Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
190s -
max time network
137s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
09/04/2024, 20:02
Behavioral task
behavioral1
Sample
9711bc0fcdf0f0f42a46e859d7c26ea61d50b05aae3ec269a1edf668081330f1.exe
Resource
win7-20240221-en
windows7-x64
11 signatures
150 seconds
General
-
Target
9711bc0fcdf0f0f42a46e859d7c26ea61d50b05aae3ec269a1edf668081330f1.exe
-
Size
1.8MB
-
MD5
d55234e703c601880f1f9392678d0dc8
-
SHA1
59435f8d2b585302447486b7719d209b45309cec
-
SHA256
9711bc0fcdf0f0f42a46e859d7c26ea61d50b05aae3ec269a1edf668081330f1
-
SHA512
ac91ff473406069a37780c319be5668909975b8108c601d4bd83b8ac84a32ee4ba86eab4f2e5b7aa8e8b43303cf4d35ea101e044e7faaaf0afd1e229d0d80a14
-
SSDEEP
24576:9r0TxazTID9UhQtRlA6Jz7kzSRciXSD3FbbBN/IyZJbOOEHqBh3SWgSklWNy+:9ZzED7tRX8SWwWpNN/IyjEOBST1WNy+
Malware Config
Signatures
-
Detect Blackmoon payload 1 IoCs
resource yara_rule behavioral1/files/0x0008000000015db7-52.dat family_blackmoon -
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/files/0x000d000000015c29-59.dat acprotect -
Executes dropped EXE 1 IoCs
pid Process 2908 TGATKP.PETE -
Loads dropped DLL 4 IoCs
pid Process 2616 9711bc0fcdf0f0f42a46e859d7c26ea61d50b05aae3ec269a1edf668081330f1.exe 2616 9711bc0fcdf0f0f42a46e859d7c26ea61d50b05aae3ec269a1edf668081330f1.exe 2908 TGATKP.PETE 2908 TGATKP.PETE -
resource yara_rule behavioral1/memory/2616-2-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2616-5-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2616-9-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2616-13-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2616-17-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2616-15-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2616-22-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2616-20-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2616-11-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2616-7-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2616-4-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2616-24-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2616-29-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2616-31-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2616-35-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2616-37-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2616-41-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2616-39-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2616-33-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2616-44-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2616-46-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2616-49-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2616-27-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2616-51-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/files/0x000d000000015c29-59.dat upx