Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
167s -
max time network
183s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
28/12/2023, 21:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f9c077fbd617508e47a46c55aa81d16d.exe
Resource
win7-20231215-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
f9c077fbd617508e47a46c55aa81d16d.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
f9c077fbd617508e47a46c55aa81d16d.exe
-
Size
135KB
-
MD5
f9c077fbd617508e47a46c55aa81d16d
-
SHA1
2f1d8c117a7363c35088b1e3380decce56cfdf04
-
SHA256
59ba59f342e0dfeca24912fe4728f7c544e0f4c1b96ea632d0031b97064d141f
-
SHA512
d33870eb9ba485aaec096118ba64cbb614468785c4dd041fd52f0718d568222e297138c3247fd499a1b1e2c830a9d6738885a99a0bf0bb90ee54e40539931ff0
-
SSDEEP
3072:WyQVsbe0H3j6lWe/gEojZQSeHrCcYJlhduMgEPzZN+RevcBZNZMXAGaA2aWtJ:5QVX0Tje/gM9HrCFzUizZIRBBZNZMXAp
Score
8/10
Malware Config
Signatures
-
Modifies AppInit DLL entries 2 TTPs
-
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\ws2helpXP.dll f9c077fbd617508e47a46c55aa81d16d.exe File opened for modification C:\Windows\SysWOW64\ws2helpXP.dll f9c077fbd617508e47a46c55aa81d16d.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\imm32.bmp f9c077fbd617508e47a46c55aa81d16d.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3600 f9c077fbd617508e47a46c55aa81d16d.exe 3600 f9c077fbd617508e47a46c55aa81d16d.exe 3600 f9c077fbd617508e47a46c55aa81d16d.exe 3600 f9c077fbd617508e47a46c55aa81d16d.exe 3600 f9c077fbd617508e47a46c55aa81d16d.exe 3600 f9c077fbd617508e47a46c55aa81d16d.exe 3600 f9c077fbd617508e47a46c55aa81d16d.exe 3600 f9c077fbd617508e47a46c55aa81d16d.exe 3600 f9c077fbd617508e47a46c55aa81d16d.exe 3600 f9c077fbd617508e47a46c55aa81d16d.exe 3600 f9c077fbd617508e47a46c55aa81d16d.exe 3600 f9c077fbd617508e47a46c55aa81d16d.exe 3600 f9c077fbd617508e47a46c55aa81d16d.exe 3600 f9c077fbd617508e47a46c55aa81d16d.exe 3600 f9c077fbd617508e47a46c55aa81d16d.exe 3600 f9c077fbd617508e47a46c55aa81d16d.exe 3600 f9c077fbd617508e47a46c55aa81d16d.exe 3600 f9c077fbd617508e47a46c55aa81d16d.exe 3600 f9c077fbd617508e47a46c55aa81d16d.exe 3600 f9c077fbd617508e47a46c55aa81d16d.exe 3600 f9c077fbd617508e47a46c55aa81d16d.exe 3600 f9c077fbd617508e47a46c55aa81d16d.exe 3600 f9c077fbd617508e47a46c55aa81d16d.exe 3600 f9c077fbd617508e47a46c55aa81d16d.exe 3600 f9c077fbd617508e47a46c55aa81d16d.exe 3600 f9c077fbd617508e47a46c55aa81d16d.exe 3600 f9c077fbd617508e47a46c55aa81d16d.exe 3600 f9c077fbd617508e47a46c55aa81d16d.exe 3600 f9c077fbd617508e47a46c55aa81d16d.exe 3600 f9c077fbd617508e47a46c55aa81d16d.exe 3600 f9c077fbd617508e47a46c55aa81d16d.exe 3600 f9c077fbd617508e47a46c55aa81d16d.exe 3600 f9c077fbd617508e47a46c55aa81d16d.exe 3600 f9c077fbd617508e47a46c55aa81d16d.exe 3600 f9c077fbd617508e47a46c55aa81d16d.exe 3600 f9c077fbd617508e47a46c55aa81d16d.exe 3600 f9c077fbd617508e47a46c55aa81d16d.exe 3600 f9c077fbd617508e47a46c55aa81d16d.exe 3600 f9c077fbd617508e47a46c55aa81d16d.exe 3600 