Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    5s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    31/12/2023, 05:50 UTC

General

  • Target

    2ab1bba297feb6086115d9f3ad81a7ab.exe

  • Size

    1.9MB

  • MD5

    2ab1bba297feb6086115d9f3ad81a7ab

  • SHA1

    3c591e1fb5550f3bb298e96251f8a0e2ae44b0ce

  • SHA256

    dabfdfccb61a75867d9e77cb416602e484035aae3673d6e81f18686d18b834e6

  • SHA512

    b7e25fca3e22a49caee8d4f95b10ba7c4fb96d631b26e111c1a9a1b73047fba6acd00b62d8763f951fa2b043f7ecc8b345ddbe141a4b7bbcf23488a1d61f6946

  • SSDEEP

    12288:UZWtI6RkAunupOB0fONunupOB0fONunupOB0fONunupOB0fONunupOB0fONunup3:UuhaCOxOxOxOxOxOEOn4

Score
10/10

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
  • Blocks application from running via registry modification 17 IoCs

    Adds application to list of disallowed applications.

  • Sets file execution options in registry 2 TTPs 20 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 4 IoCs
  • Drops file in System32 directory 2 IoCs
  • Drops file in Windows directory 9 IoCs
  • Launches sc.exe 8 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Runs net.exe
  • Runs regedit.exe 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Views/modifies file attributes 1 TTPs 16 IoCs

