Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
85s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
07/01/2024, 19:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ad69ba9f0c1b6d2e22141d0cfbfdf892.exe
Resource
win7-20231215-en
11 signatures
150 seconds
General
-
Target
ad69ba9f0c1b6d2e22141d0cfbfdf892.exe
-
Size
116KB
-
MD5
ad69ba9f0c1b6d2e22141d0cfbfdf892
-
SHA1
d0fb135c6dbf4d67e9e80ea422ad0f3a0afcf5ce
-
SHA256
383df27b84ca79e918b559f8450046bcdce04616aa39a3849b046941d4bc6a52
-
SHA512
b8f26cbee38afbcf8ff0f76f780d972f1464bada7563cbaf4a957b82b79b897668cb29c4feed22c45f7154d5978d8a0e4303f19fcd5c66663378dbcea6c269fb
-
SSDEEP
1536:/R0vxn3Pc0LCH9MtbvabUDzJYWu3BvbSGBYYonJasu7o:/R2xn3k0CdM1vabyzJYWqxbFBYBn0e
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,c:\\program files (x86)\\microsoft\\watermark.exe" svchost.exe -
Executes dropped EXE 1 IoCs
pid Process 2052 WaterMark.exe -
Loads dropped DLL 2 IoCs
pid Process 2236 ad69ba9f0c1b6d2e22141d0cfbfdf892.exe 2236 ad69ba9f0c1b6d2e22141d0cfbfdf892.exe -
resource yara_rule behavioral1/memory/2236-1-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2236-9-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2236-7-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2052-30-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2052-29-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2236-6-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2236-5-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2236-4-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2236-2-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2052-428-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2052-432-0x0000000000400000-0x0000000000421000-memory.dmp upx -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\dmlconf.dat svchost.exe File opened for modification C:\Windows\SysWOW64\dmlconf.dat svchost.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\klist.exe svchost.exe File opened for modification C:\Program Files\7-Zip\7-zip32.dll svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Filters\msgfilt.dll svchost.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\sqlxmlx.dll svchost.exe File opened for modification C:\Program Files\Internet Explorer\F12.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\java.exe svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\mraut.dll svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\mshwgst.dll svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Green Bubbles.htm svchost.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\tnameserv.exe svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\wsimport.exe svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\tiptsf.dll svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe svchost.exe File opened for modification C:\Program Files\Common Files\System\msadc\msadcer.dll svchost.exe File opened for modification C:\Program Files\Internet Explorer\msdbg2.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstack.exe svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\dicjp.dll svchost.exe File opened for modification C:\Program Files\Internet Explorer\JSProfilerCore.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jconsole.exe svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\tipskins.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javafxpackager.exe svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jcmd.exe svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\micaut.dll svchost.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\msdaps.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jrunscript.exe svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\imjplm.dll svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\Microsoft.Ink.dll svchost.exe File opened for modification C:\Program Files\Common Files\System\msadc\msdaremr.dll svchost.exe File opened for modification C:\Program Files\7-Zip\7zG.exe svchost.exe File opened for modification C:\Program Files\Common Files\System\msadc\msadcfr.dll svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\InkWatson.exe svchost.exe File opened for modification C:\Program Files\Common Files\System\DirectDB.dll svchost.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\msdaosp.dll svchost.