Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
135s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
29/04/2024, 00:41
Behavioral task
behavioral1
Sample
a486d2a0b6b61b32aa9c2656cf3bc41f4e52e8a9e42d1acc3d4ded6799d7bed7.exe
Resource
win7-20240419-en
General
-
Target
a486d2a0b6b61b32aa9c2656cf3bc41f4e52e8a9e42d1acc3d4ded6799d7bed7.exe
-
Size
858KB
-
MD5
be0e619026ab61ce6f26cfac1662abe5
-
SHA1
c62908e7042a7c1ccd63d3c14924e6231e983e69
-
SHA256
a486d2a0b6b61b32aa9c2656cf3bc41f4e52e8a9e42d1acc3d4ded6799d7bed7
-
SHA512
453b6478100234d470e1c9cd340424482d31e7aba931494a044278160efb48017983d3982b64100f7c6ae462f5f01136f3b80cc39dea32b66aff0f1d0e746fb3
-
SSDEEP
12288:zJB0lh5aILwtFPCfmAUtFC6NXbv+GEBQqtGSs9U3NL9WEEoLPw9IWPzX:zQ5aILMCfmAUjzX6xQt9U3917LwpP7
Malware Config
Signatures
-
KPOT Core Executable 1 IoCs
resource yara_rule behavioral1/files/0x00090000000134f5-21.dat family_kpot -
Trickbot x86 loader 5 IoCs
Detected Trickbot's x86 loader that unpacks the x86 payload.
resource yara_rule behavioral1/memory/2444-19-0x0000000000370000-0x0000000000399000-memory.dmp trickbot_loader32 behavioral1/memory/2444-15-0x0000000000370000-0x0000000000399000-memory.dmp trickbot_loader32 behavioral1/memory/2444-28-0x0000000000370000-0x0000000000399000-memory.dmp trickbot_loader32 behavioral1/memory/2632-61-0x0000000002480000-0x00000000024A9000-memory.dmp trickbot_loader32 behavioral1/memory/2632-48-0x0000000002480000-0x00000000024A9000-memory.dmp trickbot_loader32 -
Stops running service(s) 3 TTPs
-
Executes dropped EXE 3 IoCs
pid Process 2632 a497d2a0b7b71b32aa9c2767cf3bc41f4e62e9a9e42d1acc3d4ded7899d8bed8.exe 812 a497d2a0b7b71b32aa9c2767cf3bc41f4e62e9a9e42d1acc3d4ded7899d8bed8.exe 568 a497d2a0b7b71b32aa9c2767cf3bc41f4e62e9a9e42d1acc3d4ded7899d8bed8.exe -
Loads dropped DLL 2 IoCs
pid Process 2444 a486d2a0b6b61b32aa9c2656cf3bc41f4e52e8a9e42d1acc3d4ded6799d7bed7.exe 2444 a486d2a0b6b61b32aa9c2656cf3bc41f4e52e8a9e42d1acc3d4ded6799d7bed7.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 1300 sc.exe 2588 sc.exe 340 sc.exe 1896 sc.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2444 a486d2a0b6b61b32aa9c2656cf3bc41f4e52e8a9e42d1acc3d4ded6799d7bed7.exe 2444 a486d2a0b6b61b32aa9c2656cf3bc41f4e52e8a9e42d1acc3d4ded6799d7bed7.exe 2444 a486d2a0b6b61b32aa9c2656cf3bc41f4e52e8a9e42d1acc3d4ded6799d7bed7.exe 2632 a497d2a0b7b71b32aa9c2767cf3bc41f4e62e9a9e42d1acc3d4ded7899d8bed8.exe 2632 a497d2a0b7b71b32aa9c2767cf3bc41f4e62e9a9e42d1acc3d4ded7899d8bed8.exe 2632 a497d2a0b7b71b32aa9c2767cf3bc41f4e62e9a9e42d1acc3d4ded7899d8bed8.exe 760 powershell.exe 1412 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 760 powershell.exe Token: SeDebugPrivilege 1412 powershell.exe Token: SeTcbPrivilege 812 a497d2a0b7b71b32aa9c2767cf3bc41f4e62e9a9e42d1acc3d4ded7899d8bed8.exe Token: SeTcbPrivilege 568 a497d2a0b7b71b32aa9c2767cf3bc41f4e62e9a9e42d1acc3d4ded7899d8bed8.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2444 a486d2a0b6b61b32aa9c2656cf3bc41f4e52e8a9e42d1acc3d4ded6799d7bed7.exe 2632 a497d2a0b7b71b32aa9c2767cf3bc41f4e62e9a9e42d1acc3d4ded7899d8bed8.exe 812 a497d2a0b7b71b32aa9c2767cf3bc41f4e62e9a9e42d1acc3d4ded7899d8bed8.exe 568 a497d2a0b7b71b32aa9c2767cf3bc41f4e62e9a9e42d1acc3d4ded7899d8bed8.