Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
14/01/2024, 13:30
General
-
Target
b7f218e507f9c5b46add1865b6ea130d13918371b236865d3acc1191a20dfedb.exe
-
Size
705KB
-
MD5
372c3c5872cb016a4a29d0bb283b1cb2
-
SHA1
6fefba5095eae11c63cfbf86b1582fbf5fb59b0f
-
SHA256
b7f218e507f9c5b46add1865b6ea130d13918371b236865d3acc1191a20dfedb
-
SHA512
22b4baba146585bd636266f3979e2062c8c387b51dab558e725484998edbe0557003e17e69323b1b967d4e55387d133f5d9703e871b8eb5bae95e2b3f24d6d0f
-
SSDEEP
12288:wW9B+VJFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:wW9Bq8NDFKYmKOF0zr31JwAlcR3QC0O3
Malware Config
Signatures
-
Executes dropped EXE 22 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 24 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 64 IoCs
-
Suspicious behavior: EnumeratesProcesses 7 IoCs
-
Suspicious behavior: LoadsDriver 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 42 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\b7f218e507f9c5b46add1865b6ea130d13918371b236865d3acc1191a20dfedb.exe"C:\Users\Admin\AppData\Local\Temp\b7f218e507f9c5b46add1865b6ea130d13918371b236865d3acc1191a20dfedb.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 916 920 928 8192 924 9002⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
781KB
MD5e309f7818e33611e2dae90efac3d3b6a
SHA145a698ee4d143b80e3a02809b4a17e0b317b9175
SHA2566b47595f7cfae7ce921f7bb01c01b8a1e99c207e4ac4a74bc8824701c612c93e
SHA5120809e2fee8aac2e2470436c18b25f60ec563e8801f166b819da03a4562eece6d31d2d21b9c644ad90064557cbd05e080de66beefb6db8193a6fafb90fcb21575
-
Filesize
92KB
MD5f5017437fed334d8579b5a92d090be21
SHA179a666d563fd8ea51929cf94dc3c30f2ea23d072
SHA2568b02d4f17711c6af42af8d3b256689afae8e3985ec23a2f96c90af34e6353c28
SHA51241cffb91bc3a822099b64ad973f58c477f4426b890d883469de493ff91ff7517d7d7b9b62fa6105f1763d043bb59ec73a4db2f1e283ef8e0e8467bd95e773399
-
Filesize
659KB
MD51230024fd3044b489727de273b0def17
SHA1fecbf72831a5d4b59fccac0ea54243d38e1f8d70
SHA25679ec581f56ebc8a2d6d31b31d4aae71c92f0a5352afa2bf99731f95f598f76b0
SHA512b7a4dec8db29f225c5b4c563d2026ef78af00b5602406e2293451062a5b7b5e3b96a09a912030da09e53e7e234f7d9be6a95c86ef9976224dcba42872608c9e0
-
Filesize
1.2MB
MD50b08ce9dd28b60c8c0e7e33ad2b0f754
SHA1cc4cc3d8be2d3d6a22cf4363d44a7623669bd67f
SHA256860f871d8871cfe2dd0da1e611a1bc672d6e67ab561338fe36f28b9d8452f108
SHA5122b27d645dcadc9eb4b3f9b770b879869583dda24a2af25d02e9c2254bb3a4f284d6c43cd241684b5180bd1ddb5c60c618bd638d9d5bc9abdd3677056f46dc98c
-
Filesize
894KB
MD5b2fe5a5d8d092a5d39d967270bc1aaa1
SHA1e9f552aaba7fb07c18f2bafacd968273d5176a15
SHA256eed95bf7ac5a93b37b5fb5b7da01d4059a298f2a785a858728c6d96336a2225f
SHA51271547791f32501de4c544ad163e450cf3ec3121f30d50bd306de713452dadfa2113ab0cc6c02ff45f7ca3f13079d41796d1011633337c6f1eaf373da9adf3f37
-
Filesize
671KB
MD58d1f08e7c73f017c8447d8bc000fdc1d
SHA11f5b78101c7134167c2c2c962b259a5e941fe3fd
SHA25699af5988865f7a842102f8038bbec726408867a8718a15f3216f5d572aa61aac
SHA5129efbc9e4f9305ed6c38cfb20e5eae623d35224c6b5ce13282dac4169bea8152329866e68c691bce609015973034b2e1c18d8dfd19a17d01ba10818abc8a30d6c
-
Filesize
1024KB
MD59c227b64067e3488bded95fd041cadbd
SHA15b942ecb86f6aaaf325bc4ecfd21947d143caf8f
SHA25678a62287a3bfbb59e5c35da34cdba5418a7544c531fa6d9822c4e7e2a34e40db
SHA5127c7d018da4f3071fc104b6f499c18a17fff5bad8e172e8d121b9f8b872156155757789b8423e536acbd591d586628c9381423f0dccc60c6daec1805d4e341a28
-
Filesize
385KB
MD50cfe3aca4a0801b2a71a48c8afc3ae36
SHA172b32158f2fd1c7fa711dd683315b6db258911c8
SHA2568b1e391efddb720874c62b99589a58c647fe873f91bc657bb87b41f79ab78f80
SHA512cd6e1f0ec9d5964e31e408886e3fc87e0858fb36149b0c66bb9d0c3eaf3f573e4b9d4b7fc8683c6a3f788f19c9ab2f2ce1e58a515ace2cd5b103e6d73368c84f
-
Filesize
321KB
MD5ff0f083dac17091dfb8390cd76a008f2
SHA13911e10c2dc96e9054adedb3982ca950a4bc8795
SHA25622c32a75865c83aaa8a99d7d5b8d247fccbfde5d7fbeaddeb0d8dc7f58fbaa2d
SHA512d8c80416f5a87991ed59e64cc737f836686940cda0edff87cc054bbd7bec8d48eb04117d9d8050cb78ebe250f26e00fa0408078f87896347809a73932a6155ef
-
Filesize
584KB
MD59ef424f61a9a1106f0253687e9cda505
SHA136fed5e4c880a302188dcf51aba43b4dc2fe330a
SHA2569f6d08c00f929c75e5dfb552bc28d1e56d607a451c0b3f10561a6d9d23460197
SHA512a43e5c3decccb05c93bd29a113f0b1573727ac0718e95472c06257d80c1adb2b34c476c0e4b4bc9789fc80ed766d9f1e7b6413973df89e1b6014999424e1cb92
-
Filesize
828KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
828KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
740KB
-
Filesize
740KB
-
Filesize
384KB
-
Filesize
680KB
-
Filesize
680KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
684KB
-
Filesize
684KB
-
Filesize
384KB
-
Filesize
600KB
-
Filesize
600KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
384KB
-
Filesize
792KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
384KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
384KB
-
Filesize
2.1MB
-
Filesize
676KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
676KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.5MB
-
Filesize
808KB
-
Filesize
808KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
384KB
-
Filesize
904KB
-
Filesize
384KB
-
Filesize
904KB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
412KB
-
Filesize
604KB
-
Filesize
604KB
-
Filesize
596KB
-
Filesize
384KB
-
Filesize
596KB
-
Filesize
384KB
-
Filesize
2.0MB