cd6bbafa5f6f6940c8bc332e7c8c611d1b3b63bb2c5fcda48bbe2a678d81a3819940ecc0c701d6fec4194c7
-
Filesize
190B
MD5b0d27eaec71f1cd73b015f5ceeb15f9d
SHA162264f8b5c2f5034a1e4143df6e8c787165fbc2f
SHA25686d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
SHA5127b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c