Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
219s -
max time network
289s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
26/12/2023, 15:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
783032c39a1b128532724362efb6c9f0.exe
Resource
win7-20231215-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
783032c39a1b128532724362efb6c9f0.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
783032c39a1b128532724362efb6c9f0.exe
-
Size
195KB
-
MD5
783032c39a1b128532724362efb6c9f0
-
SHA1
ce4d6f3554296bb48265fd245536a2ac527878d3
-
SHA256
21b8c34f00e3e840e24f365946f6cfbb87d21ebb2d76c666644bc9cbf52084fd
-
SHA512
199b3fa25d924f6539733c97c4bf800005e0468cdaf39ec25bbf12cf7d37d06ce0e6ed20b0db98efb803a045802c6e6716ac1b0ac0a8b5bf1a07477921dcaf50
-
SSDEEP
3072:17fM5EWgd1mEwIEaSdkQzRLs9T7r5NOSqeXWZ+2sDOgLw8DlKLD7hSs:1fkEdr3wnPZEHfOSqGlBLxRiA
Score
10/10
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 18 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\Logging services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\AuthorizedApplications services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Configurable services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\Logging services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Static\System services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Static services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\Logging services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\GloballyOpenPorts services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\PublicProfile services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Configurable\System services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts services.exe -
Modifies security service 2 TTPs 24 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\TriggerInfo services.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Type = "32" services.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Type = "32" services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters services.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\DeleteFlag = "1" services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\Parameters services.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\ErrorControl = "0" services.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\ErrorControl = "0" services.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\DeleteFlag = "1" services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\IPTLSIn services.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\Start = "4" services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\TriggerInfo\0 services.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" services.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\DeleteFlag = "1" services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Security services.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Start = "4" services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\Security services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\DHCP services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\IPTLSOut services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\RPC-EPMap services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\Teredo services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Security services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Parameters services.exe -
Deletes itself 1 IoCs
pid Process 2248 cmd.exe -
Registers COM server for autorun 1 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\{6367fb4b-b5c9-d074-f341-f311a16214c0}\\n." 783032c39a1b128532724362efb6c9f0.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InprocServer32 783032c39a1b128532724362efb6c9f0.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InprocServer32\ThreadingModel = "Both" 783032c39a1b128532724362efb6c9f0.exe -
Unexpected DNS network traffic destination 8 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 83.133.123.20 Destination IP 83.133.123.20 Destination IP 83.133.123.20 Destination IP 83.133.123.20 Destination IP 83.133.123.20 Destination IP 83.133.123.20 Destination IP 83.133.123.20 Destination IP 83.133.123.20 -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File created \systemroot\assembly\GAC_64\Desktop.ini services.exe File created \systemroot\assembly\GAC_32\Desktop.ini services.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2852 set thread context of 2248 2852 783032c39a1b128532724362efb6c9f0.exe 27 -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Installer\{6367fb4b-b5c9-d074-f341-f311a16214c0}\@ 783032c39a1b128532724362efb6c9f0.exe File created C:\Windows\Installer\{6367fb4b-b5c9-d074-f341-f311a16214c0}\n 783032c39a1b128532724362efb6c9f0.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\clsid 783032c39a1b128532724362efb6c9f0.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1} 783032c39a1b128532724362efb6c9f0.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InprocServer32 783032c39a1b128532724362efb6c9f0.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InprocServer32\ThreadingModel = "Both" 783032c39a1b128532724362efb6c9f0.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\{6367fb4b-b5c9-d074-f341-f311a16214c0}\\n." 783032c39a1b128532724362efb6c9f0.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
pid Process 2852 783032c39a1b128532724362efb6c9f0.exe 2852 783032c39a1b128532724362efb6c9f0.exe 2852 783032c39a1b128532724362efb6c9f0.exe 2852 783032c39a1b128532724362efb6c9f0.exe 2852 783032c39a1b128532724362efb6c9f0.exe 472 services.exe 2852 783032c39a1b128532724362efb6c9f0.exe -
Suspicious use of AdjustPrivilegeToken 28 IoCs
description pid Process Token: SeDebugPrivilege 2852 783032c39a1b128532724362efb6c9f0.exe Token: SeDebugPrivilege 2852 783032c39a1b128532724362efb6c9f0.exe Token: SeDebugPrivilege 2852 783032c39a1b128532724362efb6c9f0.exe Token: SeDebugPrivilege 472 services.exe Token: SeBackupPrivilege 472 services.exe Token: SeRestorePrivilege 472 services.exe Token: SeSecurityPrivilege 472 services.exe Token: SeTakeOwnershipPrivilege 472 services.exe Token: SeBackupPrivilege 472 services.exe Token: SeRestorePrivilege 472 services.exe Token: SeSecurityPrivilege 472 services.exe Token: SeTakeOwnershipPrivilege 472 services.exe Token: SeBackupPrivilege 472 services.exe Token: SeRestorePrivilege 472 services.exe Token: SeSecurityPrivilege 472 services.exe Token: SeTakeOwnershipPrivilege 472 services.exe Token: SeBackupPrivilege 472 services.exe Token: SeRestorePrivilege 472 services.exe Token: SeSecurityPrivilege 472 services.exe Token: SeTakeOwnershipPrivilege 472 services.exe Token: SeBackupPrivilege 472 services.exe Token: SeRestorePrivilege 472 services.exe Token: SeSecurityPrivilege 472 services.exe Token: SeTakeOwnershipPrivilege 472 services.exe Token: SeBackupPrivilege 472 services.exe Token: SeRestorePrivilege 472 services.exe Token: SeSecurityPrivilege 472 services.exe Token: SeTakeOwnershipPrivilege 472 services.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2852 wrote to memory of 1204 2852 783032c39a1b128532724362efb6c9f0.exe 17 PID 2852 wrote to memory of 1204 2852 783032c39a1b128532724362efb6c9f0.exe 17 PID 2852 wrote to memory of 472 2852 783032c39a1b128532724362efb6c9f0.exe 2 PID 2852 wrote to memory of 2248 2852 783032c39a1b128532724362efb6c9f0.exe 27 PID 2852 wrote to memory of 2248 2852 783032c39a1b128532724362efb6c9f0.exe 27 PID 2852 wrote to memory of 2248 2852 783032c39a1b128532724362efb6c9f0.exe 27 PID 2852 wrote to memory of 2248 2852 783032c39a1b128532724362efb6c9f0.exe 27 PID 2852 wrote to memory of 2248 2852 783032c39a1b128532724362efb6c9f0.exe 27
Processes
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe1⤵
- Modifies firewall policy service
- Modifies security service
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:472
-
C:\Users\Admin\AppData\Local\Temp\783032c39a1b128532724362efb6c9f0.exe"C:\Users\Admin\AppData\Local\Temp\783032c39a1b128532724362efb6c9f0.exe"1⤵
- Registers COM server for autorun
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Deletes itself
PID:2248
-
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1204
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD543604f0ef5e0e366faa088f5cb42fa44
SHA1b1756f9efa1f3ccccab1fa2c82d8d324cddf35cb
SHA256519b475307972bd12184e58b7bc89a23709314b3148decc83b2a4fcf70fb332b
SHA5122001547b926aa9c2718d7a023d3946add364f713e24b5225e5b91ea01dac203f3dc859c078c5ea0f9a14c01300ed1da09c03fa0d550e38c9d33478f23b905a16