Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
1210s -
max time network
1263s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
20/04/2024, 14:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a/myDriver.sys
Resource
win10v2004-20240412-en
windows10-2004-x64
8 signatures
1200 seconds
General
-
Target
a/myDriver.sys
-
Size
16KB
-
MD5
ea98412a984f3a28b077fe7db73e2629
-
SHA1
98eaa091e6b737c75bac6accc6be15013beccf91
-
SHA256
5aa6e67c99b20f02dfcad282a4bae7862e463568e02dd13a37ec43da61588527
-
SHA512
dfd8dbc96c5006065c4febc0b22487729d3943091a5a84bd00d319d26d3cc0296e67e547ebb9dd529773aba8b317eabb3650623e68db0ed933d10c11daffe2e5
-
SSDEEP
192:Hf2LrtQsx5GvVA1nI9YfG4eVorAm3/a2YcHmI7exNk7A9UOad8g8UEmFy0NCpnPO:/mbGtAKYfG4uorAm3f5GI7+nazCmT
Score
5/10
Malware Config
Signatures
-
Drops file in System32 directory 20 IoCs
description ioc Process File opened for modification C:\Windows\System32\DriverStore\Temp\{b526e71b-9439-7040-88af-c099adb699dd}\SET92A.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{b526e71b-9439-7040-88af-c099adb699dd}\SET92B.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{30ea491c-94d7-9d40-866e-b15cc6f7e0e1}\SET19BE.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{30ea491c-94d7-9d40-866e-b15cc6f7e0e1}\SET19BE.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{30ea491c-94d7-9d40-866e-b15cc6f7e0e1}\myDriver.cat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{30ea491c-94d7-9d40-866e-b15cc6f7e0e1}\myDriver.sys DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{30ea491c-94d7-9d40-866e-b15cc6f7e0e1} DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{b526e71b-9439-7040-88af-c099adb699dd}\SET919.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{30ea491c-94d7-9d40-866e-b15cc6f7e0e1}\myDriver.inf DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{30ea491c-94d7-9d40-866e-b15cc6f7e0e1}\SET19C0.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{b526e71b-9439-7040-88af-c099adb699dd}\myDriver.inf DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{b526e71b-9439-7040-88af-c099adb699dd}\myDriver.cat DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{b526e71b-9439-7040-88af-c099adb699dd}\SET92A.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{b526e71b-9439-7040-88af-c099adb699dd}\SET92B.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{b526e71b-9439-7040-88af-c099adb699dd}\myDriver.sys DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{b526e71b-9439-7040-88af-c099adb699dd} DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{30ea491c-94d7-9d40-866e-b15cc6f7e0e1}\SET19BF.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{30ea491c-94d7-9d40-866e-b15cc6f7e0e1}\SET19BF.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{b526e71b-9439-7040-88af-c099adb699dd}\SET919.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{30ea491c-94d7-9d40-866e-b15cc6f7e0e1}\SET19C0.tmp DrvInst.exe -
Drops file in Windows directory 5 IoCs
description ioc Process File opened for modification C:\Windows\INF\setupapi.dev.log pnputil.exe File opened for modification C:\Windows\INF\setupapi.dev.log svchost.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log pnputil.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 3472 sc.exe -
Checks SCSI registry key(s) 3 TTPs 10 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 svchost.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 4800 powershell.exe 4800 powershell.exe 4800 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4800 powershell.exe Token: SeAuditPrivilege 1256 svchost.exe Token: SeSecurityPrivilege 1256 svchost.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 4800 wrote to memory of 4416 4800 powershell.exe 129 PID 4800 wrote to memory of 4416 4800 powershell.exe 129 PID 4800 wrote to memory of 3164 4800 powershell.exe 131 PID 4800 wrote to memory of 3164 4800 powershell.exe 131 PID 1256 wrote to memory of 4544 1256 svchost.exe 133 PID 1256 wrote to memory of 4544 1256 svchost.exe 133 PID 4800 wrote to memory of 3472 4800 powershell.exe 134 PID 4800 wrote to memory of 3472 4800 powershell.exe 134 PID 4800 wrote to memory of 1756 4800 powershell.exe 135 PID 4800 wrote to memory of 1756 4800 powershell.exe 135 PID 1256 wrote to memory of 2508 1256 svchost.exe 136 PID 1256 wrote to memory of 2508 1256 svchost.exe 136
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\a\myDriver.sys1⤵PID:1256
-
C:\Users\Admin\AppData\Local\Temp\a\myDriver.sysC:\Users\Admin\AppData\Local\Temp\a\myDriver.sys2⤵PID:3000
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Users\Admin\AppData\Local\Temp\a\MoneyGrabber.exe"C:\Users\Admin\AppData\Local\Temp\a\MoneyGrabber.exe"2⤵PID:4416
-
-
C:\Windows\system32\pnputil.exe"C:\Windows\system32\pnputil.exe" /add-driver .\myDriver.inf /install2⤵
- Drops file in Windows directory
PID:3164
-
-
C:\Windows\system32\sc.exe"C:\Windows\system32\sc.exe" start myDriver2⤵
- Launches sc.exe
PID:3472
-
-
C:\Windows\system32\pnputil.exe"C:\Windows\system32\pnputil.exe" /add-driver .\myDriver.inf /install2⤵
- Drops file in Windows directory
PID:1756
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1280
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1256 -
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{456ec49f-ea70-fa47-879d-b39400b8b671}\myDriver.inf" "9" "41b46ff43" "000000000000014C" "WinSta0\Default" "0000000000000164" "208" "C:\Users\Admin\AppData\Local\Temp\a"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:4544
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{e7f5848b-e6a2-b949-8dbb-a4c03b8171f6}\myDriver.inf" "9" "41b46ff43" "0000000000000188" "WinSta0\Default" "000000000000018C" "208" "C:\Users\Admin\AppData\Local\Temp\a"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:2508
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
2KB
MD527e74d02728dbf0dc63efe7292833126
SHA1d74fb90f0dc704eae3d6ce0459d0a551d077e9ed
SHA256685e91c151845093f316362c093547bbecde3ab0f27d412f644eeab9e7bc68f4
SHA512e5d181e9c2407a58231d88449da8c97e264a8a2b1a10bd412b59e97caccf5a0b04a1553eabb2b3c85c73b7647dd8405b584e0db8c979ff187d30a1f88a73d390
-
Filesize
1KB
MD58dd881d5d8a835544386c2f02bcc5096
SHA1bfae64d5691e09d3f2c6083b1d881c2a7a6934bf
SHA256b276dcf68623c18c6dd9e5f1f00ef35728f42e63205af30e5d1840b6094ee378
SHA512b0412f3ebe1d13917c1449c2da1ac500baa8f081bec86e460305a6157edb5aebdbe13ca50ca85ca846c74b380775e75c68d304e16fb7c297d1e90ed850b63dcf
-
Filesize
16KB
MD5ea98412a984f3a28b077fe7db73e2629
SHA198eaa091e6b737c75bac6accc6be15013beccf91
SHA2565aa6e67c99b20f02dfcad282a4bae7862e463568e02dd13a37ec43da61588527
SHA512dfd8dbc96c5006065c4febc0b22487729d3943091a5a84bd00d319d26d3cc0296e67e547ebb9dd529773aba8b317eabb3650623e68db0ed933d10c11daffe2e5