Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
152s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
21/01/2024, 04:09
Static task
static1
Behavioral task
behavioral1
Sample
6c50c8abafb090571b809b7e440760fb.exe
Resource
win7-20231215-en
General
-
Target
6c50c8abafb090571b809b7e440760fb.exe
-
Size
318KB
-
MD5
6c50c8abafb090571b809b7e440760fb
-
SHA1
940400974cbe308babd859914b0f8158168a7d67
-
SHA256
987a459213fe3739f0b3a9599a965c98fd7ffe48217cb7051649767b5815a87d
-
SHA512
2e965287ef25056c6d9edd113ea87d72a674d90b01f9db97bf9092bb820bbd35cd8b125ba0593d73561f23f7916d3223322652a221258935d010ccd51f0f6878
-
SSDEEP
6144:TKjZy6NQ1xaIN8kUedSzx2ME5+b/LNWZR6c2r4/OQfUg8UW:yNQ/2kb35+nsoc2MRF
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2692 explorer.exe -
Executes dropped EXE 3 IoCs
pid Process 2692 explorer.exe 2584 nvxdsinc.exe 1972 nwtray.exe -
Loads dropped DLL 6 IoCs
pid Process 3044 6c50c8abafb090571b809b7e440760fb.exe 3044 6c50c8abafb090571b809b7e440760fb.exe 2692 explorer.exe 2692 explorer.exe 2584 nvxdsinc.exe 2584 nvxdsinc.exe -
resource yara_rule behavioral1/memory/2616-25-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2616-27-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2616-30-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2616-31-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2616-32-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2616-41-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2616-45-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2616-46-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2616-56-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2616-58-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2616-61-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2832-74-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2616-82-0x0000000000400000-0x00000000004B5000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft® Windows® Operating System = "C:\\Users\\Admin\\AppData\\Local\\Temp\\System\\nvxdsinc.exe" nvxdsinc.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2692 set thread context of 2616 2692 explorer.exe 29 PID 1972 set thread context of 2832 1972 nwtray.exe 32 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2692 explorer.exe 2584 nvxdsinc.exe 2692 explorer.exe 1972 nwtray.exe 2584 nvxdsinc.exe 2692 explorer.exe 1972 nwtray.exe 2584 nvxdsinc.exe 2692 explorer.exe 1972 nwtray.exe 2584 nvxdsinc.exe 1972 nwtray.exe 2692 explorer.exe 2584 nvxdsinc.exe 2692 explorer.exe 1972 nwtray.exe 2584 nvxdsinc.exe 2692 explorer.exe 1972 nwtray.exe 2584 nvxdsinc.exe 2692 explorer.exe 1972 nwtray.exe 2584 nvxdsinc.exe 1972 nwtray.exe 2692 explorer.exe 2584 nvxdsinc.exe 1972 nwtray.exe 2692 explorer.exe 2584 nvxdsinc.exe 1972 nwtray.exe 2692 explorer.exe 2584 nvxdsinc.exe 2692 explorer.exe 1972 nwtray.exe 2584 nvxdsinc.exe 1972 nwtray.exe 2692 explorer.exe 2584 nvxdsinc.exe 1972 nwtray.exe 2692 explorer.exe 2584 nvxdsinc.exe 2692 explorer.exe 1972 nwtray.exe 2584 nvxdsinc.exe 1972 nwtray.exe 2692 explorer.exe 2584 nvxdsinc.exe 2692 explorer.exe 1972 nwtray.exe 2584 nvxdsinc.exe 1972 nwtray.exe 2692 explorer.exe 2584 nvxdsinc.exe 1972 nwtray.exe 2692 explorer.exe 2584 nvxdsinc.exe 2692 explorer.exe 1972 nwtray.exe 2584 nvxdsinc.exe 1972 nwtray.exe 2692 explorer.exe 2584 nvxdsinc.exe 1972 nwtray.exe 2692 explorer.exe -