Processes

  • C:\Windows\SysWOW64\net.exe
    net.exe start schedule /y
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2632
    • C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start schedule /y
      2⤵
        PID:2732
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c C:\Windows\system32\Option.bat
      1⤵
        PID:2616
      • C:\Users\Admin\AppData\Local\Temp\2ab1bba297feb6086115d9f3ad81a7ab.exe
        "C:\Users\Admin\AppData\Local\Temp\2ab1bba297feb6086115d9f3ad81a7ab.exe"
        1⤵
        • Loads dropped DLL
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1728
        • C:\Windows\SysWOW64\reg.exe
          C:\Windows\system32\reg.exe delete "hklm\SYSTEM\ControlSet001\Control\SafeBoot\Network\{4D36E967-E325-11CE-BFC1-08002BE10318}" /f
          2⤵
            PID:1488
          • C:\Windows\SysWOW64\reg.exe
            C:\Windows\system32\reg.exe delete "hklm\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}" /f
            2⤵
              PID:2592
            • C:\Windows\SysWOW64\regedit.exe
              regedit.exe /s C:\Windows\regedt32.sys
              2⤵
              • Modifies visibility of file extensions in Explorer
              • Blocks application from running via registry modification
              • Sets file execution options in registry
              • Runs regedit.exe
              PID:756
            • C:\Windows\SysWOW64\sc.exe
              C:\Windows\system32\sc.exe config srservice start= disabled
              2⤵
              • Launches sc.exe
              PID:848
            • C:\Windows\system\KavUpda.exe
              C:\Windows\system\KavUpda.exe
              2⤵
              • Executes dropped EXE
              • Drops file in System32 directory
              • Drops file in Windows directory
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of SetWindowsHookEx
              PID:1340
              • C:\Windows\SysWOW64\net.exe
                net.exe stop sharedaccess /y
                3⤵
                  PID:1976
                  • C:\Windows\SysWOW64\net1.exe
                    C:\Windows\system32\net1 stop sharedaccess /y
                    4⤵
                      PID:1064
                  • C:\Windows\SysWOW64\net.exe
                    net.exe stop 360timeprot /y
                    3⤵
                      PID:2984
                      • C:\Windows\SysWOW64\net1.exe
                        C:\Windows\system32\net1 stop 360timeprot /y
                        4⤵
                          PID:2184
                      • C:\Windows\SysWOW64\cmd.exe
                        cmd /c rmdir F:\Autorun.inf /s /q
                        3⤵
                          PID:900
                        • C:\Windows\SysWOW64\cmd.exe
                          cmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d
                          3⤵
                            PID:2372
                          • C:\Windows\SysWOW64\reg.exe
                            C:\Windows\system32\reg.exe delete "hklm\SYSTEM\ControlSet001\Control\SafeBoot\Network\{4D36E967-E325-11CE-BFC1-08002BE10318}" /f
                            3⤵
                              PID:1280
                            • C:\Windows\SysWOW64\reg.exe
                              C:\Windows\system32\reg.exe delete "hklm\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}" /f
                              3⤵
                                PID:1696
                              • C:\Windows\SysWOW64\sc.exe
                                C:\Windows\system32\sc.exe config srservice start= disabled
                                3⤵
                                • Launches sc.exe
                                PID:2300
                                • C:\Windows\SysWOW64\attrib.exe
                                  attrib -s -h -r C:\Autorun.inf\*.* /s /d
                                  4⤵
                                  • Views/modifies file attributes
                                  PID:880
                              • C:\Windows\SysWOW64\sc.exe
                                C:\Windows\system32\sc.exe config wscsvc start= disabled
                                3⤵
                                • Launches sc.exe
                                PID:2376
                              • C:\Windows\SysWOW64\sc.exe
                                C:\Windows\system32\sc.exe config SharedAccess start= disabled
                                3⤵
                                • Launches sc.exe
                                PID:1484
                                • C:\Windows\SysWOW64\attrib.exe
                                  attrib -s -h -r F:\Autorun.inf\*.* /s /d
                                  4⤵
                                  • Views/modifies file attributes
                                  PID:1044
                              • C:\Windows\SysWOW64\sc.exe
                                C:\Windows\system32\sc.exe config srservice start= disabled
                                3⤵
                                • Launches sc.exe
                                PID:328
                              • C:\Windows\SysWOW64\net.exe
                                net.exe stop srservice /y
                                3⤵
                                  PID:1044
                                • C:\Windows\SysWOW64\net.exe
                                  net.exe stop wuauserv /y
                                  3⤵
                                    PID:268
                                  • C:\Windows\SysWOW64\net.exe
                                    net.exe stop wscsvc /y
                                    3⤵
                                      PID:1776
                                    • C:\Windows\SysWOW64\cmd.exe
                                      cmd /c at 5:32:53 PM C:\Windows\Sysinf.bat
                                      3⤵
                                        PID:2384
                                      • C:\Windows\SysWOW64\cmd.exe
                                        cmd /c at 5:29:53 PM C:\Windows\Sysinf.bat
                                        3⤵
                                          PID:1964
                                        • C:\Windows\SysWOW64\At.exe
                                          At.exe 5:30:51 PM C:\Windows\Help\HelpCat.exe
                                          3⤵
                                            PID:2620
                                            • C:\Windows\SysWOW64\attrib.exe
                                              attrib -s -h -r C:\Autorun.inf\*.* /s /d
                                              4⤵
                                              • Views/modifies file attributes
                                              PID:608
                                          • C:\Windows\SysWOW64\cmd.exe
                                            cmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d
                                            3⤵
                                              PID:2840
                                              • C:\Windows\SysWOW64\attrib.exe
                                                attrib -s -h -r C:\Autorun.inf\*.* /s /d
                                                4⤵
                                                • Views/modifies file attributes
                                                PID:984
                                            • C:\Windows\SysWOW64\cmd.exe
                                              cmd /c rmdir C:\Autorun.inf /s /q
                                              3⤵
                                                PID:2396
                                              • C:\Windows\SysWOW64\cmd.exe
                                                cmd /c rmdir F:\Autorun.inf /s /q
                                                3⤵
                                                  PID:2352
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  cmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d
                                                  3⤵
                                                    PID:1528
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    cmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d
                                                    3⤵
                                                      PID:2760
                                                      • C:\Windows\SysWOW64\attrib.exe
                                                        attrib -s -h -r C:\Autorun.inf\*.* /s /d
                                                        4⤵
                                                        • Views/modifies file attributes
                                                        PID:1260
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      cmd /c rmdir C:\Autorun.inf /s /q
                                                      3⤵
                                                        PID:3008
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        cmd /c rmdir F:\Autorun.inf /s /q
                                                        3⤵
                                                          PID:2948
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          cmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d
                                                          3⤵
                                                            PID:1580
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            cmd /c rmdir C:\Autorun.inf /s /q
                                                            3⤵
                                                              PID:2584
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              cmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d
                                                              3⤵
                                                                PID:1344
