Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
25/08/2023, 22:57
Static task
static1
Behavioral task
behavioral1
Sample
f91db36135a994d00b92ec2b1be0fca9.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
f91db36135a994d00b92ec2b1be0fca9.exe
Resource
win10v2004-20230703-en
General
-
Target
f91db36135a994d00b92ec2b1be0fca9.exe
-
Size
3.0MB
-
MD5
f91db36135a994d00b92ec2b1be0fca9
-
SHA1
4219943320a7f291a4da37aed89bce5a4a09e250
-
SHA256
f3aba98cd53c71d4d5e917e9e1fd43e3db61b46c59610eefba45b8c81f3e68ff
-
SHA512
48ffd9c8af8019e9e3ae2a5bd479d5eb7ff815e7b9b8bf3887d8528a6e796af7d0ab17f300afadaf24cc24a2fdffd2dff73ba2062903a7f8df40c5e5521f0db9
-
SSDEEP
49152:mwOiIXJQSGd77+om1nVr6AZxPbxlhqhMKucCuTOgVrp7vRo6JE3CGiiFlENhh4xM:mT5af+tF6UxPFlQ+KdnESGNFe4xLafv
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Windows\CurrentVersion\Run\DataServicesWindows = "C:\\Users\\Admin\\AppData\\Roaming\\DataServicesWindows.exe" f91db36135a994d00b92ec2b1be0fca9.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 1080 f91db36135a994d00b92ec2b1be0fca9.exe 1080 f91db36135a994d00b92ec2b1be0fca9.exe 1080 f91db36135a994d00b92ec2b1be0fca9.exe 1080 f91db36135a994d00b92ec2b1be0fca9.exe 1080 f91db36135a994d00b92ec2b1be0fca9.exe 1080 f91db36135a994d00b92ec2b1be0fca9.exe 1080 f91db36135a994d00b92ec2b1be0fca9.exe 1080 f91db36135a994d00b92ec2b1be0fca9.exe 1080 f91db36135a994d00b92ec2b1be0fca9.exe 1080 f91db36135a994d00b92ec2b1be0fca9.exe 1080 f91db36135a994d00b92ec2b1be0fca9.exe 1080 f91db36135a994d00b92ec2b1be0fca9.exe 1080 f91db36135a994d00b92ec2b1be0fca9.exe 1080 f91db36135a994d00b92ec2b1be0fca9.exe 1080 f91db36135a994d00b92ec2b1be0fca9.exe 1080 f91db36135a994d00b92ec2b1be0fca9.exe 1080 f91db36135a994d00b92ec2b1be0fca9.exe 1080 f91db36135a994d00b92ec2b1be0fca9.exe 1080 f91db36135a994d00b92ec2b1be0fca9.exe 1080 f91db36135a994d00b92ec2b1be0fca9.exe 1080 f91db36135a994d00b92ec2b1be0fca9.exe 2288 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1080 f91db36135a994d00b92ec2b1be0fca9.exe Token: SeDebugPrivilege 2288 powershell.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1080 wrote to memory of 916 1080 f91db36135a994d00b92ec2b1be0fca9.exe 30 PID 1080 wrote to memory of 916 1080 f91db36135a994d00b92ec2b1be0fca9.exe 30 PID 1080 wrote to memory of 916 1080 f91db36135a994d00b92ec2b1be0fca9.exe 30 PID 1080 wrote to memory of 916 1080 f91db36135a994d00b92ec2b1be0fca9.exe 30 PID 916 wrote to memory of 2288 916 cmd.exe 32 PID 916 wrote to memory of 2288 916 cmd.exe 32 PID 916 wrote to memory of 2288 916 cmd.exe 32 PID 916 wrote to memory of 2288 916 cmd.exe 32 PID 1080 wrote to memory of 2432 1080 f91db36135a994d00b92ec2b1be0fca9.exe 33 PID 1080 wrote to memory of 2432 1080 f91db36135a994d00b92ec2b1be0fca9.exe 33 PID 1080 wrote to memory of 2432 1080 f91db36135a994d00b92ec2b1be0fca9.exe 33 PID 1080 wrote to memory of 2432 1080 f91db36135a994d00b92ec2b1be0fca9.exe 33 PID 1080 wrote to memory of 2432 1080 f91db36135a994d00b92ec2b1be0fca9.exe 33 PID 1080 wrote to memory of 2432 1080 f91db36135a994d00b92ec2b1be0fca9.exe 33 PID 1080 wrote to memory of 2432 1080 f91db36135a994d00b92ec2b1be0fca9.exe 33 PID 1080 wrote to memory of 2432 1080 f91db36135a994d00b92ec2b1be0fca9.exe 33 PID 1080 wrote to memory of 888 1080 f91db36135a994d00b92ec2b1be0fca9.exe 34 PID 1080 wrote to memory of 888 1080 f91db36135a994d00b92ec2b1be0fca9.exe 34 PID 1080 wrote to memory of 888 1080 f91db36135a994d00b92ec2b1be0fca9.exe 34 PID 1080 wrote to memory of 888 1080 f91db36135a994d00b92ec2b1be0fca9.exe 34 PID 1080 wrote to memory of 888 1080 f91db36135a994d00b92ec2b1be0fca9.exe 34 PID 1080 wrote to memory of 888 1080 f91db36135a994d00b92ec2b1be0fca9.exe 34 PID 1080 wrote to memory of 888 1080 f91db36135a994d00b92ec2b1be0fca9.exe 34 PID 1080 wrote to memory of 888 1080 f91db36135a994d00b92ec2b1be0fca9.exe 34 PID 1080 wrote to memory of 964 1080 f91db36135a994d00b92ec2b1be0fca9.exe 35 PID 1080 wrote to memory of 964 1080 f91db36135a994d00b92ec2b1be0fca9.exe 35 PID 1080 wrote to memory of 964 1080 