Suspicious use of AdjustPrivilegeToken 50 IoCs
description pid Process Token: SeDebugPrivilege 3044 6c50c8abafb090571b809b7e440760fb.exe Token: SeDebugPrivilege 2692 explorer.exe Token: SeDebugPrivilege 2584 nvxdsinc.exe Token: SeDebugPrivilege 1972 nwtray.exe Token: SeIncreaseQuotaPrivilege 2616 AppLaunch.exe Token: SeSecurityPrivilege 2616 AppLaunch.exe Token: SeTakeOwnershipPrivilege 2616 AppLaunch.exe Token: SeLoadDriverPrivilege 2616 AppLaunch.exe Token: SeSystemProfilePrivilege 2616 AppLaunch.exe Token: SeSystemtimePrivilege 2616 AppLaunch.exe Token: SeProfSingleProcessPrivilege 2616 AppLaunch.exe Token: SeIncBasePriorityPrivilege 2616 AppLaunch.exe Token: SeCreatePagefilePrivilege 2616 AppLaunch.exe Token: SeBackupPrivilege 2616 AppLaunch.exe Token: SeRestorePrivilege 2616 AppLaunch.exe Token: SeShutdownPrivilege 2616 AppLaunch.exe Token: SeDebugPrivilege 2616 AppLaunch.exe Token: SeSystemEnvironmentPrivilege 2616 AppLaunch.exe Token: SeChangeNotifyPrivilege 2616 AppLaunch.exe Token: SeRemoteShutdownPrivilege 2616 AppLaunch.exe Token: SeUndockPrivilege 2616 AppLaunch.exe Token: SeManageVolumePrivilege 2616 AppLaunch.exe Token: SeImpersonatePrivilege 2616 AppLaunch.exe Token: SeCreateGlobalPrivilege 2616 AppLaunch.exe Token: 33 2616 AppLaunch.exe Token: 34 2616 AppLaunch.exe Token: 35 2616 AppLaunch.exe Token: SeIncreaseQuotaPrivilege 2832 AppLaunch.exe Token: SeSecurityPrivilege 2832 AppLaunch.exe Token: SeTakeOwnershipPrivilege 2832 AppLaunch.exe Token: SeLoadDriverPrivilege 2832 AppLaunch.exe Token: SeSystemProfilePrivilege 2832 AppLaunch.exe Token: SeSystemtimePrivilege 2832 AppLaunch.exe Token: SeProfSingleProcessPrivilege 2832 AppLaunch.exe Token: SeIncBasePriorityPrivilege 2832 AppLaunch.exe Token: SeCreatePagefilePrivilege 2832 AppLaunch.exe Token: SeBackupPrivilege 2832 AppLaunch.exe Token: SeRestorePrivilege 2832 AppLaunch.exe Token: SeShutdownPrivilege 2832 AppLaunch.exe Token: SeDebugPrivilege 2832 AppLaunch.exe Token: SeSystemEnvironmentPrivilege 2832 AppLaunch.exe Token: SeChangeNotifyPrivilege 2832 AppLaunch.exe Token: SeRemoteShutdownPrivilege 2832 AppLaunch.exe Token: SeUndockPrivilege 2832 AppLaunch.exe Token: SeManageVolumePrivilege 2832 AppLaunch.exe Token: SeImpersonatePrivilege 2832 AppLaunch.exe Token: SeCreateGlobalPrivilege 2832 AppLaunch.exe Token: 33 2832 AppLaunch.exe Token: 34 2832 AppLaunch.exe Token: 35 2832 AppLaunch.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2616 AppLaunch.exe -
Suspicious use of WriteProcessMemory 34 IoCs