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                cmd /c rmdir F:\Autorun.inf /s /q
                                                                3⤵
                                                                  PID:2532
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  cmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d
                                                                  3⤵
                                                                    PID:1736
                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                    cmd /c rmdir C:\Autorun.inf /s /q
                                                                    3⤵
                                                                      PID:2020
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      cmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d
                                                                      3⤵
                                                                        PID:752
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        cmd /c rmdir F:\Autorun.inf /s /q
                                                                        3⤵
                                                                          PID:812
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          cmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d
                                                                          3⤵
                                                                            PID:1404
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            cmd /c rmdir C:\Autorun.inf /s /q
                                                                            3⤵
                                                                              PID:2068
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              cmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d
                                                                              3⤵
                                                                                PID:2620
                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                cmd /c rmdir F:\Autorun.inf /s /q
                                                                                3⤵
                                                                                  PID:2412
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  cmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d
                                                                                  3⤵
                                                                                    PID:1484
                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                    cmd /c rmdir C:\Autorun.inf /s /q
                                                                                    3⤵
                                                                                      PID:1688
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      cmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d
                                                                                      3⤵
                                                                                        PID:2300
                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                        cmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d
                                                                                        3⤵
                                                                                          PID:2160
                                                                                          • C:\Windows\SysWOW64\attrib.exe
                                                                                            attrib -s -h -r F:\Autorun.inf\*.* /s /d
                                                                                            4⤵
                                                                                            • Views/modifies file attributes
                                                                                            PID:3036
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          cmd /c rmdir F:\Autorun.inf /s /q
                                                                                          3⤵
                                                                                            PID:1972
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            cmd /c rmdir C:\Autorun.inf /s /q
                                                                                            3⤵
                                                                                              PID:2316
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              cmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d
                                                                                              3⤵
                                                                                                PID:1628
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                cmd /c rmdir F:\Autorun.inf /s /q
                                                                                                3⤵
                                                                                                  PID:1536
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  cmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d
                                                                                                  3⤵
                                                                                                    PID:1508
                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                    cmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d
                                                                                                    3⤵
                                                                                                      PID:2080
                                                                                                      • C:\Windows\SysWOW64\attrib.exe
                                                                                                        attrib -s -h -r C:\Autorun.inf\*.* /s /d
                                                                                                        4⤵
                                                                                                        • Views/modifies file attributes
                                                                                                        PID:2752
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      cmd /c rmdir C:\Autorun.inf /s /q
                                                                                                      3⤵
                                                                                                        PID:2552
                                                                                                    • C:\Windows\SysWOW64\sc.exe
                                                                                                      C:\Windows\system32\sc.exe config wscsvc start= disabled
                                                                                                      2⤵
                                                                                                      • Launches sc.exe
                                                                                                      PID:2912
                                                                                                    • C:\Windows\SysWOW64\sc.exe
                                                                                                      C:\Windows\system32\sc.exe config SharedAccess start= disabled
                                                                                                      2⤵
                                                                                                      • Launches sc.exe
                                                                                                      PID:2864
                                                                                                    • C:\Windows\SysWOW64\sc.exe
                                                                                                      C:\Windows\system32\sc.exe config srservice start= disabled
                                                                                                      2⤵
                                                                                                      • Launches sc.exe
                                                                                                      PID:2368
                                                                                                    • C:\Windows\SysWOW64\net.exe
                                                                                                      net.exe stop 360timeprot /y
                                                                                                      2⤵
                                                                                                        PID:2572
                                                                                                      • C:\Windows\SysWOW64\net.exe
                                                                                                        net.exe stop srservice /y
                                                                                                        2⤵
                                                                                                          PID:2524
