Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
26/11/2023, 08:46
Static task
static1
Behavioral task
behavioral1
Sample
b35e1b1fa32a323b029b01b9cf136309.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
b35e1b1fa32a323b029b01b9cf136309.exe
Resource
win10v2004-20231020-en
General
-
Target
b35e1b1fa32a323b029b01b9cf136309.exe
-
Size
209KB
-
MD5
b35e1b1fa32a323b029b01b9cf136309
-
SHA1
1e2ce20398031c3ca7af5bc37e8db72210c3eae8
-
SHA256
a6320d82830e7f5e29a80342019dc44272096f8473afec272dfd1bfc5c4d80a0
-
SHA512
a136fe87a6941056117328056bd80bab2b8e653d57dc4a76e5998bf6ad253aaa3e01536a78cf4194f3b97e496cbb9d42beaa2eb428a34a8dc77c9ed820b70690
-
SSDEEP
6144:YOB8K/S3r3FfK3yDrjQVEzUIVhK+2aZyRO:YBKKzFfKCbQVEzNz4R
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2288 svchost.exe -
Loads dropped DLL 2 IoCs
pid Process 1164 b35e1b1fa32a323b029b01b9cf136309.exe 1164 b35e1b1fa32a323b029b01b9cf136309.exe -
Modifies WinLogon 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\8b9d3528 = "C:\\Windows\\apppatch\\svchost.exe" b35e1b1fa32a323b029b01b9cf136309.exe -
Drops file in Program Files directory 16 IoCs
description ioc Process File created C:\Program Files (x86)\Windows Defender\pupycag.com svchost.exe File created C:\Program Files (x86)\Windows Defender\gadyciz.com svchost.exe File created C:\Program Files (x86)\Windows Defender\purylev.com svchost.exe File created C:\Program Files (x86)\Windows Defender\qetyhyg.com svchost.exe File created C:\Program Files (x86)\Windows Defender\gatyhub.com svchost.exe File created C:\Program Files (x86)\Windows Defender\galyqaz.com svchost.exe File created C:\Program Files (x86)\Windows Defender\lyrysor.com svchost.exe File created C:\Program Files (x86)\Windows Defender\qetyfuv.com svchost.exe File created C:\Program Files (x86)\Windows Defender\galynuh.com svchost.exe File created C:\Program Files (x86)\Windows Defender\lymyxid.com svchost.exe File created C:\Program Files (x86)\Windows Defender\qexyhuv.com svchost.exe File created C:\Program Files (x86)\Windows Defender\vonypom.com svchost.exe File created C:\Program Files (x86)\Windows Defender\lysyfyj.com svchost.exe File created C:\Program Files (x86)\Windows Defender\vofycot.com svchost.exe File created C:\Program Files (x86)\Windows Defender\vojyqem.com svchost.exe File created C:\Program Files (x86)\Windows Defender\vocyzit.com svchost.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\apppatch\svchost.exe b35e1b1fa32a323b029b01b9cf136309.exe File opened for modification C:\Windows\apppatch\svchost.exe b35e1b1fa32a323b029b01b9cf136309.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000_CLASSES\Local Settings\MuiCache svchost.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2288 svchost.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1164 b35e1b1fa32a323b029b01b9cf136309.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeSecurityPrivilege 1164 b35e1b1fa32a323b029b01b9cf136309.exe Token: SeSecurityPrivilege 1164 b35e1b1fa32a323b029b01b9cf136309.exe Token: SeSecurityPrivilege 2288 svchost.exe Token: SeSecurityPrivilege 2288 svchost.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1164 wrote to memory of 2288 1164 b35e1b1fa32a323b029b01b9cf136309.exe 28 PID 1164 wrote to memory of 2288 1164 b35e1b1fa32a323b029b01b9cf136309.exe 28 PID 1164 wrote to memory of 2288 1164 b35e1b1fa32a323b029b01b9cf136309.exe 28 PID 1164 wrote to memory of 2288 1164 b35e1b1fa32a323b029b01b9cf136309.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\b35e1b1fa32a323b029b01b9cf136309.exe"C:\Users\Admin\AppData\Local\Temp\b35e1b1fa32a323b029b01b9cf136309.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1164 -
