Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
374s -
max time network
362s -
platform
windows7_x64 -
resource
win7-20240215-es -
resource tags
arch:x64arch:x86image:win7-20240215-eslocale:es-esos:windows7-x64systemwindows -
submitted
25/04/2024, 00:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
guiformat.exe
Resource
win7-20240215-es
windows7-x64
9 signatures
600 seconds
General
-
Target
guiformat.exe
-
Size
76KB
-
MD5
2459a629ace148286360b860442221a2
-
SHA1
e1530fe47f34bfb18c7c01ce60010c7ff80652dd
-
SHA256
647fb4f5108af632c3d52fec34934922c50c70585697504e92fb80b3b7d05ee3
-
SHA512
3db860433a6522eff77736e1dc28c76543c2cce58e054f08700e781c52674dfa35f355853a1ee73c255956ea0ffbe47f288bc7b5f1e27be6d1eda07ecb27782e
-
SSDEEP
1536:aihX6I+ob6rhXaHTcOgECqvec4ZoGcy0I:0I+UchNOgECUecGoGT
Score
6/10
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 3 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\F: guiformat.exe File opened (read-only) \??\E: vds.exe File opened (read-only) \??\E: guiformat.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 vds.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\diskmgmt.msc mmc.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\INF\setupapi.ev2 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe -
Modifies data under HKEY_USERS 43 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\63C768CF\LanguageList = 650073002d0045005300000065007300000065006e002d0055005300000065006e0000000000 DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2916 mmc.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 2512 guiformat.exe -
Suspicious use of AdjustPrivilegeToken 18 IoCs
description pid Process Token: 33 2916 mmc.exe Token: SeIncBasePriorityPrivilege 2916 mmc.exe Token: 33 2916 mmc.exe Token: SeIncBasePriorityPrivilege 2916 mmc.exe Token: SeRestorePrivilege 1876 DrvInst.exe Token: SeRestorePrivilege 1876 DrvInst.exe Token: SeRestorePrivilege 1876 DrvInst.exe Token: SeRestorePrivilege 1876 DrvInst.exe Token: SeRestorePrivilege 1876 DrvInst.exe Token: SeRestorePrivilege 1876 DrvInst.exe Token: SeRestorePrivilege 1876 DrvInst.exe Token: SeRestorePrivilege 1876 DrvInst.exe Token: SeLoadDriverPrivilege 1876 DrvInst.exe Token: SeLoadDriverPrivilege 1876 DrvInst.exe Token: 33 580 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 580 AUDIODG.EXE Token: 33 580 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 580 AUDIODG.EXE -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2916 mmc.exe 2916 mmc.exe 2916 mmc.exe 2916 mmc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\guiformat.exe"C:\Users\Admin\AppData\Local\Temp\guiformat.exe"1⤵
- Enumerates connected drives
- Suspicious behavior: LoadsDriver
PID:2512
-
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe" C:\Windows\system32\diskmgmt.msc1⤵
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2916
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:2600
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
PID:2532
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\Volume\{4938c940-cc12-11ee-9366-806e6f6e6963}#0000003D71100000" "" "" "64f46229f" "0000000000000000" "000000000000059C" "00000000000003BC"1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1876
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:2104
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x1ac1⤵
- Suspicious use of AdjustPrivilegeToken
PID:580