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2444 wrote to memory of 2796 2444 a486d2a0b6b61b32aa9c2656cf3bc41f4e52e8a9e42d1acc3d4ded6799d7bed7.exe 28 PID 2444 wrote to memory of 2796 2444 a486d2a0b6b61b32aa9c2656cf3bc41f4e52e8a9e42d1acc3d4ded6799d7bed7.exe 28 PID 2444 wrote to memory of 2796 2444 a486d2a0b6b61b32aa9c2656cf3bc41f4e52e8a9e42d1acc3d4ded6799d7bed7.exe 28 PID 2444 wrote to memory of 2796 2444 a486d2a0b6b61b32aa9c2656cf3bc41f4e52e8a9e42d1acc3d4ded6799d7bed7.exe 28 PID 2444 wrote to memory of 2808 2444 a486d2a0b6b61b32aa9c2656cf3bc41f4e52e8a9e42d1acc3d4ded6799d7bed7.exe 29 PID 2444 wrote to memory of 2808 2444 a486d2a0b6b61b32aa9c2656cf3bc41f4e52e8a9e42d1acc3d4ded6799d7bed7.exe 29 PID 2444 wrote to memory of 2808 2444 a486d2a0b6b61b32aa9c2656cf3bc41f4e52e8a9e42d1acc3d4ded6799d7bed7.exe 29 PID 2444 wrote to memory of 2808 2444 a486d2a0b6b61b32aa9c2656cf3bc41f4e52e8a9e42d1acc3d4ded6799d7bed7.exe 29 PID 2444 wrote to memory of 2896 2444 a486d2a0b6b61b32aa9c2656cf3bc41f4e52e8a9e42d1acc3d4ded6799d7bed7.exe 32 PID 2444 wrote to memory of 2896 2444 a486d2a0b6b61b32aa9c2656cf3bc41f4e52e8a9e42d1acc3d4ded6799d7bed7.exe 32 PID 2444 wrote to memory of 2896 2444 a486d2a0b6b61b32aa9c2656cf3bc41f4e52e8a9e42d1acc3d4ded6799d7bed7.exe 32 PID 2444 wrote to memory of 2896 2444 a486d2a0b6b61b32aa9c2656cf3bc41f4e52e8a9e42d1acc3d4ded6799d7bed7.exe 32 PID 2444 wrote to memory of 2632 2444 a486d2a0b6b61b32aa9c2656cf3bc41f4e52e8a9e42d1acc3d4ded6799d7bed7.exe 34 PID 2444 wrote to memory of 2632 2444 a486d2a0b6b61b32aa9c2656cf3bc41f4e52e8a9e42d1acc3d4ded6799d7bed7.exe 34 PID 2444 wrote to memory of 2632 2444 a486d2a0b6b61b32aa9c2656cf3bc41f4e52e8a9e42d1acc3d4ded6799d7bed7.exe 34 PID 2444 wrote to memory of 2632 2444 a486d2a0b6b61b32aa9c2656cf3bc41f4e52e8a9e42d1acc3d4ded6799d7bed7.exe 34 PID 2632 wrote to memory of 2696 2632 a497d2a0b7b71b32aa9c2767cf3bc41f4e62e9a9e42d1acc3d4ded7899d8bed8.exe 35 PID 2632 wrote to memory of 2696 2632 a497d2a0b7b71b32aa9c2767cf3bc41f4e62e9a9e42d1acc3d4ded7899d8bed8.exe 35 PID 2632 wrote to memory of 2696 2632 a497d2a0b7b71b32aa9c2767cf3bc41f4e62e9a9e42d1acc3d4ded7899d8bed8.exe 35 PID 2632 wrote to memory of 2696 2632 a497d2a0b7b71b32aa9c2767cf3bc41f4e62e9a9e42d1acc3d4ded7899d8bed8.exe 35 PID 2632 wrote to memory of 2576 2632 a497d2a0b7b71b32aa9c2767cf3bc41f4e62e9a9e42d1acc3d4ded7899d8bed8.exe 36 PID 2632 wrote to memory of 2576 2632 a497d2a0b7b71b32aa9c2767cf3bc41f4e62e9a9e42d1acc3d4ded7899d8bed8.exe 36 PID 2632 wrote to memory of 2576 2632 a497d2a0b7b71b32aa9c2767cf3bc41f4e62e9a9e42d1acc3d4ded7899d8bed8.exe 36 PID 2632 wrote to memory of 2576 2632 a497d2a0b7b71b32aa9c2767cf3bc41f4e62e9a9e42d1acc3d4ded7899d8bed8.exe 36 PID 2632 wrote to memory of 2580 2632 a497d2a0b7b71b32aa9c2767cf3bc41f4e62e9a9e42d1acc3d4ded7899d8bed8.exe 37 PID 2632 wrote to memory of 2580 2632 a497d2a0b7b71b32aa9c2767cf3bc41f4e62e9a9e42d1acc3d4ded7899d8bed8.exe 