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2288
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58c6e087a2328e7fe4cbe101fec21301a
SHA1423187b9d16b0edd81971c830ff30d73460fffc7
SHA2565ba09091d5ebd96b34d3559a7cb2f328430bfd70f9cb50b3ece1b83a7010f37e
SHA5121153975420bbba567ab4845123b2f1deef17603f7301a343eb33a64500025d5a97a283369a013f5a5376533d2f95a02af4223dbeb9d6e00393c9c7b95c9f6570
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD594ea2c013ad31941c815d74a139f0c79
SHA1a55a6902426b633df777efedfe96627496053bc5
SHA25671fdb0b4f05a657230c43ca188db5b88b7745df9347a2047524dae34a9ecf06f
SHA5124e24439e2c16a7c46fa1958f13161c2e56d4ddd4aac19588e1d072ac08432026feac8778c49235d0fc1735e3cb45335b1d204cfd68ef82a77544d360d335570a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD538f37d4af045bb5233699532d0500fac
SHA1d26f31660252e8fe6df0d0e0b0e1c3506a84f237
SHA2566d533bef0ad5c6b837661ce1707dce95b13116119f42c28418d8f530c49c431b
SHA512ba995e3a19546da35762e323f9988577d0356480e74585c166326db1ac7f32b3ef0166f8a40d5e667df799b090cca43089ba4ea4e51914ee84c10cc6c4e321b0
-
Filesize
61KB
MD5f3441b8572aae8801c04f3060b550443
SHA14ef0a35436125d6821831ef36c28ffaf196cda15
SHA2566720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf
SHA5125ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9
-
Filesize
163KB
MD59441737383d21192400eca82fda910ec
SHA1725e0d606a4fc9ba44aa8ffde65bed15e65367e4
SHA256bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5
SHA5127608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf
-
Filesize
209KB
MD56181e52c87d360ad309ca8a68ba8450f
SHA1a4a41409ca822daa9e8256d30adabf3fbbe6939a
SHA2567095178a056665adbacb8e546f181dcb57de2764c70f6e8612218ebd066a90ab
SHA512297de26fc1892608b631ce5c1b41cdac9d4671a531305a86889964c38181a55f141cd60211cacfea169f1658d502564b805e458ebf21b02c67eca2f86ddc1b45
-
Filesize
209KB
MD56181e52c87d360ad309ca8a68ba8450f
SHA1a4a41409ca822daa9e8256d30adabf3fbbe6939a
SHA2567095178a056665adbacb8e546f181dcb57de2764c70f6e8612218ebd066a90ab
SHA512297de26fc1892608b631ce5c1b41cdac9d4671a531305a86889964c38181a55f141cd60211cacfea169f1658d502564b805e458ebf21b02c67eca2f86ddc1b45
-
Filesize
209KB
MD56181e52c87d360ad309ca8a68ba8450f
SHA1a4a41409ca822daa9e8256d30adabf3fbbe6939a
SHA2567095178a056665adbacb8e546f181dcb57de2764c70f6e8612218ebd066a90ab
SHA512297de26fc1892608b631ce5c1b41cdac9d4671a531305a86889964c38181a55f141cd60211cacfea169f1658d502564b805e458ebf21b02c67eca2f86ddc1b45
-
Filesize
209KB
MD56181e52c87d360ad309ca8a68ba8450f
SHA1a4a41409ca822daa9e8256d30adabf3fbbe6939a
SHA2567095178a056665adbacb8e546f181dcb57de2764c70f6e8612218ebd066a90ab
SHA512297de26fc1892608b631ce5c1b41cdac9d4671a531305a86889964c38181a55f141cd60211cacfea169f1658d502564b805e458ebf21b02c67eca2f86ddc1b45
-
Filesize
209KB
MD56181e52c87d360ad309ca8a68ba8450f
SHA1a4a41409ca822daa9e8256d30adabf3fbbe6939a
SHA2567095178a056665adbacb8e546f181dcb57de2764c70f6e8612218ebd066a90ab
SHA512297de26fc1892608b631ce5c1b41cdac9d4671a531305a86889964c38181a55f141cd60211cacfea169f1658d502564b805e458ebf21b02c67eca2f86ddc1b45