                                                                                                        • C:\Windows\SysWOW64\net.exe
                                                                                                          net.exe stop wuauserv /y
                                                                                                          2⤵
                                                                                                            PID:2688
                                                                                                          • C:\Windows\SysWOW64\net.exe
                                                                                                            net.exe stop sharedaccess /y
                                                                                                            2⤵
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:2700
                                                                                                          • C:\Windows\SysWOW64\net.exe
                                                                                                            net.exe stop wscsvc /y
                                                                                                            2⤵
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:2824
                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                            cmd /c at 5:32:50 PM C:\Windows\Sysinf.bat
                                                                                                            2⤵
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:3004
                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                            cmd /c at 5:29:50 PM C:\Windows\Sysinf.bat
                                                                                                            2⤵
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:2656
                                                                                                          • C:\Windows\SysWOW64\At.exe
                                                                                                            At.exe 5:30:48 PM C:\Windows\Help\HelpCat.exe
                                                                                                            2⤵
                                                                                                              PID:2816
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2ab1bba297feb6086115d9f3ad81a7ab~4.exe
                                                                                                              2ab1bba297feb6086115d9f3ad81a7ab~4.exe
                                                                                                              2⤵
                                                                                                              • Executes dropped EXE
                                                                                                              PID:1196
                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                            cmd /c C:\Windows\system32\Option.bat
                                                                                                            1⤵
                                                                                                              PID:804
                                                                                                            • C:\Windows\SysWOW64\net1.exe
                                                                                                              C:\Windows\system32\net1 start schedule /y
                                                                                                              1⤵
                                                                                                                PID:2004
                                                                                                              • C:\Windows\SysWOW64\net.exe
                                                                                                                net.exe start schedule /y
                                                                                                                1⤵
                                                                                                                  PID:2036
                                                                                                                • C:\Windows\SysWOW64\net1.exe
                                                                                                                  C:\Windows\system32\net1 stop 360timeprot /y
                                                                                                                  1⤵
                                                                                                                    PID:2940
                                                                                                                  • C:\Windows\SysWOW64\net1.exe
                                                                                                                    C:\Windows\system32\net1 stop srservice /y
                                                                                                                    1⤵
                                                                                                                      PID:2932
                                                                                                                    • C:\Windows\SysWOW64\net1.exe
                                                                                                                      C:\Windows\system32\net1 stop wuauserv /y
                                                                                                                      1⤵
                                                                                                                        PID:2076
                                                                                                                      • C:\Windows\SysWOW64\net1.exe
                                                                                                                        C:\Windows\system32\net1 stop sharedaccess /y
                                                                                                                        1⤵
                                                                                                                          PID:1580
                                                                                                                          • C:\Windows\SysWOW64\attrib.exe
                                                                                                                            attrib -s -h -r F:\Autorun.inf\*.* /s /d
                                                                                                                            2⤵
                                                                                                                            • Views/modifies file attributes
                                                                                                                            PID:2540
                                                                                                                        • C:\Windows\SysWOW64\net1.exe
                                                                                                                          C:\Windows\system32\net1 stop wscsvc /y
                                                                                                                          1⤵
                                                                                                                            PID:2016
                                                                                                                          • C:\Windows\SysWOW64\at.exe
                                                                                                                            at 5:32:50 PM C:\Windows\Sysinf.bat
                                                                                                                            1⤵
                                                                                                                              PID:2644
                                                                                                                            • C:\Windows\SysWOW64\at.exe
                                                                                                                              at 5:29:50 PM C:\Windows\Sysinf.bat
                                                                                                                              1⤵
                                                                                                                                PID:2532
                                                                                                                              • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                attrib -s -h -r F:\Autorun.inf\*.* /s /d
                                                                                                                                1⤵
                                                                                                                                • Views/modifies file attributes
                                                                                                                                PID:1872
                                                                                                                              • C:\Windows\SysWOW64\net1.exe
