Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
91s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
22/09/2023, 02:06
Behavioral task
behavioral1
Sample
1eea5073c05f06eb99fc1a0bc1f19a9641037d507dadb6a4620cd875a563c93c.exe
Resource
win7-20230831-en
windows7-x64
9 signatures
150 seconds
General
-
Target
1eea5073c05f06eb99fc1a0bc1f19a9641037d507dadb6a4620cd875a563c93c.exe
-
Size
11.1MB
-
MD5
4edebaf2db8a9692c62283a06ba37cc8
-
SHA1
ac698b4892c703ab1df30ad3995bef26537771df
-
SHA256
1eea5073c05f06eb99fc1a0bc1f19a9641037d507dadb6a4620cd875a563c93c
-
SHA512
9c411787cd579ff405c6f4ea863d3354cf9199315951ac04d84cfd06c21efa2dac0a74ea83b61c2cb30e129fdfad41e53008a003e64e7e54588d0404a9121644
-
SSDEEP
196608:+pjfEMCIgaPQ5sjWwjNvexZtT4gaZD/oStzCX/eu7aVhJnwz0a:+xxxgaPQqO94rD/oSgjaVTwz0
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 1eea5073c05f06eb99fc1a0bc1f19a9641037d507dadb6a4620cd875a563c93c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 1eea5073c05f06eb99fc1a0bc1f19a9641037d507dadb6a4620cd875a563c93c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 1eea5073c05f06eb99fc1a0bc1f19a9641037d507dadb6a4620cd875a563c93c.exe -
resource yara_rule behavioral2/memory/676-27-0x0000000003A50000-0x0000000003A77000-memory.dmp upx behavioral2/memory/676-28-0x0000000003A50000-0x0000000003A77000-memory.dmp upx -
resource yara_rule behavioral2/memory/676-2-0x0000000000400000-0x00000000019AD000-memory.dmp vmprotect behavioral2/memory/676-9-0x0000000000400000-0x00000000019AD000-memory.dmp vmprotect behavioral2/memory/676-43-0x0000000000400000-0x00000000019AD000-memory.dmp vmprotect behavioral2/memory/676-44-0x0000000000400000-0x00000000019AD000-memory.dmp vmprotect -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 1eea5073c05f06eb99fc1a0bc1f19a9641037d507dadb6a4620cd875a563c93c.exe -
Drops file in Windows directory 13 IoCs
description ioc Process File created C:\Windows\Langlizdgd\È˲ιû.bmp 1eea5073c05f06eb99fc1a0bc1f19a9641037d507dadb6a4620cd875a563c93c.exe File created C:\Windows\Langlizdgd\ó´ÌÒ.bmp 1eea5073c05f06eb99fc1a0bc1f19a9641037d507dadb6a4620cd875a563c93c.exe File created C:\Windows\Langlizdgd\ºìľÈÎÎñͼ.bmp 1eea5073c05f06eb99fc1a0bc1f19a9641037d507dadb6a4620cd875a563c93c.exe File created C:\Windows\Langlizdgd\ºìľÈÎÎñͼ1.bmp 1eea5073c05f06eb99fc1a0bc1f19a9641037d507dadb6a4620cd875a563c93c.exe File created C:\Windows\Langlizdgd\ˮīÈÎÎñ1.bmp 1eea5073c05f06eb99fc1a0bc1f19a9641037d507dadb6a4620cd875a563c93c.exe File created C:\Windows\Langlizdgd\×óÉϽÇ.bmp 1eea5073c05f06eb99fc1a0bc1f19a9641037d507dadb6a4620cd875a563c93c.exe File created C:\Windows\Langlizdgd\±³°üÈÎÎñͼ±ê1.bmp 1eea5073c05f06eb99fc1a0bc1f19a9641037d507dadb6a4620cd875a563c93c.exe File created C:\Windows\Langlizdgd\±³°üÉåÑýÏã.bmp 1eea5073c05f06eb99fc1a0bc1f19a9641037d507dadb6a4620cd875a563c93c.exe File created C:\Windows\Langlizdgd\Í·Ïñ¿òÏÂÉåÑýÏã.bmp 1eea5073c05f06eb99fc1a0bc1f19a9641037d507dadb6a4620cd875a563c93c.exe File created C:\Windows\Langlizdgd\Í·Ïñ¿òÏÂÉåÑýÏã1.bmp 1eea5073c05f06eb99fc1a0bc1f19a9641037d507dadb6a4620cd875a563c93c.exe File created C:\Windows\Langlizdgd\ˮīÈÎÎñ.bmp 1eea5073c05f06eb99fc1a0bc1f19a9641037d507dadb6a4620cd875a563c93c.exe File created C:\Windows\Langlizdgd\×Ö¿â.txt 1eea5073c05f06eb99fc1a0bc1f19a9641037d507dadb6a4620cd875a563c93c.exe File created C:\Windows\Langlizdgd\±³°üÈÎÎñͼ±ê.bmp 1eea5073c05f06eb99fc1a0bc1f19a9641037d507dadb6a4620cd875a563c93c.