37 PID 2632 wrote to memory of 2580 2632 a497d2a0b7b71b32aa9c2767cf3bc41f4e62e9a9e42d1acc3d4ded7899d8bed8.exe 37 PID 2632 wrote to memory of 2580 2632 a497d2a0b7b71b32aa9c2767cf3bc41f4e62e9a9e42d1acc3d4ded7899d8bed8.exe 37 PID 2632 wrote to memory of 2544 2632 a497d2a0b7b71b32aa9c2767cf3bc41f4e62e9a9e42d1acc3d4ded7899d8bed8.exe 38 PID 2632 wrote to memory of 2544 2632 a497d2a0b7b71b32aa9c2767cf3bc41f4e62e9a9e42d1acc3d4ded7899d8bed8.exe 38 PID 2632 wrote to memory of 2544 2632 a497d2a0b7b71b32aa9c2767cf3bc41f4e62e9a9e42d1acc3d4ded7899d8bed8.exe 38 PID 2632 wrote to memory of 2544 2632 a497d2a0b7b71b32aa9c2767cf3bc41f4e62e9a9e42d1acc3d4ded7899d8bed8.exe 38 PID 2632 wrote to memory of 2544 2632 a497d2a0b7b71b32aa9c2767cf3bc41f4e62e9a9e42d1acc3d4ded7899d8bed8.exe 38 PID 2632 wrote to memory of 2544 2632 a497d2a0b7b71b32aa9c2767cf3bc41f4e62e9a9e42d1acc3d4ded7899d8bed8.exe 38 PID 2632 wrote to memory of 2544 2632 a497d2a0b7b71b32aa9c2767cf3bc41f4e62e9a9e42d1acc3d4ded7899d8bed8.exe 38 PID 2576 wrote to memory of 1300 2576 cmd.exe 42 PID 2576 wrote to memory of 1300 2576 cmd.exe 42 PID 2576 wrote to memory of 1300 2576 cmd.exe 42 PID 2576 wrote to memory of 1300 2576 cmd.exe 42 PID 2796 wrote to memory of 2588 2796 cmd.exe 43 PID 2796 wrote to memory of 2588 2796 cmd.exe 43 PID 2796 wrote to memory of 2588 2796 cmd.exe 43 PID 2796 wrote to memory of 2588 2796 cmd.exe 43 PID 2696 wrote to memory of 1896 2696 cmd.exe 44 PID 2696 wrote to memory of 1896 2696 cmd.exe 44 PID 2696 wrote to memory of 1896 2696 cmd.exe 44 PID 2696 wrote to memory of 1896 2696 cmd.exe 44 PID 2808 wrote to memory of 340 2808 cmd.exe 45 PID 2808 wrote to memory of 340 2808 cmd.exe 45 PID 2808 wrote to memory of 340 2808 cmd.exe 45 PID 2808 wrote to memory of 340 2808 cmd.exe 45 PID 2896 wrote to memory of 760 2896 cmd.exe 46 PID 2896 wrote to memory of 760 2896 cmd.exe 46 PID 2896 wrote to memory of 760 2896 cmd.exe 46 PID 2896 wrote to memory of 760 2896 cmd.exe 46 PID 2580 wrote to memory of 1412 2580 cmd.exe 47 PID 2580 wrote to memory of 1412 2580 cmd.exe 47 PID 2580 wrote to memory of 1412 2580 cmd.exe 47 PID 2580 wrote to memory of 1412 2580 cmd.exe 47 PID 2632 wrote to memory of 2544 2632 a497d2a0b7b71b32aa9c2767cf3bc41f4e62e9a9e42d1acc3d4ded7899d8bed8.exe 38 PID 2632 wrote to memory of 2544 2632 a497d2a0b7b71b32aa9c2767cf3bc41f4e62e9a9e42d1acc3d4ded7899d8bed8.exe 38 PID 2632 wrote to memory of 2544 2632 a497d2a0b7b71b32aa9c2767cf3bc41f4e62e9a9e42d1acc3d4ded7899d8bed8.exe 38 PID 2632 wrote to memory of 2544 2632 a497d2a0b7b71b32aa9c2767cf3bc41f4e62e9a9e42d1acc3d4ded7899d8bed8.exe 38 PID 2632 wrote to memory of 2544 2632 a497d2a0b7b71b32aa9c2767cf3bc41f4e62e9a9e42d1acc3d4ded7899d8bed8.exe 38 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\a486d2a0b6b61b32aa9c2656cf3bc41f4e52e8a9e42d1acc3d4ded6799d7bed7.exe"C:\Users\Admin\AppData\Local\Temp\a486d2a0b6b61b32aa9c2656cf3bc41f4e52e8a9e42d1acc3d4ded6799d7bed7.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Windows\SysWOW64\cmd.exe/c sc stop WinDefend2⤵