behavioral1/memory/2908-62-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2908-63-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2908-66-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2908-68-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2908-70-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2908-72-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2908-75-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2908-77-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2908-79-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2908-81-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2908-83-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2908-87-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2908-91-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2908-98-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2908-107-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2908-110-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2908-125-0x0000000010000000-0x000000001003E000-memory.dmp upx -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\ESPI11.dll TGATKP.PETE File opened for modification C:\Windows\SysWOW64\ESPI11.dll TGATKP.PETE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2908 TGATKP.PETE 2908 TGATKP.PETE 2908 TGATKP.PETE 2908 TGATKP.PETE 2908 TGATKP.PETE 2908 TGATKP.PETE 2908 TGATKP.PETE 2908 TGATKP.PETE 2908 TGATKP.PETE 2908 TGATKP.PETE 2908 TGATKP.PETE 2908 TGATKP.PETE 2908 TGATKP.PETE 2908 TGATKP.PETE 2908 TGATKP.PETE 2908 TGATKP.PETE 2908 TGATKP.PETE 2908 TGATKP.PETE 2908 TGATKP.PETE 2908 TGATKP.PETE 2908 TGATKP.PETE 2908 TGATKP.PETE 2908 TGATKP.PETE 2908 TGATKP.PETE 2908 TGATKP.PETE 2908 TGATKP.PETE 2908 TGATKP.PETE 2908 TGATKP.PETE 2908 TGATKP.PETE 2908 TGATKP.PETE 2908 TGATKP.PETE 2908 TGATKP.PETE 2908 TGATKP.PETE 2908 TGATKP.PETE 2908 TGATKP.PETE 2908 TGATKP.PETE 2908 TGATKP.PETE 2908 TGATKP.PETE 2908 TGATKP.PETE 2908 TGATKP.PETE 2908 TGATKP.PETE 2908 TGATKP.PETE 2908 TGATKP.PETE 2908 TGATKP.PETE 2908 TGATKP.PETE 2908 TGATKP.PETE 2908 TGATKP.PETE 2908 TGATKP.PETE 2908 TGATKP.PETE 2908 TGATKP.PETE 2908 TGATKP.PETE 2908 TGATKP.PETE 2908 TGATKP.PETE 2908 TGATKP.PETE 2908 TGATKP.PETE 2908 TGATKP.PETE 2908 TGATKP.PETE 2908 TGATKP.PETE 2908 TGATKP.PETE 2908 TGATKP.PETE 2908 TGATKP.PETE 2908 TGATKP.PETE 2908 TGATKP.PETE 2908 TGATKP.PETE -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2908 TGATKP.PETE Token: 33 2908 TGATKP.PETE Token: SeIncBasePriorityPrivilege 2908 TGATKP.PETE Token: 33 2908 TGATKP.PETE Token: SeIncBasePriorityPrivilege 2908 TGATKP.PETE Token: 33 2908 TGATKP.PETE Token: SeIncBasePriorityPrivilege 2908 TGATKP.PETE Token: 33 2908 TGATKP.PETE Token: SeIncBasePriorityPrivilege 2908 TGATKP.PETE Token: 33 2908 TGATKP.PETE Token: SeIncBasePriorityPrivilege 2908 TGATKP.PETE Token: 33 2908 TGATKP.PETE Token: SeIncBasePriorityPrivilege 2908 TGATKP.PETE Token: 33 2908 TGATKP.PETE Token: SeIncBasePriorityPrivilege 2908 TGATKP.PETE Token: 33 2908 TGATKP.PETE Token: SeIncBasePriorityPrivilege 2908 TGATKP.PETE Token: 33 2908 TGATKP.PETE Token: SeIncBasePriorityPrivilege 2908 TGATKP.PETE Token: 33 2908 TGATKP.PETE Token: SeIncBasePriorityPrivilege 2908 TGATKP.PETE Token: 33 2908 TGATKP.PETE Token: SeIncBasePriorityPrivilege 2908 TGATKP.PETE Token: 33 2908 TGATKP.PETE Token: SeIncBasePriorityPrivilege 2908 TGATKP.PETE Token: 33 2908 TGATKP.PETE Token: SeIncBasePriorityPrivilege 2908 TGATKP.PETE Token: 33 2908 TGATKP.PETE Token: SeIncBasePriorityPrivilege 2908 TGATKP.PETE Token: 33 2908 TGATKP.PETE Token: SeIncBasePriorityPrivilege 2908 TGATKP.PETE Token: 33 2908 TGATKP.PETE Token: SeIncBasePriorityPrivilege 2908 TGATKP.PETE Token: 33 2908 TGATKP.PETE Token: SeIncBasePriorityPrivilege 2908 TGATKP.PETE Token: 33 2908 TGATKP.PETE Token: SeIncBasePriorityPrivilege 2908 TGATKP.PETE Token: 33 2908 TGATKP.PETE Token: SeIncBasePriorityPrivilege 2908 TGATKP.PETE