Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
81s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
06/03/2024, 01:07
Static task
static1
Behavioral task
behavioral1
Sample
c93b7adbca782227238b433836fce87fc21927d590dda5401fd0b8fd2b9a8816.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
c93b7adbca782227238b433836fce87fc21927d590dda5401fd0b8fd2b9a8816.exe
Resource
win10v2004-20240226-en
General
-
Target
c93b7adbca782227238b433836fce87fc21927d590dda5401fd0b8fd2b9a8816.exe
-
Size
5.1MB
-
MD5
80d925050159e9a4db249e9b5242629a
-
SHA1
710322120a60664f35a98a902f8a8d4977039b95
-
SHA256
c93b7adbca782227238b433836fce87fc21927d590dda5401fd0b8fd2b9a8816
-
SHA512
337167fc67bf2d9d001e8e03b2cfdc3e278c6176daf9d3474bf9bf58e315f25227e2c4ad42c9bad6224e258b672df6c6122cf8a883ee37dd3f1801b12f641419
-
SSDEEP
98304:xRjPz9KDzUU8O5/B/LJ25E9SVh86sS3TRknQ3ss2MApp9meypA3cPDu7:xFKoU8O5/b2XViSjX310SeyGc7u7
Malware Config
Signatures
-
UPX dump on OEP (original entry point) 13 IoCs
resource yara_rule behavioral1/memory/2072-36-0x0000000140000000-0x0000000140848000-memory.dmp UPX behavioral1/memory/2072-38-0x0000000140000000-0x0000000140848000-memory.dmp UPX behavioral1/memory/2072-39-0x0000000140000000-0x0000000140848000-memory.dmp UPX behavioral1/memory/2072-40-0x0000000140000000-0x0000000140848000-memory.dmp UPX behavioral1/memory/2072-37-0x0000000140000000-0x0000000140848000-memory.dmp UPX behavioral1/memory/2072-42-0x0000000140000000-0x0000000140848000-memory.dmp UPX behavioral1/memory/2072-35-0x0000000140000000-0x0000000140848000-memory.dmp UPX behavioral1/memory/2072-43-0x0000000140000000-0x0000000140848000-memory.dmp UPX behavioral1/memory/2072-44-0x0000000140000000-0x0000000140848000-memory.dmp UPX behavioral1/memory/2072-45-0x0000000140000000-0x0000000140848000-memory.dmp UPX behavioral1/memory/2072-46-0x0000000140000000-0x0000000140848000-memory.dmp UPX behavioral1/memory/2072-48-0x0000000140000000-0x0000000140848000-memory.dmp UPX behavioral1/memory/2072-47-0x0000000140000000-0x0000000140848000-memory.dmp UPX -
XMRig Miner payload 9 IoCs
resource yara_rule behavioral1/memory/2072-39-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/2072-40-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/2072-42-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/2072-43-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/2072-44-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/2072-45-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/2072-46-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/2072-48-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/2072-47-0x0000000140000000-0x0000000140848000-memory.dmp xmrig -
Creates new service(s) 1 TTPs
-
Stops running service(s) 3 TTPs
-
Deletes itself 1 IoCs
pid Process 2700 cmd.exe -
Executes dropped EXE 2 IoCs
pid Process 476 Process not Found 2168 lutlgidagtja.exe -
Loads dropped DLL 1 IoCs
pid Process 476 Process not Found -
resource yara_rule behavioral1/memory/2072-34-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2072-36-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2072-38-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2072-39-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2072-40-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2072-37-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2072-42-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2072-35-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2072-43-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2072-44-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2072-45-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2072-46-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2072-48-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2072-47-0x0000000140000000-0x0000000140848000-memory.dmp upx -
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\system32\MRT.exe lutlgidagtja.exe File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\system32\MRT.exe c93b7adbca782227238b433836fce87fc21927d590dda5401fd0b8fd2b9a8816.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2168 set thread context of 2056 2168 lutlgidagtja.exe 84 PID 2168 set thread context of 2072 2168 lutlgidagtja.exe 87 -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\wusa.lock wusa.exe File created C:\Windows\wusa.lock wusa.exe -