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 676 1eea5073c05f06eb99fc1a0bc1f19a9641037d507dadb6a4620cd875a563c93c.exe 676 1eea5073c05f06eb99fc1a0bc1f19a9641037d507dadb6a4620cd875a563c93c.exe 676 1eea5073c05f06eb99fc1a0bc1f19a9641037d507dadb6a4620cd875a563c93c.exe 676 1eea5073c05f06eb99fc1a0bc1f19a9641037d507dadb6a4620cd875a563c93c.exe -
Suspicious use of AdjustPrivilegeToken 49 IoCs
description pid Process Token: SeDebugPrivilege 676 1eea5073c05f06eb99fc1a0bc1f19a9641037d507dadb6a4620cd875a563c93c.exe Token: 1 676 1eea5073c05f06eb99fc1a0bc1f19a9641037d507dadb6a4620cd875a563c93c.exe Token: SeCreateTokenPrivilege 676 1eea5073c05f06eb99fc1a0bc1f19a9641037d507dadb6a4620cd875a563c93c.exe Token: SeAssignPrimaryTokenPrivilege 676 1eea5073c05f06eb99fc1a0bc1f19a9641037d507dadb6a4620cd875a563c93c.exe Token: SeLockMemoryPrivilege 676 1eea5073c05f06eb99fc1a0bc1f19a9641037d507dadb6a4620cd875a563c93c.exe Token: SeIncreaseQuotaPrivilege 676 1eea5073c05f06eb99fc1a0bc1f19a9641037d507dadb6a4620cd875a563c93c.exe Token: SeMachineAccountPrivilege 676 1eea5073c05f06eb99fc1a0bc1f19a9641037d507dadb6a4620cd875a563c93c.exe Token: SeTcbPrivilege 676 1eea5073c05f06eb99fc1a0bc1f19a9641037d507dadb6a4620cd875a563c93c.exe Token: SeSecurityPrivilege 676 1eea5073c05f06eb99fc1a0bc1f19a9641037d507dadb6a4620cd875a563c93c.exe Token: SeTakeOwnershipPrivilege 676 1eea5073c05f06eb99fc1a0bc1f19a9641037d507dadb6a4620cd875a563c93c.exe Token: SeLoadDriverPrivilege 676 1eea5073c05f06eb99fc1a0bc1f19a9641037d507dadb6a4620cd875a563c93c.exe Token: SeSystemProfilePrivilege 676 1eea5073c05f06eb99fc1a0bc1f19a9641037d507dadb6a4620cd875a563c93c.exe Token: SeSystemtimePrivilege 676 1eea5073c05f06eb99fc1a0bc1f19a9641037d507dadb6a4620cd875a563c93c.exe Token: SeProfSingleProcessPrivilege 676 1eea5073c05f06eb99fc1a0bc1f19a9641037d507dadb6a4620cd875a563c93c.exe Token: SeIncBasePriorityPrivilege 676 1eea5073c05f06eb99fc1a0bc1f19a9641037d507dadb6a4620cd875a563c93c.exe Token: SeCreatePagefilePrivilege 676 1eea5073c05f06eb99fc1a0bc1f19a9641037d507dadb6a4620cd875a563c93c.exe Token: SeCreatePermanentPrivilege 676 1eea5073c05f06eb99fc1a0bc1f19a9641037d507dadb6a4620cd875a563c93c.exe Token: SeBackupPrivilege 676 1eea5073c05f06eb99fc1a0bc1f19a9641037d507dadb6a4620cd875a563c93c.exe Token: SeRestorePrivilege 676 1eea5073c05f06eb99fc1a0bc1f19a9641037d507dadb6a4620cd875a563c93c.exe Token: SeShutdownPrivilege 676 1eea5073c05f06eb99fc1a0bc1f19a9641037d507dadb6a4620cd875a563c93c.exe Token: SeDebugPrivilege 676 1eea5073c05f06eb99fc1a0bc1f19a9641037d507dadb6a4620cd875a563c93c.exe Token: SeAuditPrivilege 676 1eea5073c05f06eb99fc1a0bc1f19a9641037d507dadb6a4620cd875a563c93c.exe Token: SeSystemEnvironmentPrivilege 676 1eea5073c05f06eb99fc1a0bc1f19a9641037d507dadb6a4620cd875a563c93c.exe Token: SeChangeNotifyPrivilege 676 1eea5073c05f06eb99fc1a0bc1f19a9641037d507dadb6a4620cd875a563c93c.exe Token: SeRemoteShutdownPrivilege 