Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
25/02/2024, 07:48
Static task
static1
Behavioral task
behavioral1
Sample
5798aefb07e12a942672a60c2be101dc26b01485616713e8be1f68b321747f2f.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
5798aefb07e12a942672a60c2be101dc26b01485616713e8be1f68b321747f2f.exe
Resource
win10v2004-20240221-en
General
-
Target
5798aefb07e12a942672a60c2be101dc26b01485616713e8be1f68b321747f2f.exe
-
Size
442KB
-
MD5
c02689449a4ce73ec79a52595ab590f6
-
SHA1
5908453afef391437c632ca0ce921dbf0c6e8bd5
-
SHA256
5798aefb07e12a942672a60c2be101dc26b01485616713e8be1f68b321747f2f
-
SHA512
86503802f69ab69ee18e5b8635ca9442867beed6b1547565bbc3bae12db51b7aa5ed1ed472a1c7278608a936747865f290297f78b729c249006ee6377cc86082
-
SSDEEP
6144:RlDoHtgdupnzKELHSM0zAAFFOQVJ3hAkToXTOnRnN/jxrUmNAXRDfSZ8cPiKqpr/:Uj87domKxSZ8LKqm31uQHTbJ/ERp4Q5D
Malware Config
Signatures
-
Process spawned unexpected child process 2 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2400 2556 Wscript.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 664 2556 Wscript.exe 34 -
Executes dropped EXE 2 IoCs
pid Process 2708 BitlockerNetworkClient.exe 1688 BitlockerNetworkClient.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 844 set thread context of 2236 844 5798aefb07e12a942672a60c2be101dc26b01485616713e8be1f68b321747f2f.exe 30 PID 2708 set thread context of 1688 2708 BitlockerNetworkClient.exe 46 PID 1688 set thread context of 2588 1688 BitlockerNetworkClient.exe 49 -
Modifies registry key 1 TTPs 1 IoCs
pid Process 1504 reg.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2776 PING.EXE -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2588 iexplore.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2424 WMIC.exe Token: SeSecurityPrivilege 2424 WMIC.exe Token: SeTakeOwnershipPrivilege 2424 WMIC.exe Token: SeLoadDriverPrivilege 2424 WMIC.exe Token: SeSystemProfilePrivilege 2424 WMIC.exe Token: SeSystemtimePrivilege 2424 WMIC.exe Token: SeProfSingleProcessPrivilege 2424 WMIC.exe Token: SeIncBasePriorityPrivilege 2424 WMIC.exe Token: SeCreatePagefilePrivilege 2424 WMIC.exe Token: SeBackupPrivilege 2424 WMIC.exe Token: SeRestorePrivilege 2424 WMIC.exe Token: SeShutdownPrivilege 2424 WMIC.exe Token: SeDebugPrivilege 2424 WMIC.exe Token: SeSystemEnvironmentPrivilege 2424 WMIC.exe Token: SeRemoteShutdownPrivilege 2424 WMIC.exe Token: SeUndockPrivilege 2424 WMIC.exe Token: SeManageVolumePrivilege 2424 WMIC.exe Token: 33 2424 WMIC.exe Token: 34 2424 WMIC.exe Token: 35 2424 WMIC.exe Token: SeIncreaseQuotaPrivilege 2424 WMIC.exe Token: SeSecurityPrivilege 2424 WMIC.exe Token: SeTakeOwnershipPrivilege 2424 WMIC.exe Token: SeLoadDriverPrivilege 2424 WMIC.exe Token: SeSystemProfilePrivilege 2424 WMIC.exe Token: SeSystemtimePrivilege 2424 WMIC.exe Token: SeProfSingleProcessPrivilege 2424 WMIC.exe Token: SeIncBasePriorityPrivilege 2424 WMIC.exe Token: SeCreatePagefilePrivilege 2424 WMIC.exe Token: SeBackupPrivilege 2424 WMIC.exe Token: SeRestorePrivilege 2424 WMIC.exe Token: SeShutdownPrivilege 2424 WMIC.exe Token: SeDebugPrivilege 2424 WMIC.exe Token: SeSystemEnvironmentPrivilege 