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javac.exe svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\dtplugin\npdeployJava1.dll svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Hand Prints.htm svchost.exe File opened for modification C:\Program Files\Common Files\System\msadc\msdaprst.dll svchost.exe File opened for modification C:\Program Files\Internet Explorer\D3DCompiler_47.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\idlj.exe svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\InkObj.dll svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\msinfo32.exe svchost.exe File opened for modification C:\Program Files\Common Files\System\ado\msado15.dll svchost.exe File opened for modification C:\Program Files\Common Files\System\ado\msadomd.dll svchost.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\vulkan-1.dll svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Stars.htm svchost.exe File opened for modification C:\Program Files\DVD Maker\Pipeline.dll svchost.exe File opened for modification C:\Program Files\Internet Explorer\DiagnosticsHub_is.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javaws.exe svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jhat.exe svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jli.dll svchost.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\sqloledb.dll svchost.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\optimization_guide_internal.dll svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\IpsMigrationPlugin.dll svchost.exe File opened for modification C:\Program Files\Common Files\System\msadc\msadds.dll svchost.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL svchost.exe File opened for modification C:\Program Files\Common Files\System\msadc\msdarem.dll svchost.exe File opened for modification C:\Program Files\Common Files\System\wab32.dll svchost.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\libGLESv2.dll svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXEV.DLL svchost.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\MSTTSCommon.dll svchost.exe -
Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 2052 WaterMark.exe 2052 WaterMark.exe 2052 WaterMark.exe 2052 WaterMark.exe 2052 WaterMark.exe 2052 WaterMark.exe 2052 WaterMark.exe 2052 WaterMark.exe 2604 svchost.exe 2604 svchost.exe 2604 svchost.exe 2604 svchost.exe 2604 svchost.exe 2604 svchost.exe 2604 svchost.exe 2604 svchost.exe 2604 svchost.exe 2604 svchost.exe 2604 svchost.exe 2604 svchost.exe 2604 svchost.exe 2604 svchost.exe 2604 svchost.exe 2604 svchost.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2052 WaterMark.exe Token: SeDebugPrivilege 2604 svchost.exe Token: SeDebugPrivilege 2052 WaterMark.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 2236 ad69ba9f0c1b6d2e22141d0cfbfdf892.exe 2052 WaterMark.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2236 wrote to memory of 2052 2236 ad69ba9f0c1b6d2e22141d0cfbfdf892.exe 15 PID 2236 wrote to memory of 2052 2236 ad69ba9f0c1b6d2e22141d0cfbfdf892.exe 15 PID 2236 wrote to memory of 2052 2236 ad69ba9f0c1b6d2e22141d0cfbfdf892.exe 15 PID 2236 wrote to memory of 2052 2236 ad69ba9f0c1b6d2e22141d0cfbfdf892.exe 15 PID 2052 wrote to memory of 2660 2052 WaterMark.exe 14 PID 2052 wrote to memory of 2660 2052 WaterMark.exe 14 PID 2052 wrote to memory of 2660 2052 WaterMark.exe 14 PID 2052 wrote to memory of 2660 2052 WaterMark.exe 14 PID 2052 wrote to memory of 2660 2052 WaterMark.exe 14 PID 2052 wrote to memory of 2660 2052 WaterMark.exe 14 PID 2052 wrote to memory of 2660 2052 WaterMark.exe 14 PID 2052 wrote to memory of 2660 2052 WaterMark.exe 14 PID 2052 wrote to memory of 2660 2052 WaterMark.exe 14 PID 2052 wrote to memory of 2660 2052 WaterMark.exe 14 PID 2052 wrote to memory of 2604 2052 WaterMark.exe 30 PID 2052 wrote to memory of 2604 2052 WaterMark.exe 30 PID 2052 wrote to memory of 2604 2052 WaterMark.exe 30 PID 2052 wrote to memory of 2604 2052 WaterMark.exe 30 PID 2052 wrote to memory of 2604 2052 WaterMark.exe 30 PID 2052 wrote to memory of 2604 2052 WaterMark.exe 30 PID 2052 wrote to memory of 2604 2052 WaterMark.exe 30 PID 2052 wrote to memory of 2604 2052 WaterMark.exe 30 PID 2052 wrote to memory of 