Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
25/12/2023, 13:38
Behavioral task
behavioral1
Sample
2263d9661087c367cb757a58c0c505df.exe
Resource
win7-20231129-en
12 signatures
150 seconds
General
-
Target
2263d9661087c367cb757a58c0c505df.exe
-
Size
211KB
-
MD5
2263d9661087c367cb757a58c0c505df
-
SHA1
1ef5c1b3c3f95bd79657ebc0d6b9a3d602c7604b
-
SHA256
30ec8a71f9c5e303be353c877db015b733173281d81f7278b933bc5b4c956d73
-
SHA512
aa6c1abb9a7abed003b97cc90c8feadd706a5bde58a573d51af7deff07e8c6acd0b6be940f4d6306aafc7d808fe505447c5f896981fa990164a171b5d6d9a94e
-
SSDEEP
1536:M6qxQui3mTjqsuc9TGl0hwpWbdCwprWhVHh+Nk:0PzARp0dCwS+Nk
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List dwm.exe -
Stops running service(s) 3 TTPs
-
Executes dropped EXE 2 IoCs
pid Process 2820 dwm.exe 2164 dwm.exe -
Loads dropped DLL 2 IoCs
pid Process 2196 2263d9661087c367cb757a58c0c505df.exe 2196 2263d9661087c367cb757a58c0c505df.exe -
resource yara_rule behavioral1/memory/2196-0-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/memory/2196-10-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/memory/2164-16-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/memory/2820-15-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/memory/2820-12-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/memory/2164-17-0x0000000000400000-0x0000000000432000-memory.dmp upx -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat dwm.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\system\dwm.exe 2263d9661087c367cb757a58c0c505df.exe File created C:\Windows\system\dwm.exe 2263d9661087c367cb757a58c0c505df.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2208 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies data under HKEY_USERS 24 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings dwm.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" dwm.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0046000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 dwm.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3F6778D6-6084-4C66-927A-DC2A42130F35}\WpadDecisionTime = e0820c9ec537da01 dwm.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-fd-43-05-e3-85\WpadDecision = "0" dwm.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" dwm.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections dwm.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 dwm.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3F6778D6-6084-4C66-927A-DC2A42130F35}\0a-fd-43-05-e3-85 dwm.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-fd-43-05-e3-85\WpadDecisionReason = "1" dwm.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3F6778D6-6084-4C66-927A-DC2A42130F35}\WpadNetworkName = "Network 3" dwm.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-fd-43-05-e3-85 dwm.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad dwm.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3F6778D6-6084-4C66-927A-DC2A42130F35}\WpadDecisionReason = "1" dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ dwm.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" dwm.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" dwm.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 dwm.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3F6778D6-6084-4C66-927A-DC2A42130F35} dwm.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3F6778D6-6084-4C66-927A-DC2A42130F35}\WpadDecision = "0" dwm.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-fd-43-05-e3-85\WpadDecisionTime = e0820c9ec537da01 dwm.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2196 2263d9661087c367cb757a58c0c505df.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2196 wrote to memory of 2208 2196 2263d9661087c367cb757a58c0c505df.exe 15 PID 2196 wrote to memory of 2208 2196 2263d9661087c367cb757a58c0c505df.exe 15 PID 2196 wrote to memory of 2208 2196 2263d9661087c367cb757a58c0c505df.exe 15 PID 2196 wrote to memory of 2208 2196 2263d9661087c367cb757a58c0c505df.exe 15 PID 2196 wrote to memory of 2820 2196 2263d9661087c367cb757a58c0c505df.exe 31 PID 2196 wrote to memory of 2820 2196 2263d9661087c367cb757a58c0c505df.exe 31 PID 2196 wrote to memory of 2820 2196 2263d9661087c367cb757a58c0c505df.exe 31 PID 2196 wrote to memory of 2820 2196 2263d9661087c367cb757a58c0c505df.exe 31
Processes
-
C:\Windows\SysWOW64\sc.exesc delete darkness1⤵
- Launches sc.exe
PID:2208
-
C:\Users\Admin\AppData\Local\Temp\2263d9661087c367cb757a58c0c505df.exe"C:\Users\Admin\AppData\Local\Temp\2263d9661087c367cb757a58c0c505df.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Windows\system\dwm.exe"C:\Windows\system\dwm.exe" /start2⤵
- Executes dropped EXE
PID:2820
-
-
C:\Windows\system\dwm.exeC:\Windows\system\dwm.exe1⤵
- Modifies firewall policy service
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2164