2424 WMIC.exe Token: SeRemoteShutdownPrivilege 2424 WMIC.exe Token: SeUndockPrivilege 2424 WMIC.exe Token: SeManageVolumePrivilege 2424 WMIC.exe Token: 33 2424 WMIC.exe Token: 34 2424 WMIC.exe Token: 35 2424 WMIC.exe Token: SeIncreaseQuotaPrivilege 2368 WMIC.exe Token: SeSecurityPrivilege 2368 WMIC.exe Token: SeTakeOwnershipPrivilege 2368 WMIC.exe Token: SeLoadDriverPrivilege 2368 WMIC.exe Token: SeSystemProfilePrivilege 2368 WMIC.exe Token: SeSystemtimePrivilege 2368 WMIC.exe Token: SeProfSingleProcessPrivilege 2368 WMIC.exe Token: SeIncBasePriorityPrivilege 2368 WMIC.exe Token: SeCreatePagefilePrivilege 2368 WMIC.exe Token: SeBackupPrivilege 2368 WMIC.exe Token: SeRestorePrivilege 2368 WMIC.exe Token: SeShutdownPrivilege 2368 WMIC.exe Token: SeDebugPrivilege 2368 WMIC.exe Token: SeSystemEnvironmentPrivilege 2368 WMIC.exe Token: SeRemoteShutdownPrivilege 2368 WMIC.exe Token: SeUndockPrivilege 2368 WMIC.exe Token: SeManageVolumePrivilege 2368 WMIC.exe Token: 33 2368 WMIC.exe Token: 34 2368 WMIC.exe Token: 35 2368 WMIC.exe Token: SeIncreaseQuotaPrivilege 2368 WMIC.exe Token: SeSecurityPrivilege 2368 WMIC.exe Token: SeTakeOwnershipPrivilege 2368 WMIC.exe Token: SeLoadDriverPrivilege 2368 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 844 wrote to memory of 936 844 5798aefb07e12a942672a60c2be101dc26b01485616713e8be1f68b321747f2f.exe 28 PID 844 wrote to memory of 936 844 5798aefb07e12a942672a60c2be101dc26b01485616713e8be1f68b321747f2f.exe 28 PID 844 wrote to memory of 936 844 5798aefb07e12a942672a60c2be101dc26b01485616713e8be1f68b321747f2f.exe 28 PID 844 wrote to memory of 936 844 5798aefb07e12a942672a60c2be101dc26b01485616713e8be1f68b321747f2f.exe 28 PID 844 wrote to memory of 2236 844 5798aefb07e12a942672a60c2be101dc26b01485616713e8be1f68b321747f2f.exe 30 PID 844 wrote to memory of 2236 844 5798aefb07e12a942672a60c2be101dc26b01485616713e8be1f68b321747f2f.exe 30 PID 844 wrote to memory of 2236 844 5798aefb07e12a942672a60c2be101dc26b01485616713e8be1f68b321747f2f.exe 30 PID 844 wrote to memory of 2236 844 5798aefb07e12a942672a60c2be101dc26b01485616713e8be1f68b321747f2f.exe 30 PID 844 wrote to memory of 2236 844 5798aefb07e12a942672a60c2be101dc26b01485616713e8be1f68b321747f2f.exe 30 PID 844 wrote to memory of 2236 844 5798aefb07e12a942672a60c2be101dc26b01485616713e8be1f68b321747f2f.exe 30 PID 844 wrote to memory of 2236 844 5798aefb07e12a942672a60c2be101dc26b01485616713e8be1f68b321747f2f.exe 30 PID 844 wrote to memory of 2236 844 5798aefb07e12a942672a60c2be101dc26b01485616713e8be1f68b321747f2f.exe 30 PID 844 wrote to memory of 2236 844 5798aefb07e12a942672a60c2be101dc26b01485616713e8be1f68b321747f2f.exe 30 PID 844 wrote to memory of 2236 844 5798aefb07e12a942672a60c2be101dc26b01485616713e8be1f68b321747f2f.exe 30 PID 844 wrote to memory of 2236 844 5798aefb07e12a942672a60c2be101dc26b01485616713e8be1f68b321747f2f.exe 30 PID 844 wrote to memory of 2236 844 5798aefb07e12a942672a60c2be101dc26b01485616713e8be1f68b321747f2f.exe 30 PID 844 wrote to memory of 2236 844 5798aefb07e12a942672a60c2be101dc26b01485616713e8be1f68b321747f2f.exe 30 PID 2236 wrote to memory of 