Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
01/01/2024, 11:13
Behavioral task
behavioral1
Sample
3cb25b1e2019a0194a23c6d8e767228c.exe
Resource
win7-20231215-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
3cb25b1e2019a0194a23c6d8e767228c.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
3cb25b1e2019a0194a23c6d8e767228c.exe
-
Size
81KB
-
MD5
3cb25b1e2019a0194a23c6d8e767228c
-
SHA1
c4ca2261a852636617e047aedd57fe2c163efbdc
-
SHA256
7e4b3a54d7e22644051f40c3d631f4502093fc88913151761921b1fa4f50f1b1
-
SHA512
09e86840063485d43019a093ba66f07532bb666e3c3fd42c29d81a1dfe175ef7747d1b63692c2a70a5db2871f7d880fb0c0f44bee8f3763cdf4ae7633eb8d703
-
SSDEEP
1536:UT282Mk63APgjG0KPtyUlasodThq8PL+B8SUIcaf13A7NdPK:UC8hD+gjGPlyHsIhTT+HcaSLK
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/2088-0-0x0000000013150000-0x0000000013188000-memory.dmp upx behavioral1/memory/1388-5-0x0000000013150000-0x0000000013188000-memory.dmp upx behavioral1/memory/1388-8-0x0000000013150000-0x0000000013188000-memory.dmp upx behavioral1/memory/1388-11-0x0000000013150000-0x0000000013188000-memory.dmp upx behavioral1/memory/1388-17-0x0000000013150000-0x0000000013188000-memory.dmp upx behavioral1/memory/1388-23-0x0000000013150000-0x0000000013188000-memory.dmp upx behavioral1/memory/1388-26-0x0000000013150000-0x0000000013188000-memory.dmp upx behavioral1/memory/1388-32-0x0000000013150000-0x0000000013188000-memory.dmp upx behavioral1/memory/1388-29-0x0000000013150000-0x0000000013188000-memory.dmp upx behavioral1/memory/1388-20-0x0000000013150000-0x0000000013188000-memory.dmp upx behavioral1/memory/1388-14-0x0000000013150000-0x0000000013188000-memory.dmp upx behavioral1/memory/1388-35-0x0000000013150000-0x0000000013188000-memory.dmp upx behavioral1/memory/1388-41-0x0000000013150000-0x0000000013188000-memory.dmp upx behavioral1/memory/1388-44-0x0000000013150000-0x0000000013188000-memory.dmp upx behavioral1/memory/1388-47-0x0000000013150000-0x0000000013188000-memory.dmp upx behavioral1/memory/1388-53-0x0000000013150000-0x0000000013188000-memory.dmp upx behavioral1/memory/1388-56-0x0000000013150000-0x0000000013188000-memory.dmp upx behavioral1/memory/1388-65-0x0000000013150000-0x0000000013188000-memory.dmp upx behavioral1/memory/1388-62-0x0000000013150000-0x0000000013188000-memory.dmp upx behavioral1/memory/1388-50-0x0000000013150000-0x0000000013188000-memory.dmp upx behavioral1/memory/1388-38-0x0000000013150000-0x0000000013188000-memory.dmp upx behavioral1/memory/2088-170-0x0000000013150000-0x0000000013188000-memory.dmp upx -
Modifies WinLogon 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt\Asynchronous = "1" 3cb25b1e2019a0194a23c6d8e767228c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt 3cb25b1e2019a0194a23c6d8e767228c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify 3cb25b1e2019a0194a23c6d8e767228c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt\StartShell = "Run" 3cb25b1e2019a0194a23c6d8e767228c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt\Impersonate = "1" 3cb25b1e2019a0194a23c6d8e767228c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt\DLLName = "crypts.dll" 3cb25b1e2019a0194a23c6d8e767228c.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\crypts.dll 3cb25b1e2019a0194a23c6d8e767228c.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2088 3cb25b1e2019a0194a23c6d8e767228c.exe -
Suspicious use of WriteProcessMemory 56 IoCs
description pid Process procid_target PID 2088 wrote to memory of 1388 2088 3cb25b1e2019a0194a23c6d8e767228c.exe 10 PID 2088 wrote to memory of 1388 2088 3cb25b1e2019a0194a23c6d8e767228c.exe 10 PID 2088 wrote to memory of 1388 2088 3cb25b1e2019a0194a23c6d8e767228c.exe 10 PID 2088 wrote to memory of 1388 2088 3cb25b1e2019a0194a23c6d8e767228c.exe 10 PID 2088 wrote to memory of 1388 2088 3cb25b1e2019a0194a23c6d8e767228c.exe 10 PID 2088 wrote to memory of 1388 2088 3cb25b1e2019a0194a23c6d8e767228c.exe 10 PID 2088 wrote to memory of 1388 2088 3cb25b1e2019a0194a23c6d8e767228c.exe 10 PID 2088 wrote to memory of 1388 2088 