Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
09/03/2024, 22:00
Static task
static1
Behavioral task
behavioral1
Sample
bce9358187f87db6b269bac3c3e52edc.exe
Resource
win7-20240220-en
General
-
Target
bce9358187f87db6b269bac3c3e52edc.exe
-
Size
136KB
-
MD5
bce9358187f87db6b269bac3c3e52edc
-
SHA1
08042b0bc6e57a9d006631e35618ea7b97c22dbd
-
SHA256
1d7339aa3f70900564d27bfa2700063c7f1dbae84a07e3a182ae351c7bba23d0
-
SHA512
0073ffe9a0631003090f23a0e4862320a37faea3f6edce683d2ff64389227c29aebe3352b82e39a157291ba46ac15484b1a76ea003940f283436690fe77e908a
-
SSDEEP
3072:lj4SxxPPsMP9xbbrMbvT0q8O1cZPzQ7IXMBc+AMP+QfQEhxFyVU7p6vIE:6SxxPPsMFZwvP6bQ7yMP+DE827MwE
Malware Config
Signatures
-
Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" psure.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" psure.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" psure.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" psure.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" psure.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" psure.exe -
Looks for VMWare Tools registry key 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools bce9358187f87db6b269bac3c3e52edc.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools psure.exe -
Deletes itself 1 IoCs
pid Process 2612 psure.exe -
Executes dropped EXE 1 IoCs
pid Process 2612 psure.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" psure.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" psure.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" psure.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" psure.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" psure.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 bce9358187f87db6b269bac3c3e52edc.exe File opened for modification \??\PhysicalDrive0 psure.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat psure.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\psure.exe bce9358187f87db6b269bac3c3e52edc.exe File opened for modification C:\Windows\psure.exe bce9358187f87db6b269bac3c3e52edc.exe -
Modifies data under HKEY_USERS 24 IoCs
description ioc Process Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 psure.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" psure.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix psure.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" psure.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{42FB9790-6191-40B8-8E9C-954FB96BA2BE}\da-8b-f8-21-78-f7 psure.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" psure.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad psure.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0137000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 psure.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{42FB9790-6191-40B8-8E9C-954FB96BA2BE}\WpadDecisionTime = d02992306d72da01 psure.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{42FB9790-6191-40B8-8E9C-954FB96BA2BE}\WpadDecision = "0" psure.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{42FB9790-6191-40B8-8E9C-954FB96BA2BE}\WpadNetworkName = "Network 3" psure.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\da-8b-f8-21-78-f7\WpadDecision = "0" psure.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections psure.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 psure.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" psure.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{42FB9790-6191-40B8-8E9C-954FB96BA2BE} psure.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{42FB9790-6191-40B8-8E9C-954FB96BA2BE}\WpadDecisionReason = "1" psure.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\da-8b-f8-21-78-f7 psure.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings psure.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings psure.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ psure.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" psure.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\da-8b-f8-21-78-f7\WpadDecisionReason = "1" psure.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\da-8b-f8-21-78-f7\WpadDecisionTime = d02992306d72da01 psure.exe -
Modifies registry class 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key bce9358187f87db6b269bac3c3e52edc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ bce9358187f87db6b269bac3c3e52edc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" bce9358187f87db6b269bac3c3e52edc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key psure.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ psure.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" psure.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bce9358187f87db6b269bac3c3e52edc.exe"C:\Users\Admin\AppData\Local\Temp\bce9358187f87db6b269bac3c3e52edc.exe"1⤵
- Looks for VMWare Tools registry key
- Writes to the Master Boot Record (MBR)
- Drops file in Windows directory
- Modifies registry class
PID:1720
-
C:\Windows\psure.exe"C:\Windows\psure.exe"1⤵
- Modifies security service
- Windows security bypass
- Looks for VMWare Tools registry key
- Deletes itself
- Executes dropped EXE
- Windows security modification
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Modifies registry class
PID:2612
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
136KB
MD5bce9358187f87db6b269bac3c3e52edc
SHA108042b0bc6e57a9d006631e35618ea7b97c22dbd
SHA2561d7339aa3f70900564d27bfa2700063c7f1dbae84a07e3a182ae351c7bba23d0
SHA5120073ffe9a0631003090f23a0e4862320a37faea3f6edce683d2ff64389227c29aebe3352b82e39a157291ba46ac15484b1a76ea003940f283436690fe77e908a