2500 2236 5798aefb07e12a942672a60c2be101dc26b01485616713e8be1f68b321747f2f.exe 31 PID 2236 wrote to memory of 2500 2236 5798aefb07e12a942672a60c2be101dc26b01485616713e8be1f68b321747f2f.exe 31 PID 2236 wrote to memory of 2500 2236 5798aefb07e12a942672a60c2be101dc26b01485616713e8be1f68b321747f2f.exe 31 PID 2236 wrote to memory of 2500 2236 5798aefb07e12a942672a60c2be101dc26b01485616713e8be1f68b321747f2f.exe 31 PID 2500 wrote to memory of 2424 2500 cmd.exe 33 PID 2500 wrote to memory of 2424 2500 cmd.exe 33 PID 2500 wrote to memory of 2424 2500 cmd.exe 33 PID 2500 wrote to memory of 2424 2500 cmd.exe 33 PID 2236 wrote to memory of 2972 2236 5798aefb07e12a942672a60c2be101dc26b01485616713e8be1f68b321747f2f.exe 36 PID 2236 wrote to memory of 2972 2236 5798aefb07e12a942672a60c2be101dc26b01485616713e8be1f68b321747f2f.exe 36 PID 2236 wrote to memory of 2972 2236 5798aefb07e12a942672a60c2be101dc26b01485616713e8be1f68b321747f2f.exe 36 PID 2236 wrote to memory of 2972 2236 5798aefb07e12a942672a60c2be101dc26b01485616713e8be1f68b321747f2f.exe 36 PID 2972 wrote to memory of 2368 2972 cmd.exe 38 PID 2972 wrote to memory of 2368 2972 cmd.exe 38 PID 2972 wrote to memory of 2368 2972 cmd.exe 38 PID 2972 wrote to memory of 2368 2972 cmd.exe 38 PID 2236 wrote to memory of 2476 2236 5798aefb07e12a942672a60c2be101dc26b01485616713e8be1f68b321747f2f.exe 40 PID 2236 wrote to memory of 2476 2236 5798aefb07e12a942672a60c2be101dc26b01485616713e8be1f68b321747f2f.exe 40 PID 2236 wrote to memory of 2476 2236 5798aefb07e12a942672a60c2be101dc26b01485616713e8be1f68b321747f2f.exe 40 PID 2236 wrote to memory of 2476 2236 5798aefb07e12a942672a60c2be101dc26b01485616713e8be1f68b321747f2f.exe 40 PID 2476 wrote to memory of 2636 2476 cmd.exe 42 PID 2476 wrote to memory of 2636 2476 cmd.exe 42 PID 2476 wrote to memory of 2636 2476 cmd.exe 42 PID 2476 wrote to memory of 2636 2476 cmd.exe 42 PID 2708 wrote to memory of 2728 2708 BitlockerNetworkClient.exe 44 PID 2708 wrote to memory of 2728 2708 BitlockerNetworkClient.exe 44 PID 2708 wrote to memory of 2728 2708 BitlockerNetworkClient.exe 44 PID 2708 wrote to memory of 2728 2708 BitlockerNetworkClient.exe 44 PID 2708 wrote to memory of 1688 2708 BitlockerNetworkClient.exe 46 PID 2708 wrote to memory of 1688 2708 BitlockerNetworkClient.exe 46 PID 2708 wrote to memory of 1688 2708 BitlockerNetworkClient.exe 46 PID 2708 wrote to memory of 1688 2708 BitlockerNetworkClient.exe 46 PID 2708 wrote to memory of 1688 2708 BitlockerNetworkClient.exe 46 PID 2708 wrote to memory of 1688 2708 BitlockerNetworkClient.exe 46 PID 2708 wrote to memory of 1688 2708 BitlockerNetworkClient.exe 46 PID 2708 wrote to memory of 1688 2708 BitlockerNetworkClient.exe 46 PID 2708 wrote to memory of 1688 2708 BitlockerNetworkClient.exe 46 PID 2708 wrote to memory of 1688 2708 BitlockerNetworkClient.exe 46 PID 2708 wrote to memory of 1688 2708 BitlockerNetworkClient.exe 46 PID 2708 wrote to memory of 1688 2708 BitlockerNetworkClient.exe 46 PID 2708 wrote to memory of 1688 2708 BitlockerNetworkClient.exe 46 PID 1688 wrote to memory of 2180 1688 BitlockerNetworkClient.exe 47 PID 1688 wrote to memory of 2180 1688 BitlockerNetworkClient.exe 47 PID 1688 wrote to memory of 2180 1688 BitlockerNetworkClient.exe 47 PID 1688 wrote to memory of 2180 1688 BitlockerNetworkClient.exe 47 PID 1688 wrote to memory of 2588 1688 BitlockerNetworkClient.exe 49 PID 1688 wrote to memory of 2588 1688 BitlockerNetworkClient.exe 49
