Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
157s -
platform
windows11-21h2_x64 -
resource
win11-20240221-en -
resource tags
-
submitted
13/03/2024, 23:50
General
-
Target
InstallDefenderUI.exe
-
Size
3.7MB
-
MD5
d0d4b05c2b9b7cd1b056cd619580c854
-
SHA1
31e772d20daa64b497622da4a54743b829f32bd0
-
SHA256
4fd594d6b504845b7e05d9b129bd36b2f7fd9dd71403b4a3a3d0c3b7a882f4e2
-
SHA512
435984efe7d87609eef25ab552727303b724d5a29d9383c60beb8e3216fa58da8db9df22065684e6cf2c2002029d968839f4677d9aeb0bef960e82ed78e3c95c
-
SSDEEP
98304:skLyNo01VA4hzP2ixt4RAamul5hmN5JmX7b5eNoy12:LKs4RPx/4Yc5OXeHa12
Malware Config
Signatures
-
Stops running service(s) 3 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 64 IoCs
-
Executes dropped EXE 6 IoCs
-
Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Kills process with taskkill 2 IoCs
-
Modifies registry class 12 IoCs
-
Modifies system certificate store 2 TTPs 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious behavior: LoadsDriver 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\InstallDefenderUI.exe"C:\Users\Admin\AppData\Local\Temp\InstallDefenderUI.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-1CB9B.tmp\InstallDefenderUI.tmp"C:\Users\Admin\AppData\Local\Temp\is-1CB9B.tmp\InstallDefenderUI.tmp" /SL5="$C004C,2962819,1072128,C:\Users\Admin\AppData\Local\Temp\InstallDefenderUI.exe"2⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\System32\taskkill.exe" /f /im DefenderUI.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\System32\taskkill.exe" /f /im DefenderUIService.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" stop DefenderUIService3⤵
- Launches sc.exe
-
-
C:\Program Files\DefenderUI\DefenderUIService.exe"C:\Program Files\DefenderUI\DefenderUIService.exe" --install3⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Modifies system certificate store
-
-
C:\Windows\system32\sc.exe"C:\Windows\system32\sc.exe" sdset DefenderUIService D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWRPLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)3⤵
- Launches sc.exe
-
-
-
C:\Program Files\DefenderUI\DefenderUIService.exe"C:\Program Files\DefenderUI\DefenderUIService.exe"1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\DefenderUI\DefenderUI.exe"C:\Program Files\DefenderUI\DefenderUI.exe"2⤵
- Executes dropped EXE
-
-
C:\Program Files\DefenderUI\DefenderUI.exe"C:\Program Files\DefenderUI\DefenderUI.exe" /sw1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵
-
C:\Program Files\DefenderUI\DefenderUI.exe"C:\Program Files\DefenderUI\DefenderUI.exe" /sw1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
926KB
MD51ab799964953ff86378d99fb4efc5df3
SHA133797d4425ee0dd6bb2741f5b4d33eefcacfb85f
SHA256b37e88231d14c1a555d02404c888f2f498c0c507bd7da6a263966389102fe51e
SHA512271f777e776721afec4f1013fc0cbd33b429f6eac5ba622d3ab152a90874e17aa299756412ffdbe7efdbe197afff1aa9d59a85ba94dea2dfecba5ffd81584b12
-
Filesize
1KB
MD536f7f88d6d95958be77bf1480101f149
SHA12599a397018e0ec73ec2b657ba0917ae68caea22
SHA256e15ec30bc8de4d3126da5717262801b95bc273c927b84864c0bb9787a9ce174e
SHA5120f26720dca3e5b5c4756736f3f2b28ebece5ff0a53147ed7bb5f06c28fabe17026a11234e8c1412e12eaf302198b6e449073393cb92c5f08238f503cbfd8a600
-
Filesize
865B
MD55b6388f1f9f4a91c4fbee0a61367ca24
SHA1ca63d34edb365c2ea35e14cb9a73cc823df07177
SHA256f6e5bbd75aab174b6d8316e7aea12c67e2467618293786d19d6a42a5a66ec680
SHA512d038d6bbe839ba0cb96aae09258764769c80389337f0d421f71a7bb94b93ad828aa685623908cc5f888c4048cd6970cf349d9ce1efc71241b9b1ae091beedc17
-
Filesize
333KB
MD537156a8e5b77992f0567d73dc2c23aad
SHA11358bc9468f96cbf31111660debb51c512a96c96
SHA25618365a56dbe3c376a025741f7b7198d2d7f579d8f20906f14e9d226e4272552b
SHA5126073cdd3bcee0c669faf0fa09738b7b8604ce07fa505420e497aae0ef67700fa2768cebcb081e1256f18da6e11840505116730a2ec3c3135f608aed6717b67b3
-
Filesize
1KB
MD58601f442efebfa652ba88fe057411a3a
SHA19a59e83c7f1da071ee30945744ebeedcfc467e90
SHA256fae8b2996603e19f77b736e5e210f749c443f2b371374389a5321bf92462e582
SHA51251709c40605af3ab3d7a0840e71275d51ad778ec3daad217503bdd9eb2d053593bbe0ad6262edb99b0269f64706551579e4e28960b5913b2a12c9a2d64186a65
-
Filesize
3.3MB
MD544da3dcc727f727f00f81e025ce6a359
SHA147f4d663f949c2d016d937d08fd8356addfdf670
SHA256f35cf25818a082f066d69796085caaead8600c2c453dddec9062be85816b5413
SHA512cd847755121ee9d3a7aaca4e4766decbe81319b3bad60b76c21faa310e6d53d5fc72471ef75eedc7ac7c47b5599ad13a296bbdfa2f7c6b62b9567c682ecf0cdd
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
1.7MB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
1.7MB
-
Filesize
240KB
-
Filesize
72KB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
344KB
-
Filesize
10.8MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
3.3MB
-
Filesize
4KB
-
Filesize
3.3MB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
624KB
-
Filesize
936KB
-
Filesize
10.8MB
-
Filesize
1.7MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
1.0MB
-
Filesize
320KB
-
Filesize
160KB
-
Filesize
64KB
-
Filesize
10.8MB