f9c077fbd617508e47a46c55aa81d16d.exe 3600 f9c077fbd617508e47a46c55aa81d16d.exe 3600 f9c077fbd617508e47a46c55aa81d16d.exe 3600 f9c077fbd617508e47a46c55aa81d16d.exe 3600 f9c077fbd617508e47a46c55aa81d16d.exe 3600 f9c077fbd617508e47a46c55aa81d16d.exe 3600 f9c077fbd617508e47a46c55aa81d16d.exe 3600 f9c077fbd617508e47a46c55aa81d16d.exe 3600 f9c077fbd617508e47a46c55aa81d16d.exe 3600 f9c077fbd617508e47a46c55aa81d16d.exe 3600 f9c077fbd617508e47a46c55aa81d16d.exe 3600 f9c077fbd617508e47a46c55aa81d16d.exe 3600 f9c077fbd617508e47a46c55aa81d16d.exe 3600 f9c077fbd617508e47a46c55aa81d16d.exe 3600 f9c077fbd617508e47a46c55aa81d16d.exe 3600 f9c077fbd617508e47a46c55aa81d16d.exe 3600 f9c077fbd617508e47a46c55aa81d16d.exe 3600 f9c077fbd617508e47a46c55aa81d16d.exe 3600 f9c077fbd617508e47a46c55aa81d16d.exe 3600 f9c077fbd617508e47a46c55aa81d16d.exe 3600 f9c077fbd617508e47a46c55aa81d16d.exe 3600 f9c077fbd617508e47a46c55aa81d16d.exe 3600 f9c077fbd617508e47a46c55aa81d16d.exe 3600 f9c077fbd617508e47a46c55aa81d16d.exe 3600 f9c077fbd617508e47a46c55aa81d16d.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3600 f9c077fbd617508e47a46c55aa81d16d.exe Token: SeDebugPrivilege 3600 f9c077fbd617508e47a46c55aa81d16d.exe Token: SeDebugPrivilege 3600 f9c077fbd617508e47a46c55aa81d16d.exe Token: SeDebugPrivilege 3600 f9c077fbd617508e47a46c55aa81d16d.exe Token: SeDebugPrivilege 3600 f9c077fbd617508e47a46c55aa81d16d.exe Token: SeDebugPrivilege 3600 f9c077fbd617508e47a46c55aa81d16d.exe Token: SeDebugPrivilege 3600 f9c077fbd617508e47a46c55aa81d16d.exe Token: SeDebugPrivilege 3600 f9c077fbd617508e47a46c55aa81d16d.exe Token: SeDebugPrivilege 3600 f9c077fbd617508e47a46c55aa81d16d.exe Token: SeDebugPrivilege 3600 f9c077fbd617508e47a46c55aa81d16d.exe Token: SeDebugPrivilege 3600 f9c077fbd617508e47a46c55aa81d16d.exe Token: SeDebugPrivilege 3600 f9c077fbd617508e47a46c55aa81d16d.exe Token: SeDebugPrivilege 3600 f9c077fbd617508e47a46c55aa81d16d.exe Token: SeDebugPrivilege 3600 f9c077fbd617508e47a46c55aa81d16d.exe Token: SeDebugPrivilege 3600 f9c077fbd617508e47a46c55aa81d16d.exe Token: SeDebugPrivilege 3600 f9c077fbd617508e47a46c55aa81d16d.exe Token: SeDebugPrivilege 3600 f9c077fbd617508e47a46c55aa81d16d.exe Token: SeDebugPrivilege 3600 f9c077fbd617508e47a46c55aa81d16d.exe Token: SeDebugPrivilege 3600 f9c077fbd617508e47a46c55aa81d16d.exe Token: SeDebugPrivilege 3600 f9c077fbd617508e47a46c55aa81d16d.exe Token: SeDebugPrivilege 3600 f9c077fbd617508e47a46c55aa81d16d.exe Token: SeDebugPrivilege 3600 f9c077fbd617508e47a46c55aa81d16d.exe Token: SeDebugPrivilege 3600 f9c077fbd617508e47a46c55aa81d16d.exe Token: SeDebugPrivilege 3600 f9c077fbd617508e47a46c55aa81d16d.exe Token: SeDebugPrivilege 3600 f9c077fbd617508e47a46c55aa81d16d.exe Token: SeDebugPrivilege 3600 f9c077fbd617508e47a46c55aa81d16d.exe Token: SeDebugPrivilege 3600 f9c077fbd617508e47a46c55aa81d16d.exe Token: SeDebugPrivilege 3600 f9c077fbd617508e47a46c55aa81d16d.exe Token: SeDebugPrivilege 3600 