Processes
-
C:\Users\Admin\AppData\Local\Temp\5798aefb07e12a942672a60c2be101dc26b01485616713e8be1f68b321747f2f.exe"C:\Users\Admin\AppData\Local\Temp\5798aefb07e12a942672a60c2be101dc26b01485616713e8be1f68b321747f2f.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:844 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c copy "C:\Users\Admin\AppData\Local\Temp\5798aefb07e12a942672a60c2be101dc26b01485616713e8be1f68b321747f2f.exe" C:\Users\Admin\AppData\Local\Temp\bd891.tmp2⤵PID:936
-
-
C:\Users\Admin\AppData\Local\Temp\5798aefb07e12a942672a60c2be101dc26b01485616713e8be1f68b321747f2f.exe"C:\Users\Admin\AppData\Local\Temp\5798aefb07e12a942672a60c2be101dc26b01485616713e8be1f68b321747f2f.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Windows\SysWOW64\cmd.execmd /c WMIC Process Call Create "C:\Windows\System32\Wscript.exe //NOLOGO C:\Users\Admin\AppData\Local\Temp\C-PDC-C-Cpy-T.vbs"3⤵
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Windows\SysWOW64\Wbem\WMIC.exeWMIC Process Call Create "C:\Windows\System32\Wscript.exe //NOLOGO C:\Users\Admin\AppData\Local\Temp\C-PDC-C-Cpy-T.vbs"4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2424
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c WMIC Process Call Create "C:\Windows\System32\Wscript.exe //NOLOGO C:\Users\Admin\AppData\Local\Temp\C-PDI-C-Cpy-T.vbs"3⤵
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Windows\SysWOW64\Wbem\WMIC.exeWMIC Process Call Create "C:\Windows\System32\Wscript.exe //NOLOGO C:\Users\Admin\AppData\Local\Temp\C-PDI-C-Cpy-T.vbs"4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2368
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c wmic process call create "C:\ProgramData\Chrome\BitlockerNetworkClient.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic process call create "C:\ProgramData\Chrome\BitlockerNetworkClient.exe"4⤵PID:2636
-
-
-
-
C:\Windows\System32\Wscript.exeC:\Windows\System32\Wscript.exe //NOLOGO C:\Users\Admin\AppData\Local\Temp\C-PDC-C-Cpy-T.vbs1⤵
- Process spawned unexpected child process
PID:2400
-
C:\Windows\System32\Wscript.exeC:\Windows\System32\Wscript.exe //NOLOGO C:\Users\Admin\AppData\Local\Temp\C-PDI-C-Cpy-T.vbs1⤵
- Process spawned unexpected child process
PID:664
-
C:\ProgramData\Chrome\BitlockerNetworkClient.exeC:\ProgramData\Chrome\BitlockerNetworkClient.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c copy "C:\ProgramData\Chrome\BitlockerNetworkClient.exe" C:\Users\Admin\AppData\Local\Temp\bd891.tmp2⤵PID:2728
-
-
C:\ProgramData\Chrome\BitlockerNetworkClient.exe"C:\ProgramData\Chrome\BitlockerNetworkClient.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c copy "C:\ProgramData\Chrome\BitlockerNetworkClient.exe" C:\Users\Admin\AppData\Local\Temp\bd891.tmp3⤵PID:2180
-
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2588 -