description pid Process procid_target PID 3044 wrote to memory of 2692 3044 6c50c8abafb090571b809b7e440760fb.exe 28 PID 3044 wrote to memory of 2692 3044 6c50c8abafb090571b809b7e440760fb.exe 28 PID 3044 wrote to memory of 2692 3044 6c50c8abafb090571b809b7e440760fb.exe 28 PID 3044 wrote to memory of 2692 3044 6c50c8abafb090571b809b7e440760fb.exe 28 PID 2692 wrote to memory of 2616 2692 explorer.exe 29 PID 2692 wrote to memory of 2616 2692 explorer.exe 29 PID 2692 wrote to memory of 2616 2692 explorer.exe 29 PID 2692 wrote to memory of 2616 2692 explorer.exe 29 PID 2692 wrote to memory of 2616 2692 explorer.exe 29 PID 2692 wrote to memory of 2616 2692 explorer.exe 29 PID 2692 wrote to memory of 2616 2692 explorer.exe 29 PID 2692 wrote to memory of 2616 2692 explorer.exe 29 PID 2692 wrote to memory of 2616 2692 explorer.exe 29 PID 2692 wrote to memory of 2616 2692 explorer.exe 29 PID 2692 wrote to memory of 2616 2692 explorer.exe 29 PID 2692 wrote to memory of 2584 2692 explorer.exe 30 PID 2692 wrote to memory of 2584 2692 explorer.exe 30 PID 2692 wrote to memory of 2584 2692 explorer.exe 30 PID 2692 wrote to memory of 2584 2692 explorer.exe 30 PID 2584 wrote to memory of 1972 2584 nvxdsinc.exe 31 PID 2584 wrote to memory of 1972 2584 nvxdsinc.exe 31 PID 2584 wrote to memory of 1972 2584 nvxdsinc.exe 31 PID 2584 wrote to memory of 1972 2584 nvxdsinc.exe 31 PID 1972 wrote to memory of 2832 1972 nwtray.exe 32 PID 1972 wrote to memory of 2832 1972 nwtray.exe 32 PID 1972 wrote to memory of 2832 1972 nwtray.exe 32 PID 1972 wrote to memory of 2832 1972 nwtray.exe 32 PID 1972 wrote to memory of 2832 1972 nwtray.exe 32 PID 1972 wrote to memory of 2832 1972 nwtray.exe 32 PID 1972 wrote to memory of 2832 1972 nwtray.exe 32 PID 1972 wrote to memory of 2832 1972 nwtray.exe 32 PID 1972 wrote to memory of 2832 1972 nwtray.exe 32 PID 1972 wrote to memory of 2832 1972 nwtray.exe 32 PID 1972 wrote to memory of 2832 1972 nwtray.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\6c50c8abafb090571b809b7e440760fb.exe"C:\Users\Admin\AppData\Local\Temp\6c50c8abafb090571b809b7e440760fb.exe"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2616
-
-
C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe"C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\System\nwtray.exe"C:\Users\Admin\AppData\Local\Temp\System\nwtray.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe5⤵
- Suspicious use of AdjustPrivilegeToken
PID:2832
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70B
MD515ca2a60b35b747793a242b165d6611d
SHA1c9ed4f2f5f3c69efb10ad2c154a649f29184d1af
SHA256d85b4e442a01018b9d4968e7b4dd89e9bdb38c904e6d2e522c9d030fe74c6ae6
SHA5123c16a29f0c8c34c8ad162e1ec191da8058f9eb41219442713fe7ffad589e576e9de7b004f22de82b6acd3edf15eb7825b69abd4aa64eec36453bb5a5bd209ed4
-
Filesize
39KB
MD538abcaec6ee62213f90b1717d830a1bb
SHA1d8f5849d0d3f4ccc0dfb66a9a4a0442ac66a31b9
SHA2566fee9a2c70b2cc48b0812f7cb2e09497c9c90941976f430a8f8279ad3c787768
SHA51277eaabcbc6f7a3835b6220d72c4b1cae82d2125ea971907e33b15ceeede7e4da0741c6e63e988bd782ed6eb72ad3cbcba10ea83919eafd9b95d612c43a735274
-
Filesize
318KB
MD56c50c8abafb090571b809b7e440760fb
SHA1940400974cbe308babd859914b0f8158168a7d67
SHA256987a459213fe3739f0b3a9599a965c98fd7ffe48217cb7051649767b5815a87d
SHA5122e965287ef25056c6d9edd113ea87d72a674d90b01f9db97bf9092bb820bbd35cd8b125ba0593d73561f23f7916d3223322652a221258935d010ccd51f0f6878