Token: 33 2908 TGATKP.PETE Token: SeIncBasePriorityPrivilege 2908 TGATKP.PETE Token: 33 2908 TGATKP.PETE Token: SeIncBasePriorityPrivilege 2908 TGATKP.PETE Token: 33 2908 TGATKP.PETE Token: SeIncBasePriorityPrivilege 2908 TGATKP.PETE Token: 33 2908 TGATKP.PETE Token: SeIncBasePriorityPrivilege 2908 TGATKP.PETE Token: 33 2908 TGATKP.PETE Token: SeIncBasePriorityPrivilege 2908 TGATKP.PETE Token: 33 2908 TGATKP.PETE Token: SeIncBasePriorityPrivilege 2908 TGATKP.PETE Token: 33 2908 TGATKP.PETE Token: SeIncBasePriorityPrivilege 2908 TGATKP.PETE Token: 33 2908 TGATKP.PETE Token: SeIncBasePriorityPrivilege 2908 TGATKP.PETE Token: 33 2908 TGATKP.PETE Token: SeIncBasePriorityPrivilege 2908 TGATKP.PETE Token: 33 2908 TGATKP.PETE Token: SeIncBasePriorityPrivilege 2908 TGATKP.PETE Token: 33 2908 TGATKP.PETE Token: SeIncBasePriorityPrivilege 2908 TGATKP.PETE Token: 33 2908 TGATKP.PETE Token: SeIncBasePriorityPrivilege 2908 TGATKP.PETE Token: 33 2908 TGATKP.PETE -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2616 9711bc0fcdf0f0f42a46e859d7c26ea61d50b05aae3ec269a1edf668081330f1.exe 2616 9711bc0fcdf0f0f42a46e859d7c26ea61d50b05aae3ec269a1edf668081330f1.exe 2616 9711bc0fcdf0f0f42a46e859d7c26ea61d50b05aae3ec269a1edf668081330f1.exe 2908 TGATKP.PETE 2908 TGATKP.PETE 2908 TGATKP.PETE -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2616 wrote to memory of 2908 2616 9711bc0fcdf0f0f42a46e859d7c26ea61d50b05aae3ec269a1edf668081330f1.exe 29 PID 2616 wrote to memory of 2908 2616 9711bc0fcdf0f0f42a46e859d7c26ea61d50b05aae3ec269a1edf668081330f1.exe 29 PID 2616 wrote to memory of 2908 2616 9711bc0fcdf0f0f42a46e859d7c26ea61d50b05aae3ec269a1edf668081330f1.exe 29 PID 2616 wrote to memory of 2908 2616 9711bc0fcdf0f0f42a46e859d7c26ea61d50b05aae3ec269a1edf668081330f1.exe 29 PID 2908 wrote to memory of 2716 2908 TGATKP.PETE 30 PID 2908 wrote to memory of 2716 2908 TGATKP.PETE 30 PID 2908 wrote to memory of 2716 2908 TGATKP.PETE 30 PID 2908 wrote to memory of 2716 2908 TGATKP.PETE 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\9711bc0fcdf0f0f42a46e859d7c26ea61d50b05aae3ec269a1edf668081330f1.exe"C:\Users\Admin\AppData\Local\Temp\9711bc0fcdf0f0f42a46e859d7c26ea61d50b05aae3ec269a1edf668081330f1.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\TGATKP.PETE"C:\Users\Admin\AppData\Local\Temp\TGATKP.PETE"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Windows\SysWOW64\netsh.exenetsh winsock reset3⤵PID:2716
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
86KB
MD5114054313070472cd1a6d7d28f7c5002
SHA19a044986e6101df1a126035da7326a50c3fe9a23
SHA256e15d9e1b772fed3db19e67b8d54533d1a2d46a37f8b12702a5892c6b886e9db1
SHA512a2ff8481e89698dae4a1c83404105093472e384d7a3debbd7014e010543e08efc8ebb3f67c8a4ce09029e6b2a8fb7779bb402aae7c9987e61389cd8a72c73522
-
Filesize
120KB
MD5c3adbb35a05b44bc877a895d273aa270
SHA18afe20d8261d217fd23ccfe53bd45ad3bec82d2d
SHA256b2b2ea9737587313d420bde96a42063c002a83e35d9f987f8ec0d5d4d96c262c
SHA512614dc24e3368047d68e2833ecdf9cda1f5ef290fc74287769a70df46bfa937386ce2e1332b3bada0f7e54b470ecdfe7c8bbd4ec3fa1c815f52993bb7edb93afc
-
Filesize
1.8MB
MD58dcaf0d355a473a00058ecbc2bf8b875
SHA1ff4f7881e354946e67e85ff13aa8549c29cf9ac6
SHA256549c270a9baeda99796648d5af0f570b6a7cbe91e94bdbf8de9c278719f6e6b0
SHA512f9932fe7a847dbdc3d1cc89c36e86a6292288074ea09005a60a4168cdf5132b4793a647d3b59e48c0eaf875d5eb6d221d631784bfebede49ede3aa4eb1fc8b2e