Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
183s -
max time network
187s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25/12/2023, 16:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2d220abbec85cf9f7bd72b36969880fc.exe
Resource
win7-20231215-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2d220abbec85cf9f7bd72b36969880fc.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
2d220abbec85cf9f7bd72b36969880fc.exe
-
Size
336KB
-
MD5
2d220abbec85cf9f7bd72b36969880fc
-
SHA1
58cc4a0df23b58fa4b49af74f369b9de88d346fb
-
SHA256
356f8192676cbf3f4b1ed91fe9af0484dab3b36f7a7152eab61c4bb240e09eb9
-
SHA512
d3b94e431f0e14957ca6914bb0cdffb474987429c1ed39d11d1e1b2ff7fb3cda6d29a2bd2582208fe7bf946d056362a5a7eff43f14c44bc34a031164581d05a3
-
SSDEEP
6144:6iu0srKxP6nVMg1FENy/V/5c6thb+lazG8j:650srcyLjN/5c6thb+lazGe
Score
10/10
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 8 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\RSBotsPro.exe = "C:\\Users\\Admin\\AppData\\Roaming\\RSBotsPro.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\2d220abbec85cf9f7bd72b36969880fc.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2d220abbec85cf9f7bd72b36969880fc.exe:*:Enabled:Windows Messanger" reg.exe -
Modifies registry key 1 TTPs 4 IoCs
pid Process 2836 reg.exe 2748 reg.exe 2640 reg.exe 1356 reg.exe -
Suspicious use of AdjustPrivilegeToken 36 IoCs
description pid Process Token: 1 2832 2d220abbec85cf9f7bd72b36969880fc.exe Token: SeCreateTokenPrivilege 2832 2d220abbec85cf9f7bd72b36969880fc.exe Token: SeAssignPrimaryTokenPrivilege 2832 2d220abbec85cf9f7bd72b36969880fc.exe Token: SeLockMemoryPrivilege 2832 2d220abbec85cf9f7bd72b36969880fc.exe Token: SeIncreaseQuotaPrivilege 2832 2d220abbec85cf9f7bd72b36969880fc.exe Token: SeMachineAccountPrivilege 2832 2d220abbec85cf9f7bd72b36969880fc.exe Token: SeTcbPrivilege 2832 2d220abbec85cf9f7bd72b36969880fc.exe Token: SeSecurityPrivilege 2832 2d220abbec85cf9f7bd72b36969880fc.exe Token: SeTakeOwnershipPrivilege 2832 2d220abbec85cf9f7bd72b36969880fc.exe Token: SeLoadDriverPrivilege 2832 2d220abbec85cf9f7bd72b36969880fc.exe Token: SeSystemProfilePrivilege 2832 2d220abbec85cf9f7bd72b36969880fc.exe Token: SeSystemtimePrivilege 2832 2d220abbec85cf9f7bd72b36969880fc.exe Token: SeProfSingleProcessPrivilege 2832 2d220abbec85cf9f7bd72b36969880fc.exe Token: SeIncBasePriorityPrivilege 2832 2d220abbec85cf9f7bd72b36969880fc.exe Token: SeCreatePagefilePrivilege 2832 2d220abbec85cf9f7bd72b36969880fc.exe Token: SeCreatePermanentPrivilege 2832 2d220abbec85cf9f7bd72b36969880fc.exe Token: SeBackupPrivilege 2832 2d220abbec85cf9f7bd72b36969880fc.exe Token: SeRestorePrivilege 2832 2d220abbec85cf9f7bd72b36969880fc.exe Token: SeShutdownPrivilege 2832 2d220abbec85cf9f7bd72b36969880fc.exe Token: SeDebugPrivilege 2832 2d220abbec85cf9f7bd72b36969880fc.exe Token: SeAuditPrivilege 2832 2d220abbec85cf9f7bd72b36969880fc.exe Token: SeSystemEnvironmentPrivilege 2832 2d220abbec85cf9f7bd72b36969880fc.exe Token: SeChangeNotifyPrivilege 2832 2d220abbec85cf9f7bd72b36969880fc.exe Token: SeRemoteShutdownPrivilege 2832 2d220abbec85cf9f7bd72b36969880fc.exe Token: SeUndockPrivilege 2832 2d220abbec85cf9f7bd72b36969880fc.exe Token: SeSyncAgentPrivilege 2832 2d220abbec85cf9f7bd72b36969880fc.exe Token: SeEnableDelegationPrivilege 2832 2d220abbec85cf9f7bd72b36969880fc.exe Token: SeManageVolumePrivilege 2832 2d220abbec85cf9f7bd72b36969880fc.exe Token: SeImpersonatePrivilege 2832 2d220abbec85cf9f7bd72b36969880fc.exe Token: SeCreateGlobalPrivilege 2832 2d220abbec85cf9f7bd72b36969880fc.exe Token: 31 2832 2d220abbec85cf9f7bd72b36969880fc.exe Token: 32 2832 2d220abbec85cf9f7bd72b36969880fc.exe Token: 33 2832 2d220abbec85cf9f7bd72b36969880fc.exe Token: 34 2832 2d220abbec85cf9f7bd72b36969880fc.exe Token: 35 2832 2d220abbec85cf9f7bd72b36969880fc.exe Token: SeDebugPrivilege 2832 2d220abbec85cf9f7bd72b36969880fc.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2832 2d220abbec85cf9f7bd72b36969880fc.exe 2832 2d220abbec85cf9f7bd72b36969880fc.exe 2832 2d220abbec85cf9f7bd72b36969880fc.exe -
Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 2832 wrote to memory of 2824 2832 2d220abbec85cf9f7bd72b36969880fc.exe 27 PID 2832 wrote to memory of 2824 2832 2d220abbec85cf9f7bd72b36969880fc.exe 27 PID 2832 wrote to memory of 2824 2832 2d220abbec85cf9f7bd72b36969880fc.exe 27 PID 2832 wrote to memory of 2824 2832 2d220abbec85cf9f7bd72b36969880fc.exe 27 PID 2832 wrote to memory of 2716 2832 2d220abbec85cf9f7bd72b36969880fc.exe 38 PID 2832 wrote to memory of 2716 2832 2d220abbec85cf9f7bd72b36969880fc.exe 38 PID 2832 wrote to memory of 2716 2832 2d220abbec85cf9f7bd72b36969880fc.exe 38 PID 2832 wrote to memory of 2716 2832 2d220abbec85cf9f7bd72b36969880fc.exe 38 PID 2832 wrote to memory of 2976 2832 2d220abbec85cf9f7bd72b36969880fc.exe 36 PID 2832 wrote to memory of 2976 2832 2d220abbec85cf9f7bd72b36969880fc.exe 36 PID 2832 wrote to memory of 2976 2832 2d220abbec85cf9f7bd72b36969880fc.exe 36 PID 2832 wrote to memory of 2976 2832 2d220abbec85cf9f7bd72b36969880fc.exe 36 PID 2832 wrote to memory of 1176 2832 2d220abbec85cf9f7bd72b36969880fc.exe 28 PID 2832 wrote to memory of 1176 2832 2d220abbec85cf9f7bd72b36969880fc.exe 28 PID 2832 wrote to memory of 1176 2832 2d220abbec85cf9f7bd72b36969880fc.exe 28 PID 2832 wrote to memory of 1176 2832 2d220abbec85cf9f7bd72b36969880fc.exe 28 PID 1176 wrote to memory of 2748 1176 cmd.exe 30 PID 1176 wrote to memory of 2748 1176 cmd.exe 30 PID 1176 wrote to memory of 2748 1176 cmd.exe 30 PID 1176 wrote to memory of 2748 1176 cmd.exe 30 PID 2824 wrote to memory of 2836 2824 cmd.exe 29 PID 2824 wrote to memory of 2836 2824 cmd.exe 29 PID 2824 wrote to memory of 2836 2824 cmd.exe 29 PID 2824 wrote to memory of 2836 2824 cmd.exe 29 PID 2716 wrote to memory of 2640 2716 cmd.exe 31 PID 2716 wrote to memory of 2640 2716 cmd.exe 31 PID 2716 wrote to memory of 2640 2716 cmd.exe 31 PID 2716 wrote to memory of 2640 2716 cmd.exe 31 PID 2976 wrote to memory of 1356 2976 cmd.exe 32 PID 2976 wrote to memory of 1356 2976 cmd.exe 32 PID 2976 wrote to memory of 1356 2976 cmd.exe 32 PID 2976 wrote to memory of 1356 2976 cmd.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\2d220abbec85cf9f7bd72b36969880fc.exe"C:\Users\Admin\AppData\Local\Temp\2d220abbec85cf9f7bd72b36969880fc.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f2⤵
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- Modifies firewall policy service
- Modifies registry key
PID:2836
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\RSBotsPro.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\RSBotsPro.exe:*:Enabled:Windows Messanger" /f2⤵
- Suspicious use of WriteProcessMemory
PID:1176 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\RSBotsPro.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\RSBotsPro.exe:*:Enabled:Windows Messanger" /f3⤵
- Modifies firewall policy service
- Modifies registry key
PID:2748
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f2⤵
- Suspicious use of WriteProcessMemory
PID:2976
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\2d220abbec85cf9f7bd72b36969880fc.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\2d220abbec85cf9f7bd72b36969880fc.exe:*:Enabled:Windows Messanger" /f2⤵
- Suspicious use of WriteProcessMemory
PID:2716
-
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\2d220abbec85cf9f7bd72b36969880fc.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\2d220abbec85cf9f7bd72b36969880fc.exe:*:Enabled:Windows Messanger" /f1⤵
- Modifies firewall policy service
- Modifies registry key
PID:2640
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f1⤵
- Modifies firewall policy service
- Modifies registry key
PID:1356