C:\Windows\SysWOW64\cmd.execmd /c REG DELETE HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v Stp /f4⤵PID:1612
-
C:\Windows\SysWOW64\reg.exeREG DELETE HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v Stp /f5⤵
- Modifies registry key
PID:1504
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c Copy /Y "C:\ProgramData\Chrome\FileInfo.txt" "C:\ProgramData\InternetExplorer\FileInfoStp.txt"4⤵PID:2348
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\C-Strt-C-Up-T.bat4⤵PID:2240
-
C:\Windows\SysWOW64\PING.EXEping 1.0.0.0 -n 1 -w 200005⤵
- Runs ping.exe
PID:2776
-
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic /NameSpace:\\root\default Class StdRegProv Call SetStringValue hDefKey = "&H80000001" sSubKeyName = "Software\Microsoft\Windows\CurrentVersion\Run" sValue = "C:\ProgramData\InternetExplorer\BitlockerNetworkClientStp.exe" sValueName = "BitlockerNetworkClientStp"5⤵PID:444
-
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic /NameSpace:\\root\default Class StdRegProv Call SetStringValue hDefKey = "&H80000002" sSubKeyName = "Software\Microsoft\Windows\CurrentVersion\Run" sValue = "C:\ProgramData\InternetExplorer\BitlockerNetworkClientStp.exe" sValueName = "BitlockerNetworkClientStp"5⤵PID:1520
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
96B
MD5818375bedc051f8fdb8cc7b3cd85399e
SHA111341fbfa333ea697c8b3c30654639173be10e61
SHA256f9d104bbe00c13979266edebab30c28c447fa63ad01b6690a66ca209b4f93a8e
SHA51221bc9c650774a220f6c29b3096db2b61cfbaca691afabb7f2e73b21178c827688076fdbbd52e092fadb513db69066eec44a939319a288161cb18b66b6ca6693e
-
Filesize
1KB
MD5fbee459bd14566078f798620be9ef49d
SHA12296a1cd4a5d820293cb0545516b8ed3f96c21df
SHA256388a4f87377519c5b6a59322d77db47ab7e59e4b5dc2cd6f1f514f3283fbe3e0
SHA5124a8e741d3bce336ab284aba3cbc09cd6a9a6182ae56c3c4d337748675690a4c44ec292e511bf62d10a520975754a5090afe9284c62be858d546469160c696cb1
-
Filesize
554B
MD5b00435327731c749f843ca213a56e035
SHA1d4b20e13fb910f5b1a99ca683c7e064e6c64909c
SHA2562cfe176c2470b02d3f9207b38c64413cda54ae2eced3895b07dfbe54484a7777
SHA512f92a76fdf7043f13ca6449f7ebe4ca255da4ff4d0d24ad877b332aacb88ef66bf00ec0b8c6031e64290164c93dda8cc6f1f6c5ab426d5008cb5d5a68bcb3cf62
-
Filesize
426B
MD56cc41125b5c05df3911b177c4c276c8d
SHA1b972c6f3df11aaa6a5f408d1a76bd7e6b975e750
SHA256fef03f68051274e1be6a0ac2daddcc7dfc03326e8e21df331a6712ce5904d4d4
SHA51288c68d0c50f373755de04385627a56cd085b51d1b97f70cfea11609879548a77f4bce687261d176f26df0c3eac68fbd307fbc36411080c5497ae13d963d5096b
-
Filesize
643B
MD593a428476312e448cdc7550a7487dded
SHA161d450ca5951888fac72bd8953f3ce7263792837
SHA25649b7203bdf1279e6a145115377c1e280ffebbcff1bf17c2a56372b53b1912848
SHA51270028ce83fae05e8bc3c7ac1e44d20a6b12e19ad4d0db95b7b82adfd3a6fd8aa436e5f08c7ff6e4b5d14d775e026b4bcd6aeb4be8bd69b0b941649574df104d1
-
Filesize
442KB
MD5c02689449a4ce73ec79a52595ab590f6
SHA15908453afef391437c632ca0ce921dbf0c6e8bd5
SHA2565798aefb07e12a942672a60c2be101dc26b01485616713e8be1f68b321747f2f
SHA51286503802f69ab69ee18e5b8635ca9442867beed6b1547565bbc3bae12db51b7aa5ed1ed472a1c7278608a936747865f290297f78b729c249006ee6377cc86082