f9c077fbd617508e47a46c55aa81d16d.exe Token: SeDebugPrivilege 3600 f9c077fbd617508e47a46c55aa81d16d.exe Token: SeDebugPrivilege 3600 f9c077fbd617508e47a46c55aa81d16d.exe Token: SeDebugPrivilege 3600 f9c077fbd617508e47a46c55aa81d16d.exe Token: SeDebugPrivilege 3600 f9c077fbd617508e47a46c55aa81d16d.exe Token: SeDebugPrivilege 3600 f9c077fbd617508e47a46c55aa81d16d.exe Token: SeDebugPrivilege 3600 f9c077fbd617508e47a46c55aa81d16d.exe Token: SeDebugPrivilege 3600 f9c077fbd617508e47a46c55aa81d16d.exe Token: SeDebugPrivilege 3600 f9c077fbd617508e47a46c55aa81d16d.exe Token: SeDebugPrivilege 3600 f9c077fbd617508e47a46c55aa81d16d.exe Token: SeDebugPrivilege 3600 f9c077fbd617508e47a46c55aa81d16d.exe Token: SeDebugPrivilege 3600 f9c077fbd617508e47a46c55aa81d16d.exe Token: SeDebugPrivilege 3600 f9c077fbd617508e47a46c55aa81d16d.exe Token: SeDebugPrivilege 3600 f9c077fbd617508e47a46c55aa81d16d.exe Token: SeDebugPrivilege 3600 f9c077fbd617508e47a46c55aa81d16d.exe Token: SeDebugPrivilege 3600 f9c077fbd617508e47a46c55aa81d16d.exe Token: SeDebugPrivilege 3600 f9c077fbd617508e47a46c55aa81d16d.exe Token: SeDebugPrivilege 3600 f9c077fbd617508e47a46c55aa81d16d.exe Token: SeDebugPrivilege 3600 f9c077fbd617508e47a46c55aa81d16d.exe Token: SeDebugPrivilege 3600 f9c077fbd617508e47a46c55aa81d16d.exe Token: SeDebugPrivilege 3600 f9c077fbd617508e47a46c55aa81d16d.exe Token: SeDebugPrivilege 3600 f9c077fbd617508e47a46c55aa81d16d.exe Token: SeDebugPrivilege 3600 f9c077fbd617508e47a46c55aa81d16d.exe Token: SeDebugPrivilege 3600 f9c077fbd617508e47a46c55aa81d16d.exe Token: SeDebugPrivilege 3600 f9c077fbd617508e47a46c55aa81d16d.exe Token: SeDebugPrivilege 3600 f9c077fbd617508e47a46c55aa81d16d.exe Token: SeDebugPrivilege 3600 f9c077fbd617508e47a46c55aa81d16d.exe Token: SeDebugPrivilege 3600 f9c077fbd617508e47a46c55aa81d16d.exe Token: SeDebugPrivilege 3600 f9c077fbd617508e47a46c55aa81d16d.exe Token: SeDebugPrivilege 3600 f9c077fbd617508e47a46c55aa81d16d.exe Token: SeDebugPrivilege 3600 f9c077fbd617508e47a46c55aa81d16d.exe Token: SeDebugPrivilege 3600 f9c077fbd617508e47a46c55aa81d16d.exe Token: SeDebugPrivilege 3600 f9c077fbd617508e47a46c55aa81d16d.exe Token: SeDebugPrivilege 3600 f9c077fbd617508e47a46c55aa81d16d.exe Token: SeDebugPrivilege 3600 f9c077fbd617508e47a46c55aa81d16d.exe Token: SeDebugPrivilege 3600 f9c077fbd617508e47a46c55aa81d16d.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3600 wrote to memory of 3456 3600 f9c077fbd617508e47a46c55aa81d16d.exe 95 PID 3600 wrote to memory of 3456 3600 f9c077fbd617508e47a46c55aa81d16d.exe 95 PID 3600 wrote to memory of 3456 3600 f9c077fbd617508e47a46c55aa81d16d.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\f9c077fbd617508e47a46c55aa81d16d.exe"C:\Users\Admin\AppData\Local\Temp\f9c077fbd617508e47a46c55aa81d16d.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3600 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\f9c077fbd617508e47a46c55aa81d16d.exe"2⤵PID:3456
-