Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
26/12/2023, 09:34
Behavioral task
behavioral1
Sample
6434eaf1e3f70480bc40f1216bc4641f.exe
Resource
win7-20231215-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
6434eaf1e3f70480bc40f1216bc4641f.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
6434eaf1e3f70480bc40f1216bc4641f.exe
-
Size
38KB
-
MD5
6434eaf1e3f70480bc40f1216bc4641f
-
SHA1
bb7f3d02034b1267724983518cd831d2d4518c1a
-
SHA256
85231a8f5e9c681d7d5e6cdcc19da450eab541ba0c981f3d15322e8abfbb93e7
-
SHA512
ea6fdeeaac48418b3af99bde17ae77ac4b4e892a2665d997de4453b80df574bea3440d174b02c62c7c8e47c6bbfcdc39e2cd980b6134f1de81f204a690013496
-
SSDEEP
768:T7WXtbVrCBN29+eiYc3OZ6CV2ZVO8GEDcinf:T7WXtb1Cv+YYc3c65ZVOpUnf
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 3132 .exe -
resource yara_rule behavioral2/memory/2888-0-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/files/0x000600000001e5df-4.dat upx behavioral2/memory/3132-6-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/3132-7-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/2888-8-0x0000000000400000-0x000000000041F000-memory.dmp upx -
Modifies data under HKEY_USERS 15 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "248" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe -
Suspicious behavior: LoadsDriver 64 IoCs
pid Process 3660 Process not Found 1092 Process not Found 3632 Process not Found 2276 Process not Found 3912 Process not Found 4612 Process not Found 2812 Process not Found 5088 Process not Found 3868 Process not Found 1020 Process not Found 2436 Process not Found 1276 Process not Found 4328 Process not Found 924 Process not Found 4196 Process not Found 860 Process not Found 1848 Process not Found 2348 Process not Found 4632 Process not Found 1712 Process not Found 2084 Process not Found 1300 Process not Found 1312 Process not Found 4448 Process not Found 5056 Process not Found 4660 Process not Found 4456 Process not Found 404 Process not Found 1476 Process not Found 3992 Process not Found 4284 Process not Found 2708 Process not Found 1200 Process not Found 2280 Process not Found 2068 Process not Found 1564 Process not Found 1940 Process not Found 2020 Process not Found 2924 Process not Found 2508 Process not Found 1008 Process not Found 1660 Process not Found 4512 Process not Found 4332 Process not Found 1668 Process not Found 3928 Process not Found 4108 Process not Found 4788 Process not Found 548 Process not Found 2636 Process not Found 3604 Process not Found 752 Process not Found 2904 Process not Found 716 Process not Found 2108 Process not Found 3464 Process not Found 4652 Process not Found 5080 Process not Found 228 Process not Found 4756 Process not Found 4960 Process not Found 1372 Process not Found 4336 Process not Found 2976 Process not Found -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 2888 6434eaf1e3f70480bc40f1216bc4641f.exe Token: SeShutdownPrivilege 2888 6434eaf1e3f70480bc40f1216bc4641f.exe Token: SeShutdownPrivilege 2888 6434eaf1e3f70480bc40f1216bc4641f.exe Token: SeDebugPrivilege 2888 6434eaf1e3f70480bc40f1216bc4641f.exe Token: SeDebugPrivilege 3132 .exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4956 LogonUI.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2888 wrote to memory of 3132 2888 6434eaf1e3f70480bc40f1216bc4641f.exe 86 PID 2888 wrote to memory of 3132 2888 6434eaf1e3f70480bc40f1216bc4641f.exe 86 PID 2888 wrote to memory of 3132 2888 6434eaf1e3f70480bc40f1216bc4641f.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\6434eaf1e3f70480bc40f1216bc4641f.exe"C:\Users\Admin\AppData\Local\Temp\6434eaf1e3f70480bc40f1216bc4641f.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\.exeC:\Users\Admin\AppData\Local\Temp\.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3132
-
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa399d855 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4956
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
38KB
MD5b84f4d30d66b22bbfe3c86ee3bfcda7b
SHA1dcc9edbe553b4c15e55df8a7ee7d4403e962d2ff
SHA256b3e108bd65af42b1ac999c34420e015c8521cc263b39b829982b21eefb816e2f
SHA51237016c1f9fe9e2409c9516ba86d843fb1980136e30091342094cbcb9f2acf3c8b8239ee5dd15b493f38d32f454b64920a852b852b964821f9e1e95c8dcbaaa69