Launches sc.exe 14 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2560 sc.exe 2864 sc.exe 2768 sc.exe 2972 sc.exe 868 sc.exe 2408 sc.exe 1624 sc.exe 2432 sc.exe 2420 sc.exe 2544 sc.exe 2036 sc.exe 2472 sc.exe 1596 sc.exe 2308 sc.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage powershell.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = 0074fdbc626fda01 powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2096 c93b7adbca782227238b433836fce87fc21927d590dda5401fd0b8fd2b9a8816.exe 2952 powershell.exe 2096 c93b7adbca782227238b433836fce87fc21927d590dda5401fd0b8fd2b9a8816.exe 2096 c93b7adbca782227238b433836fce87fc21927d590dda5401fd0b8fd2b9a8816.exe 2096 c93b7adbca782227238b433836fce87fc21927d590dda5401fd0b8fd2b9a8816.exe 2096 c93b7adbca782227238b433836fce87fc21927d590dda5401fd0b8fd2b9a8816.exe 2096 c93b7adbca782227238b433836fce87fc21927d590dda5401fd0b8fd2b9a8816.exe 2096 c93b7adbca782227238b433836fce87fc21927d590dda5401fd0b8fd2b9a8816.exe 2096 c93b7adbca782227238b433836fce87fc21927d590dda5401fd0b8fd2b9a8816.exe 2096 c93b7adbca782227238b433836fce87fc21927d590dda5401fd0b8fd2b9a8816.exe 2096 c93b7adbca782227238b433836fce87fc21927d590dda5401fd0b8fd2b9a8816.exe 2096 c93b7adbca782227238b433836fce87fc21927d590dda5401fd0b8fd2b9a8816.exe 2096 c93b7adbca782227238b433836fce87fc21927d590dda5401fd0b8fd2b9a8816.exe 2096 c93b7adbca782227238b433836fce87fc21927d590dda5401fd0b8fd2b9a8816.exe 2096 c93b7adbca782227238b433836fce87fc21927d590dda5401fd0b8fd2b9a8816.exe 2096 c93b7adbca782227238b433836fce87fc21927d590dda5401fd0b8fd2b9a8816.exe 2096 c93b7adbca782227238b433836fce87fc21927d590dda5401fd0b8fd2b9a8816.exe 2168 lutlgidagtja.exe 2160 powershell.exe 2168 lutlgidagtja.exe 2168 lutlgidagtja.exe 2168 lutlgidagtja.exe 2168 lutlgidagtja.exe 2168 lutlgidagtja.exe 2168 lutlgidagtja.exe 2168 lutlgidagtja.exe 2168 lutlgidagtja.exe 2168 lutlgidagtja.exe 2168 lutlgidagtja.exe 2168 lutlgidagtja.exe 2168 lutlgidagtja.exe 2072 nslookup.exe 2072 nslookup.exe 2072 nslookup.exe 2072 nslookup.exe 2072 nslookup.exe 2072 nslookup.exe 2072 nslookup.exe 2072 nslookup.exe 2072 nslookup.exe 2072 nslookup.exe 2072 nslookup.exe 2072 nslookup.exe 2072 nslookup.exe 2072 nslookup.exe 2072 nslookup.exe 2072 nslookup.exe 2072 nslookup.exe 2072 nslookup.exe 2072 nslookup.exe 2072 nslookup.exe 2072 nslookup.exe 2072 nslookup.exe 2072 nslookup.exe 2072 nslookup.exe 2072 nslookup.exe 2072 nslookup.exe 2072 nslookup.exe 2072 nslookup.exe 2072 nslookup.exe 2072 nslookup.exe 2072 nslookup.exe 2072 nslookup.exe 2072 nslookup.exe -
Suspicious use of AdjustPrivilegeToken 11 IoCs
description pid Process Token: SeDebugPrivilege 2952 powershell.exe Token: SeShutdownPrivilege 2448 powercfg.exe Token: SeShutdownPrivilege 2416 powercfg.exe Token: SeShutdownPrivilege 2460 powercfg.exe Token: SeShutdownPrivilege 2840 powercfg.exe Token: SeDebugPrivilege 2160 powershell.exe Token: SeShutdownPrivilege 2824 powercfg.exe Token: SeShutdownPrivilege 2984 powercfg.exe Token: SeShutdownPrivilege 2836 powercfg.exe Token: SeShutdownPrivilege 2424 powercfg.exe Token: SeLockMemoryPrivilege 2072 nslookup.exe -
Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 2536 wrote to memory of 2500 2536 cmd.exe 34 PID 2536 wrote to memory of 2500 2536 cmd.exe 34 PID 2536 wrote to memory of 2500 2536 cmd.exe 34 PID 2700 wrote to memory of 2724 2700 cmd.exe 61 PID 2700 wrote to memory of 2724 2700 cmd.exe 61 PID 2700 wrote to memory of 2724 2700 cmd.exe 61 PID 1480 wrote to memory of 2564 1480 cmd.exe 69 PID 1480 wrote to memory of 2564 1480 cmd.exe 69 PID 1480 wrote to memory of 2564 1480 cmd.exe 69 PID 2168 wrote to memory of 2056 2168 lutlgidagtja.exe 84 PID 2168 wrote to memory of 2056 2168 lutlgidagtja.exe 84 PID 2168 wrote to memory of 2056 2168 lutlgidagtja.exe 84 PID 2168 wrote to memory of 2056 2168 lutlgidagtja.exe 84 PID 2168 wrote to memory of 2056 2168 lutlgidagtja.exe 84 PID 2168 wrote to memory of 2056 2168 lutlgidagtja.exe 84 PID 2168 wrote to memory of 2056 2168 lutlgidagtja.exe 84 PID 2168 wrote to memory of 2056 2168 lutlgidagtja.exe 84 PID 2168 wrote to memory of 2056 2168 lutlgidagtja.exe 84 PID 2168 wrote to memory of 2072 2168 lutlgidagtja.exe 87 PID 2168 wrote to memory of 2072 2168 lutlgidagtja.exe 87 PID 2168 wrote to memory of 2072 2168 lutlgidagtja.exe 87 PID 2168 wrote to memory of 2072 2168 lutlgidagtja.exe 87 PID 2168 wrote to memory of 2072 2168 lutlgidagtja.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\c93b7adbca782227238b433836fce87fc21927d590dda5401fd0b8fd2b9a8816.exe"C:\Users\Admin\AppData\Local\Temp\c93b7adbca782227238b433836fce87fc21927d590dda5401fd0b8fd2b9a8816.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2096 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2952
