Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
14/02/2024, 01:38
Static task
static1
Behavioral task
behavioral1
Sample
9a704018edf1e84427fbce1d4e3bafc9.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
9a704018edf1e84427fbce1d4e3bafc9.exe
Resource
win10v2004-20231222-en
General
-
Target
9a704018edf1e84427fbce1d4e3bafc9.exe
-
Size
68KB
-
MD5
9a704018edf1e84427fbce1d4e3bafc9
-
SHA1
5d436c01639c95b3db0520416b902e849d7805c4
-
SHA256
f020f1e1380c95c141db08ca8f636ef60734b22242cbfbe55d77e32e6a6a6ecd
-
SHA512
7531236d79b62e5e2cb5c0710c270a3c10ef9b1d1cbee7f0b8d0f871df81daa1800020205645d612478aef089ce92400815c76939d64463d10c115bf8a4cc9ae
-
SSDEEP
1536:UOEVqZF3uikZBYHO9xEUHDIIRkYq6R/d3H8ZV:UfAFe3zYHO9xzHDIIx1R/d8
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 8 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\winudpmgr.exe = "C:\\Windows\\winudpmgr.exe:*:Enabled:Windows Messenger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\9a704018edf1e84427fbce1d4e3bafc9.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\9a704018edf1e84427fbce1d4e3bafc9.exe:*:Enabled:Windows Messenger" reg.exe -
Executes dropped EXE 2 IoCs
pid Process 1932 winudpmgr.exe 2832 winudpmgr.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows UDP Control Center = "winudpmgr.exe" 9a704018edf1e84427fbce1d4e3bafc9.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum winudpmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 winudpmgr.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2252 set thread context of 2700 2252 9a704018edf1e84427fbce1d4e3bafc9.exe 32 PID 1932 set thread context of 2832 1932 winudpmgr.exe 38 -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\winudpmgr.exe 9a704018edf1e84427fbce1d4e3bafc9.exe File opened for modification C:\Windows\winudpmgr.exe 9a704018edf1e84427fbce1d4e3bafc9.exe File opened for modification C:\Windows\winudpmgr.exe winudpmgr.exe -
Modifies registry key 1 TTPs 4 IoCs
pid Process 2680 reg.exe 2284 reg.exe 2640 reg.exe 3036 reg.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2252 9a704018edf1e84427fbce1d4e3bafc9.exe 1932 winudpmgr.exe -
Suspicious use of WriteProcessMemory 54 IoCs
description pid Process procid_target PID 2252 wrote to memory of 2412 2252 9a704018edf1e84427fbce1d4e3bafc9.exe 28 PID 2252 wrote to memory of 2412 2252 9a704018edf1e84427fbce1d4e3bafc9.exe 28 PID 2252 wrote to memory of 2412 2252 9a704018edf1e84427fbce1d4e3bafc9.exe 28 PID 2252 wrote to memory of 2412 2252 9a704018edf1e84427fbce1d4e3bafc9.exe 28 PID 2252 wrote to memory of 2464 2252 9a704018edf1e84427fbce1d4e3bafc9.exe 29 PID 2252 wrote to memory of 2464 2252 9a704018edf1e84427fbce1d4e3bafc9.exe 29 PID 2252 wrote to memory of 2464 2252 9a704018edf1e84427fbce1d4e3bafc9.exe 29 PID 2252 wrote to memory of 2464 2252 9a704018edf1e84427fbce1d4e3bafc9.exe 29 PID 2252 wrote to memory of 2700 2252 9a704018edf1e84427fbce1d4e3bafc9.exe 32 PID 2252 wrote to memory of 2700 2252 9a704018edf1e84427fbce1d4e3bafc9.exe 32 PID 2252 wrote to memory of 2700 2252 9a704018edf1e84427fbce1d4e3bafc9.exe 32 PID 2252 wrote to memory of 2700 2252 9a704018edf1e84427fbce1d4e3bafc9.exe 32 PID 2412 wrote to memory of 2284 2412 cmd.exe 34 PID 2412 wrote to memory of 2284 2412 cmd.exe 34 PID 2412 wrote to memory of 2284 2412 cmd.exe 34 PID 2412 wrote to memory of 2284 2412 cmd.exe 34 PID 2464 wrote to memory of 2680 2464 cmd.exe 33 PID 2464 wrote to memory of 2680 2464 cmd.exe 33 PID 2464 wrote to memory of 2680 2464 cmd.exe 33 PID 2464 wrote to memory of 2680 2464 cmd.exe 33 PID 2252 wrote to memory of 2700 2252 9a704018edf1e84427fbce1d4e3bafc9.exe 32 PID 2252 wrote to memory of 2700 2252 9a704018edf1e84427fbce1d4e3bafc9.exe 32 PID 2252 wrote to memory of 2700 2252 9a704018edf1e84427fbce1d4e3bafc9.exe 32 PID 2252 wrote to memory of 2700 2252 9a704018edf1e84427fbce1d4e3bafc9.exe 32 PID 2252 wrote to memory of 2700 2252 9a704018edf1e84427fbce1d4e3bafc9.exe 32 PID 2700 wrote to memory of 1932 2700 