3cb25b1e2019a0194a23c6d8e767228c.exe 10 PID 2088 wrote to memory of 1388 2088 3cb25b1e2019a0194a23c6d8e767228c.exe 10 PID 2088 wrote to memory of 1388 2088 3cb25b1e2019a0194a23c6d8e767228c.exe 10 PID 2088 wrote to memory of 1388 2088 3cb25b1e2019a0194a23c6d8e767228c.exe 10 PID 2088 wrote to memory of 1388 2088 3cb25b1e2019a0194a23c6d8e767228c.exe 10 PID 2088 wrote to memory of 1388 2088 3cb25b1e2019a0194a23c6d8e767228c.exe 10 PID 2088 wrote to memory of 1388 2088 3cb25b1e2019a0194a23c6d8e767228c.exe 10 PID 2088 wrote to memory of 1388 2088 3cb25b1e2019a0194a23c6d8e767228c.exe 10 PID 2088 wrote to memory of 1388 2088 3cb25b1e2019a0194a23c6d8e767228c.exe 10 PID 2088 wrote to memory of 1388 2088 3cb25b1e2019a0194a23c6d8e767228c.exe 10 PID 2088 wrote to memory of 1388 2088 3cb25b1e2019a0194a23c6d8e767228c.exe 10 PID 2088 wrote to memory of 1388 2088 3cb25b1e2019a0194a23c6d8e767228c.exe 10 PID 2088 wrote to memory of 1388 2088 3cb25b1e2019a0194a23c6d8e767228c.exe 10 PID 2088 wrote to memory of 1388 2088 3cb25b1e2019a0194a23c6d8e767228c.exe 10 PID 2088 wrote to memory of 1388 2088 3cb25b1e2019a0194a23c6d8e767228c.exe 10 PID 2088 wrote to memory of 1388 2088 3cb25b1e2019a0194a23c6d8e767228c.exe 10 PID 2088 wrote to memory of 1388 2088 3cb25b1e2019a0194a23c6d8e767228c.exe 10 PID 2088 wrote to memory of 1388 2088 3cb25b1e2019a0194a23c6d8e767228c.exe 10 PID 2088 wrote to memory of 1388 2088 3cb25b1e2019a0194a23c6d8e767228c.exe 10 PID 2088 wrote to memory of 1388 2088 3cb25b1e2019a0194a23c6d8e767228c.exe 10 PID 2088 wrote to memory of 1388 2088 3cb25b1e2019a0194a23c6d8e767228c.exe 10 PID 2088 wrote to memory of 1388 2088 3cb25b1e2019a0194a23c6d8e767228c.exe 10 PID 2088 wrote to memory of 1388 2088 3cb25b1e2019a0194a23c6d8e767228c.exe 10 PID 2088 wrote to memory of 1388 2088 3cb25b1e2019a0194a23c6d8e767228c.exe 10 PID 2088 wrote to memory of 1388 2088 3cb25b1e2019a0194a23c6d8e767228c.exe 10 PID 2088 wrote to memory of 1388 2088 3cb25b1e2019a0194a23c6d8e767228c.exe 10 PID 2088 wrote to memory of 1388 2088 3cb25b1e2019a0194a23c6d8e767228c.exe 10 PID 2088 wrote to memory of 1388 2088 3cb25b1e2019a0194a23c6d8e767228c.exe 10 PID 2088 wrote to memory of 1388 2088 3cb25b1e2019a0194a23c6d8e767228c.exe 10 PID 2088 wrote to memory of 1388 2088 3cb25b1e2019a0194a23c6d8e767228c.exe 10 PID 2088 wrote to memory of 1388 2088 3cb25b1e2019a0194a23c6d8e767228c.exe 10 PID 2088 wrote to memory of 1388 2088 3cb25b1e2019a0194a23c6d8e767228c.exe 10 PID 2088 wrote to memory of 1388 2088 3cb25b1e2019a0194a23c6d8e767228c.exe 10 PID 2088 wrote to memory of 1388 2088 3cb25b1e2019a0194a23c6d8e767228c.exe 10 PID 2088 wrote to memory of 1388 2088 3cb25b1e2019a0194a23c6d8e767228c.exe 10 PID 2088 wrote to memory of 1388 2088 3cb25b1e2019a0194a23c6d8e767228c.exe 10 PID 2088 wrote to memory of 1388 2088 3cb25b1e2019a0194a23c6d8e767228c.exe 10 PID 2088 wrote to memory of 1388 2088 3cb25b1e2019a0194a23c6d8e767228c.exe 10 PID 2088 wrote to memory of 1388 2088 3cb25b1e2019a0194a23c6d8e767228c.exe 10 PID 2088 wrote to memory of 1388 2088 3cb25b1e2019a0194a23c6d8e767228c.exe 10 PID 2088 wrote to memory of 1388 2088 3cb25b1e2019a0194a23c6d8e767228c.exe 10 PID 2088 wrote to memory of 1388 2088 3cb25b1e2019a0194a23c6d8e767228c.exe 10 PID 2088 wrote to memory of 1388 2088 3cb25b1e2019a0194a23c6d8e767228c.exe 10 PID 2088 wrote to memory of 1388 2088 3cb25b1e2019a0194a23c6d8e767228c.exe 10 PID 2088 wrote to memory of 1388 2088 3cb25b1e2019a0194a23c6d8e767228c.exe 10 PID 2088 wrote to memory of 1388 2088 3cb25b1e2019a0194a23c6d8e767228c.exe 10 PID 2088 wrote to memory of 1388 2088 3cb25b1e2019a0194a23c6d8e767228c.exe 10 PID 2088 wrote to memory of 1388 2088 3cb25b1e2019a0194a23c6d8e767228c.exe 10 PID 2088 wrote to memory of 1388 2088 3cb25b1e2019a0194a23c6d8e767228c.exe 10
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1388
-
C:\Users\Admin\AppData\Local\Temp\3cb25b1e2019a0194a23c6d8e767228c.exe"C:\Users\Admin\AppData\Local\Temp\3cb25b1e2019a0194a23c6d8e767228c.exe"2⤵
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2088
-