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Windows\SysWOW64\sc.exesc stop WinDefend3⤵
- Launches sc.exe
PID:2588
-
-
-
C:\Windows\SysWOW64\cmd.exe/c sc delete WinDefend2⤵
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Windows\SysWOW64\sc.exesc delete WinDefend3⤵
- Launches sc.exe
PID:340
-
-
-
C:\Windows\SysWOW64\cmd.exe/c powershell Set-MpPreference -DisableRealtimeMonitoring $true2⤵
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableRealtimeMonitoring $true3⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:760
-
-
-
C:\Users\Admin\AppData\Roaming\WinSocket\a497d2a0b7b71b32aa9c2767cf3bc41f4e62e9a9e42d1acc3d4ded7899d8bed8.exeC:\Users\Admin\AppData\Roaming\WinSocket\a497d2a0b7b71b32aa9c2767cf3bc41f4e62e9a9e42d1acc3d4ded7899d8bed8.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Windows\SysWOW64\cmd.exe/c sc stop WinDefend3⤵
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Windows\SysWOW64\sc.exesc stop WinDefend4⤵
- Launches sc.exe
PID:1896
-
-
-
C:\Windows\SysWOW64\cmd.exe/c sc delete WinDefend3⤵
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Windows\SysWOW64\sc.exesc delete WinDefend4⤵
- Launches sc.exe
PID:1300
-
-
-
C:\Windows\SysWOW64\cmd.exe/c powershell Set-MpPreference -DisableRealtimeMonitoring $true3⤵
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableRealtimeMonitoring $true4⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1412
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵PID:2544
-
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {7B02735A-CE8A-46B6-AA34-777A9D967663} S-1-5-18:NT AUTHORITY\System:Service:1⤵PID:380
-
C:\Users\Admin\AppData\Roaming\WinSocket\a497d2a0b7b71b32aa9c2767cf3bc41f4e62e9a9e42d1acc3d4ded7899d8bed8.exeC:\Users\Admin\AppData\Roaming\WinSocket\a497d2a0b7b71b32aa9c2767cf3bc41f4e62e9a9e42d1acc3d4ded7899d8bed8.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:812 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵PID:2296
-
-
-
C:\Users\Admin\AppData\Roaming\WinSocket\a497d2a0b7b71b32aa9c2767cf3bc41f4e62e9a9e42d1acc3d4ded7899d8bed8.exeC:\Users\Admin\AppData\Roaming\WinSocket\a497d2a0b7b71b32aa9c2767cf3bc41f4e62e9a9e42d1acc3d4ded7899d8bed8.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:568 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵PID:2232
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize7KB
MD5078e65f72849cb872d807ff9283da03d
SHA188e5cb320422677b9078c709671bab1688ff00cd
SHA256ed572b9c9fa940a0f3d1cdecb53d55943379af118b154714b768d541acfec2ef
SHA512ea6696f07deb3344e0fd8672973dcb71c83c67a2fa5e94703d2b59a112fcf3ff29f5cea3ba54bb0b0581811406f7fc35cfbe4b907df7bccfc0df41e15ed23172
-
\Users\Admin\AppData\Roaming\WinSocket\a497d2a0b7b71b32aa9c2767cf3bc41f4e62e9a9e42d1acc3d4ded7899d8bed8.exe
Filesize858KB
MD5be0e619026ab61ce6f26cfac1662abe5
SHA1c62908e7042a7c1ccd63d3c14924e6231e983e69
SHA256a486d2a0b6b61b32aa9c2656cf3bc41f4e52e8a9e42d1acc3d4ded6799d7bed7
SHA512453b6478100234d470e1c9cd340424482d31e7aba931494a044278160efb48017983d3982b64100f7c6ae462f5f01136f3b80cc39dea32b66aff0f1d0e746fb3