                                                                                                                                C:\Windows\system32\net1 stop srservice /y
                                                                                                                                1⤵
                                                                                                                                  PID:1856
                                                                                                                                • C:\Windows\SysWOW64\net1.exe
                                                                                                                                  C:\Windows\system32\net1 stop wuauserv /y
                                                                                                                                  1⤵
                                                                                                                                    PID:1780
                                                                                                                                  • C:\Windows\SysWOW64\at.exe
                                                                                                                                    at 5:32:53 PM C:\Windows\Sysinf.bat
                                                                                                                                    1⤵
                                                                                                                                      PID:1392
                                                                                                                                    • C:\Windows\SysWOW64\at.exe
                                                                                                                                      at 5:29:53 PM C:\Windows\Sysinf.bat
                                                                                                                                      1⤵
                                                                                                                                        PID:928
                                                                                                                                      • C:\Windows\SysWOW64\net1.exe
                                                                                                                                        C:\Windows\system32\net1 stop wscsvc /y
                                                                                                                                        1⤵
                                                                                                                                          PID:1456
                                                                                                                                        • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                          attrib -s -h -r F:\Autorun.inf\*.* /s /d
                                                                                                                                          1⤵
                                                                                                                                          • Views/modifies file attributes
                                                                                                                                          PID:2724
                                                                                                                                        • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                          attrib -s -h -r C:\Autorun.inf\*.* /s /d
                                                                                                                                          1⤵
                                                                                                                                          • Views/modifies file attributes
                                                                                                                                          PID:1584
                                                                                                                                        • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                          attrib -s -h -r F:\Autorun.inf\*.* /s /d
                                                                                                                                          1⤵
                                                                                                                                          • Views/modifies file attributes
                                                                                                                                          PID:2704
                                                                                                                                        • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                          attrib -s -h -r C:\Autorun.inf\*.* /s /d
                                                                                                                                          1⤵
                                                                                                                                          • Views/modifies file attributes
                                                                                                                                          PID:1744
                                                                                                                                        • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                          attrib -s -h -r F:\Autorun.inf\*.* /s /d
                                                                                                                                          1⤵
                                                                                                                                          • Views/modifies file attributes
                                                                                                                                          PID:1948
                                                                                                                                        • C:\Windows\system32\conhost.exe
                                                                                                                                          \??\C:\Windows\system32\conhost.exe "15975216404765208881123474500-436266789-1329852590-1635191480-13023011281320824318"
                                                                                                                                          1⤵
                                                                                                                                            PID:1280
                                                                                                                                          • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                            attrib -s -h -r C:\Autorun.inf\*.* /s /d
                                                                                                                                            1⤵
                                                                                                                                            • Views/modifies file attributes
                                                                                                                                            PID:888
                                                                                                                                          • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                            attrib -s -h -r F:\Autorun.inf\*.* /s /d
                                                                                                                                            1⤵
                                                                                                                                            • Views/modifies file attributes
                                                                                                                                            PID:2836

                                                                                                                                          Network

                                                                                                                                          MITRE ATT&CK Enterprise v15

                                                                                                                                          Replay Monitor

                                                                                                                                          Loading Replay Monitor...

                                                                                                                                          Downloads

                                                                                                                                          • memory/1728-0-0x0000000000400000-0x0000000000436000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            216KB

                                                                                                                                          We care about your privacy.

                                                                                                                                          This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.