f91db36135a994d00b92ec2b1be0fca9.exe 35 PID 1080 wrote to memory of 964 1080 f91db36135a994d00b92ec2b1be0fca9.exe 35 PID 1080 wrote to memory of 964 1080 f91db36135a994d00b92ec2b1be0fca9.exe 35 PID 1080 wrote to memory of 964 1080 f91db36135a994d00b92ec2b1be0fca9.exe 35 PID 1080 wrote to memory of 964 1080 f91db36135a994d00b92ec2b1be0fca9.exe 35 PID 1080 wrote to memory of 964 1080 f91db36135a994d00b92ec2b1be0fca9.exe 35 PID 1080 wrote to memory of 2384 1080 f91db36135a994d00b92ec2b1be0fca9.exe 36 PID 1080 wrote to memory of 2384 1080 f91db36135a994d00b92ec2b1be0fca9.exe 36 PID 1080 wrote to memory of 2384 1080 f91db36135a994d00b92ec2b1be0fca9.exe 36 PID 1080 wrote to memory of 2384 1080 f91db36135a994d00b92ec2b1be0fca9.exe 36 PID 1080 wrote to memory of 2384 1080 f91db36135a994d00b92ec2b1be0fca9.exe 36 PID 1080 wrote to memory of 2384 1080 f91db36135a994d00b92ec2b1be0fca9.exe 36 PID 1080 wrote to memory of 2384 1080 f91db36135a994d00b92ec2b1be0fca9.exe 36 PID 1080 wrote to memory of 2384 1080 f91db36135a994d00b92ec2b1be0fca9.exe 36 PID 1080 wrote to memory of 2420 1080 f91db36135a994d00b92ec2b1be0fca9.exe 37 PID 1080 wrote to memory of 2420 1080 f91db36135a994d00b92ec2b1be0fca9.exe 37 PID 1080 wrote to memory of 2420 1080 f91db36135a994d00b92ec2b1be0fca9.exe 37 PID 1080 wrote to memory of 2420 1080 f91db36135a994d00b92ec2b1be0fca9.exe 37 PID 1080 wrote to memory of 2420 1080 f91db36135a994d00b92ec2b1be0fca9.exe 37 PID 1080 wrote to memory of 2420 1080 f91db36135a994d00b92ec2b1be0fca9.exe 37 PID 1080 wrote to memory of 2420 1080 f91db36135a994d00b92ec2b1be0fca9.exe 37 PID 1080 wrote to memory of 2420 1080 f91db36135a994d00b92ec2b1be0fca9.exe 37 PID 1080 wrote to memory of 2784 1080 f91db36135a994d00b92ec2b1be0fca9.exe 38 PID 1080 wrote to memory of 2784 1080 f91db36135a994d00b92ec2b1be0fca9.exe 38 PID 1080 wrote to memory of 2784 1080 f91db36135a994d00b92ec2b1be0fca9.exe 38 PID 1080 wrote to memory of 2784 1080 f91db36135a994d00b92ec2b1be0fca9.exe 38 PID 1080 wrote to memory of 2784 1080 f91db36135a994d00b92ec2b1be0fca9.exe 38 PID 1080 wrote to memory of 2784 1080 f91db36135a994d00b92ec2b1be0fca9.exe 38 PID 1080 wrote to memory of 2784 1080 f91db36135a994d00b92ec2b1be0fca9.exe 38 PID 1080 wrote to memory of 2784 1080 f91db36135a994d00b92ec2b1be0fca9.exe 38 PID 1080 wrote to memory of 2120 1080 f91db36135a994d00b92ec2b1be0fca9.exe 39 PID 1080 wrote to memory of 2120 1080 f91db36135a994d00b92ec2b1be0fca9.exe 39 PID 1080 wrote to memory of 2120 1080 f91db36135a994d00b92ec2b1be0fca9.exe 39 PID 1080 wrote to memory of 2120 1080 f91db36135a994d00b92ec2b1be0fca9.exe 39 PID 1080 wrote to memory of 2120 1080 f91db36135a994d00b92ec2b1be0fca9.exe 39 PID 1080 wrote to memory of 2120 1080 f91db36135a994d00b92ec2b1be0fca9.exe 39 PID 1080 wrote to memory of 2120 1080 f91db36135a994d00b92ec2b1be0fca9.exe 39 PID 1080 wrote to memory of 2120 1080 f91db36135a994d00b92ec2b1be0fca9.exe 39
Processes
-
C:\Users\Admin\AppData\Local\Temp\f91db36135a994d00b92ec2b1be0fca9.exe"C:\Users\Admin\AppData\Local\Temp\f91db36135a994d00b92ec2b1be0fca9.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell set-mppreference -exclusionpath C:\2⤵
- Suspicious use of WriteProcessMemory
PID:916 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell set-mppreference -exclusionpath C:\3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2288
-
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe2⤵PID:2432
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe2⤵PID:888
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe2⤵PID:964
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe2⤵PID:2384
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe2⤵PID:2420
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe2⤵PID:2784
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe2⤵PID:2120
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe2⤵PID:2480
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe2⤵PID:1744
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe2⤵PID:1576
-