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵
- Drops file in Windows directory
PID:2500
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
PID:2768
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
PID:2544
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
PID:2420
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
PID:2408
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
PID:2432
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Suspicious use of AdjustPrivilegeToken
PID:2416
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Suspicious use of AdjustPrivilegeToken
PID:2448
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Suspicious use of AdjustPrivilegeToken
PID:2460
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Suspicious use of AdjustPrivilegeToken
PID:2840
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "JIOGRCSG"2⤵
- Launches sc.exe
PID:2972
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "JIOGRCSG" binpath= "C:\ProgramData\zvycwxhpsxqt\lutlgidagtja.exe" start= "auto"2⤵
- Launches sc.exe
PID:1624
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog2⤵
- Launches sc.exe
PID:2472
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "JIOGRCSG"2⤵
- Launches sc.exe
PID:2560
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\c93b7adbca782227238b433836fce87fc21927d590dda5401fd0b8fd2b9a8816.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:2724
-
-
-
C:\ProgramData\zvycwxhpsxqt\lutlgidagtja.exeC:\ProgramData\zvycwxhpsxqt\lutlgidagtja.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2160
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵
- Drops file in Windows directory
PID:2564
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
PID:1596
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
PID:868
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
PID:2308
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
PID:2036
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
PID:2864
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Suspicious use of AdjustPrivilegeToken
PID:2984
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Suspicious use of AdjustPrivilegeToken
PID:2836
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Suspicious use of AdjustPrivilegeToken
PID:2824
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Suspicious use of AdjustPrivilegeToken
PID:2424
-
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵PID:2056
-
-
C:\Windows\system32\nslookup.exenslookup.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2072
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
829KB
MD517bf5cec8497597a882d27a8c68ce1d6
SHA14396f7f7fcdbdb6c51289dc3824c8c46f324e376
SHA25615cbd6cc7eada84c6b7488611a638bad4d46ad1d66955df2d7e8b6b2618b5f86
SHA512c1aef448cb92cb0a918fc0198018910c77880d78f8e66efd81f3e82934357b67ccd3d70b55624d05e43b7f678cb6c6cc5e6aea3f139cbdc22b17237f37eb6825
-
Filesize
320KB
MD5b1ad48d0d3193164bfdec84193d45a26
SHA19806df4a6afc8d3092de6314edec9b114717ccf5
SHA256207645738a5c83959134be471e858eb05938f22da97e9c661d1d113e3cd4e800
SHA5123a3916671105888d3b9bc76a5e014a5214306ff2e1c1d070702e895040127fc229bcc3838b8fa5bd79efad405342f2495afbbdbf5daf34383b6382138d4985fe
-
Filesize
757KB
MD5bebfc6d366c1309e73ffd36a4ae8c0a9
SHA1b2ef35e29c802502fe6178044f3b4d87dc6473e2
SHA25699cd31279935bb2380afecfb2df60fc861bb04250daa18f0e10d54d9294fcaea
SHA512b8e8a5b54495f1c985d9e693e27624407ad27ef930606a6233e480c51194cb0403b0b3fa0bb6a0dd7c2f760afea3032576fb3758fc9c9e53c91444b09489e6cc
-
Filesize
673KB
MD5e0d866604a525de2aa62461fa9126c30
SHA18661c92c1058cb69f86cf97c0d257fab8c449faa
SHA25687190747f7ea316c59b16aa3aec343ca65dbd043ff595aa32159ebd7cbb2c744
SHA5123c59e7670f8e88c4a63454b7820efdf9352c68a72b73ce26cec85e64db7d09c17bad5423ce90eca11769701e65e84e619ec12f3b778204a0a2ea5ae49e93b706