9a704018edf1e84427fbce1d4e3bafc9.exe 35 PID 2700 wrote to memory of 1932 2700 9a704018edf1e84427fbce1d4e3bafc9.exe 35 PID 2700 wrote to memory of 1932 2700 9a704018edf1e84427fbce1d4e3bafc9.exe 35 PID 2700 wrote to memory of 1932 2700 9a704018edf1e84427fbce1d4e3bafc9.exe 35 PID 1932 wrote to memory of 1192 1932 winudpmgr.exe 36 PID 1932 wrote to memory of 1192 1932 winudpmgr.exe 36 PID 1932 wrote to memory of 1192 1932 winudpmgr.exe 36 PID 1932 wrote to memory of 1192 1932 winudpmgr.exe 36 PID 1932 wrote to memory of 2708 1932 winudpmgr.exe 37 PID 1932 wrote to memory of 2708 1932 winudpmgr.exe 37 PID 1932 wrote to memory of 2708 1932 winudpmgr.exe 37 PID 1932 wrote to memory of 2708 1932 winudpmgr.exe 37 PID 1932 wrote to memory of 2832 1932 winudpmgr.exe 38 PID 1932 wrote to memory of 2832 1932 winudpmgr.exe 38 PID 1932 wrote to memory of 2832 1932 winudpmgr.exe 38 PID 1932 wrote to memory of 2832 1932 winudpmgr.exe 38 PID 1932 wrote to memory of 2832 1932 winudpmgr.exe 38 PID 1932 wrote to memory of 2832 1932 winudpmgr.exe 38 PID 1932 wrote to memory of 2832 1932 winudpmgr.exe 38 PID 1932 wrote to memory of 2832 1932 winudpmgr.exe 38 PID 1932 wrote to memory of 2832 1932 winudpmgr.exe 38 PID 2708 wrote to memory of 2640 2708 cmd.exe 41 PID 2708 wrote to memory of 2640 2708 cmd.exe 41 PID 2708 wrote to memory of 2640 2708 cmd.exe 41 PID 2708 wrote to memory of 2640 2708 cmd.exe 41 PID 1192 wrote to memory of 3036 1192 cmd.exe 42 PID 1192 wrote to memory of 3036 1192 cmd.exe 42 PID 1192 wrote to memory of 3036 1192 cmd.exe 42 PID 1192 wrote to memory of 3036 1192 cmd.exe 42
Processes
-
C:\Users\Admin\AppData\Local\Temp\9a704018edf1e84427fbce1d4e3bafc9.exe"C:\Users\Admin\AppData\Local\Temp\9a704018edf1e84427fbce1d4e3bafc9.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f2⤵
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- Modifies firewall policy service
- Modifies registry key
PID:2284
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\9a704018edf1e84427fbce1d4e3bafc9.exe" /t 1 /d "C:\Users\Admin\AppData\Local\Temp\9a704018edf1e84427fbce1d4e3bafc9.exe:*:Enabled:Windows Messenger" /f2⤵
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\9a704018edf1e84427fbce1d4e3bafc9.exe" /t 1 /d "C:\Users\Admin\AppData\Local\Temp\9a704018edf1e84427fbce1d4e3bafc9.exe:*:Enabled:Windows Messenger" /f3⤵
- Modifies firewall policy service
- Modifies registry key
PID:2680
-
-
-
C:\Users\Admin\AppData\Local\Temp\9a704018edf1e84427fbce1d4e3bafc9.exeC:\Users\Admin\AppData\Local\Temp\9a704018edf1e84427fbce1d4e3bafc9.exe2⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Windows\winudpmgr.exe"C:\Windows\winudpmgr.exe"3⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f5⤵
- Modifies firewall policy service
- Modifies registry key
PID:3036
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\winudpmgr.exe" /t 1 /d "C:\Windows\winudpmgr.exe:*:Enabled:Windows Messenger" /f4⤵
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\winudpmgr.exe" /t 1 /d "C:\Windows\winudpmgr.exe:*:Enabled:Windows Messenger" /f5⤵
- Modifies firewall policy service
- Modifies registry key
PID:2640
-
-
-
C:\Windows\winudpmgr.exeC:\Windows\winudpmgr.exe4⤵
- Executes dropped EXE
PID:2832
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-928733405-3780110381-2966456290-1000\699c4b9cdebca7aaea5193cae8a50098_3d25fb85-47e3-4ffb-8cc7-d217183fd877
Filesize50B
MD55b63d4dd8c04c88c0e30e494ec6a609a
SHA1884d5a8bdc25fe794dc22ef9518009dcf0069d09
SHA2564d93c22555b3169e5c13716ca59b8b22892c69b3025aea841afe5259698102fd
SHA51215ff8551ac6b9de978050569bcdc26f44dfc06a0eaf445ac70fd45453a21bdafa3e4c8b4857d6a1c3226f4102a639682bdfb71d7b255062fb81a51c9126896cb
-
Filesize
68KB
MD59a704018edf1e84427fbce1d4e3bafc9
SHA15d436c01639c95b3db0520416b902e849d7805c4
SHA256f020f1e1380c95c141db08ca8f636ef60734b22242cbfbe55d77e32e6a6a6ecd
SHA5127531236d79b62e5e2cb5c0710c270a3c10ef9b1d1cbee7f0b8d0f871df81daa1800020205645d612478aef089ce92400815c76939d64463d10c115bf8a4cc9ae