676 1eea5073c05f06eb99fc1a0bc1f19a9641037d507dadb6a4620cd875a563c93c.exe Token: SeUndockPrivilege 676 1eea5073c05f06eb99fc1a0bc1f19a9641037d507dadb6a4620cd875a563c93c.exe Token: SeSyncAgentPrivilege 676 1eea5073c05f06eb99fc1a0bc1f19a9641037d507dadb6a4620cd875a563c93c.exe Token: SeEnableDelegationPrivilege 676 1eea5073c05f06eb99fc1a0bc1f19a9641037d507dadb6a4620cd875a563c93c.exe Token: SeManageVolumePrivilege 676 1eea5073c05f06eb99fc1a0bc1f19a9641037d507dadb6a4620cd875a563c93c.exe Token: SeImpersonatePrivilege 676 1eea5073c05f06eb99fc1a0bc1f19a9641037d507dadb6a4620cd875a563c93c.exe Token: SeCreateGlobalPrivilege 676 1eea5073c05f06eb99fc1a0bc1f19a9641037d507dadb6a4620cd875a563c93c.exe Token: 31 676 1eea5073c05f06eb99fc1a0bc1f19a9641037d507dadb6a4620cd875a563c93c.exe Token: 32 676 1eea5073c05f06eb99fc1a0bc1f19a9641037d507dadb6a4620cd875a563c93c.exe Token: 33 676 1eea5073c05f06eb99fc1a0bc1f19a9641037d507dadb6a4620cd875a563c93c.exe Token: 34 676 1eea5073c05f06eb99fc1a0bc1f19a9641037d507dadb6a4620cd875a563c93c.exe Token: 35 676 1eea5073c05f06eb99fc1a0bc1f19a9641037d507dadb6a4620cd875a563c93c.exe Token: 36 676 1eea5073c05f06eb99fc1a0bc1f19a9641037d507dadb6a4620cd875a563c93c.exe Token: 37 676 1eea5073c05f06eb99fc1a0bc1f19a9641037d507dadb6a4620cd875a563c93c.exe Token: 38 676 1eea5073c05f06eb99fc1a0bc1f19a9641037d507dadb6a4620cd875a563c93c.exe Token: 39 676 1eea5073c05f06eb99fc1a0bc1f19a9641037d507dadb6a4620cd875a563c93c.exe Token: 40 676 1eea5073c05f06eb99fc1a0bc1f19a9641037d507dadb6a4620cd875a563c93c.exe Token: 41 676 1eea5073c05f06eb99fc1a0bc1f19a9641037d507dadb6a4620cd875a563c93c.exe Token: 42 676 1eea5073c05f06eb99fc1a0bc1f19a9641037d507dadb6a4620cd875a563c93c.exe Token: 43 676 1eea5073c05f06eb99fc1a0bc1f19a9641037d507dadb6a4620cd875a563c93c.exe Token: 44 676 1eea5073c05f06eb99fc1a0bc1f19a9641037d507dadb6a4620cd875a563c93c.exe Token: 45 676 1eea5073c05f06eb99fc1a0bc1f19a9641037d507dadb6a4620cd875a563c93c.exe Token: 46 676 1eea5073c05f06eb99fc1a0bc1f19a9641037d507dadb6a4620cd875a563c93c.exe Token: 47 676 1eea5073c05f06eb99fc1a0bc1f19a9641037d507dadb6a4620cd875a563c93c.exe Token: 48 676 1eea5073c05f06eb99fc1a0bc1f19a9641037d507dadb6a4620cd875a563c93c.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 676 1eea5073c05f06eb99fc1a0bc1f19a9641037d507dadb6a4620cd875a563c93c.exe 676 1eea5073c05f06eb99fc1a0bc1f19a9641037d507dadb6a4620cd875a563c93c.exe 676 1eea5073c05f06eb99fc1a0bc1f19a9641037d507dadb6a4620cd875a563c93c.exe -
System policy modification 1 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 1eea5073c05f06eb99fc1a0bc1f19a9641037d507dadb6a4620cd875a563c93c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 1eea5073c05f06eb99fc1a0bc1f19a9641037d507dadb6a4620cd875a563c93c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 1eea5073c05f06eb99fc1a0bc1f19a9641037d507dadb6a4620cd875a563c93c.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1eea5073c05f06eb99fc1a0bc1f19a9641037d507dadb6a4620cd875a563c93c.exe"C:\Users\Admin\AppData\Local\Temp\1eea5073c05f06eb99fc1a0bc1f19a9641037d507dadb6a4620cd875a563c93c.exe"1⤵
- UAC bypass
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:676