2604 2052 WaterMark.exe 30 PID 2052 wrote to memory of 2604 2052 WaterMark.exe 30 PID 2604 wrote to memory of 260 2604 svchost.exe 7 PID 2604 wrote to memory of 260 2604 svchost.exe 7 PID 2604 wrote to memory of 260 2604 svchost.exe 7 PID 2604 wrote to memory of 260 2604 svchost.exe 7 PID 2604 wrote to memory of 260 2604 svchost.exe 7 PID 2604 wrote to memory of 336 2604 svchost.exe 6 PID 2604 wrote to memory of 336 2604 svchost.exe 6 PID 2604 wrote to memory of 336 2604 svchost.exe 6 PID 2604 wrote to memory of 336 2604 svchost.exe 6 PID 2604 wrote to memory of 336 2604 svchost.exe 6 PID 2604 wrote to memory of 372 2604 svchost.exe 5 PID 2604 wrote to memory of 372 2604 svchost.exe 5 PID 2604 wrote to memory of 372 2604 svchost.exe 5 PID 2604 wrote to memory of 372 2604 svchost.exe 5 PID 2604 wrote to memory of 372 2604 svchost.exe 5 PID 2604 wrote to memory of 384 2604 svchost.exe 4 PID 2604 wrote to memory of 384 2604 svchost.exe 4 PID 2604 wrote to memory of 384 2604 svchost.exe 4 PID 2604 wrote to memory of 384 2604 svchost.exe 4 PID 2604 wrote to memory of 384 2604 svchost.exe 4 PID 2604 wrote to memory of 420 2604 svchost.exe 3 PID 2604 wrote to memory of 420 2604 svchost.exe 3 PID 2604 wrote to memory of 420 2604 svchost.exe 3 PID 2604 wrote to memory of 420 2604 svchost.exe 3 PID 2604 wrote to memory of 420 2604 svchost.exe 3 PID 2604 wrote to memory of 468 2604 svchost.exe 2 PID 2604 wrote to memory of 468 2604 svchost.exe 2 PID 2604 wrote to memory of 468 2604 svchost.exe 2 PID 2604 wrote to memory of 468 2604 svchost.exe 2 PID 2604 wrote to memory of 468 2604 svchost.exe 2 PID 2604 wrote to memory of 476 2604 svchost.exe 1 PID 2604 wrote to memory of 476 2604 svchost.exe 1 PID 2604 wrote to memory of 476 2604 svchost.exe 1 PID 2604 wrote to memory of 476 2604 svchost.exe 1 PID 2604 wrote to memory of 476 2604 svchost.exe 1 PID 2604 wrote to memory of 484 2604 svchost.exe 8 PID 2604 wrote to memory of 484 2604 svchost.exe 8 PID 2604 wrote to memory of 484 2604 svchost.exe 8 PID 2604 wrote to memory of 484 2604 svchost.exe 8 PID 2604 wrote to memory of 484 2604 svchost.exe 8
Processes
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵PID:476
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe1⤵PID:468
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted2⤵PID:740
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted2⤵PID:788
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"3⤵PID:1168
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs2⤵PID:828
-
C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /F /T /R3⤵PID:2300
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService2⤵PID:960
-
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe2⤵PID:2344
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation2⤵PID:2504
-
-
C:\Windows\system32\taskhost.exe"taskhost.exe"2⤵PID:1100
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork2⤵PID:1068
-
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe2⤵PID:332
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService2⤵PID:108
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS2⤵PID:656
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch2⤵PID:576
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -Embedding3⤵PID:1620
-
-
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:420
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵PID:384
-
C:\Windows\system32\wininit.exewininit.exe1⤵PID:372
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe2⤵PID:484
-
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵PID:336
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe1⤵PID:260
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe1⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
- Drops file in Program Files directory
PID:2660
-
C:\Program Files (x86)\Microsoft\WaterMark.exe"C:\Program Files (x86)\Microsoft\WaterMark.exe"1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2604
-
-
C:\Users\Admin\AppData\Local\Temp\ad69ba9f0c1b6d2e22141d0cfbfdf892.exe"C:\Users\Admin\AppData\Local\Temp\ad69ba9f0c1b6d2e22141d0cfbfdf892.exe"1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2236
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1728
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1196