Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
02/05/2024, 05:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ee2fd8cfd4cf2626509b165bd26eaccb406f8336ae23146bc231677f601b70f5.exe
Resource
win7-20231129-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
ee2fd8cfd4cf2626509b165bd26eaccb406f8336ae23146bc231677f601b70f5.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
ee2fd8cfd4cf2626509b165bd26eaccb406f8336ae23146bc231677f601b70f5.exe
-
Size
135KB
-
MD5
27580e16d98942bd17c7fc15ee21b3b3
-
SHA1
fb1f6eb6aa320f19bbbaf053c8f5a8c361ef589b
-
SHA256
ee2fd8cfd4cf2626509b165bd26eaccb406f8336ae23146bc231677f601b70f5
-
SHA512
46609d708a3e23642307206ad933e68c535273541cb6decb11bb7a9baf11a67cc7ebaa2444f4854c37e546a679593cca1332e4f5babd6394af2a913d4ab64be3
-
SSDEEP
1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVK2:UVqoCl/YgjxEufVU0TbTyDDal82
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe -
Executes dropped EXE 4 IoCs
pid Process 2516 explorer.exe 2996 spoolsv.exe 1212 svchost.exe 2564 spoolsv.exe -
Loads dropped DLL 4 IoCs
pid Process 1988 ee2fd8cfd4cf2626509b165bd26eaccb406f8336ae23146bc231677f601b70f5.exe 2516 explorer.exe 2996 spoolsv.exe 1212 svchost.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" svchost.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\explorer.exe svchost.exe File opened for modification C:\Windows\SysWOW64\explorer.exe explorer.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification \??\c:\windows\resources\themes\explorer.exe ee2fd8cfd4cf2626509b165bd26eaccb406f8336ae23146bc231677f601b70f5.exe File opened for modification \??\c:\windows\resources\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\resources\svchost.exe spoolsv.exe File opened for modification C:\Windows\Resources\tjud.exe explorer.exe -
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2668 schtasks.exe 2800 schtasks.exe 2056 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1988 ee2fd8cfd4cf2626509b165bd26eaccb406f8336ae23146bc231677f601b70f5.exe 1988 ee2fd8cfd4cf2626509b165bd26eaccb406f8336ae23146bc231677f601b70f5.exe 1988 ee2fd8cfd4cf2626509b165bd26eaccb406f8336ae23146bc231677f601b70f5.exe 1988 ee2fd8cfd4cf2626509b165bd26eaccb406f8336ae23146bc231677f601b70f5.exe 1988 ee2fd8cfd4cf2626509b165bd26eaccb406f8336ae23146bc231677f601b70f5.exe 1988 ee2fd8cfd4cf2626509b165bd26eaccb406f8336ae23146bc231677f601b70f5.exe 1988 ee2fd8cfd4cf2626509b165bd26eaccb406f8336ae23146bc231677f601b70f5.exe 1988 ee2fd8cfd4cf2626509b165bd26eaccb406f8336ae23146bc231677f601b70f5.exe 1988 ee2fd8cfd4cf2626509b165bd26eaccb406f8336ae23146bc231677f601b70f5.exe 1988 ee2fd8cfd4cf2626509b165bd26eaccb406f8336ae23146bc231677f601b70f5.exe 1988 ee2fd8cfd4cf2626509b165bd26eaccb406f8336ae23146bc231677f601b70f5.exe 1988 ee2fd8cfd4cf2626509b165bd26eaccb406f8336ae23146bc231677f601b70f5.exe 1988 ee2fd8cfd4cf2626509b165bd26eaccb406f8336ae23146bc231677f601b70f5.exe 1988 ee2fd8cfd4cf2626509b165bd26eaccb406f8336ae23146bc231677f601b70f5.exe 1988 ee2fd8cfd4cf2626509b165bd26eaccb406f8336ae23146bc231677f601b70f5.exe 1988 ee2fd8cfd4cf2626509b165bd26eaccb406f8336ae23146bc231677f601b70f5.exe 1988 ee2fd8cfd4cf2626509b165bd26eaccb406f8336ae23146bc231677f601b70f5.exe 2516 explorer.exe 2516 explorer.exe 2516 explorer.exe 2516 explorer.exe 2516 explorer.exe 2516 explorer.exe 2516 explorer.exe 2516 explorer.exe 2516 explorer.exe 2516 explorer.exe 2516 explorer.exe 2516 explorer.exe 2516 explorer.exe 2516 explorer.exe 2516 explorer.exe 2516 explorer.exe 1212 svchost.exe 1212 svchost.exe 1212 svchost.exe 1212 svchost.exe 1212 svchost.exe 1212 svchost.exe 1212 svchost.exe 1212 svchost.exe 1212 svchost.exe 1212 svchost.exe 1212 svchost.exe 1212 svchost.exe 1212 svchost.exe 1212 svchost.exe 1212 svchost.exe 1212 svchost.exe 2516 explorer.exe 2516 explorer.exe 2516 explorer.exe 1212 svchost.exe 1212 svchost.exe 2516 explorer.exe 1212 svchost.exe 2516 explorer.exe 1212 svchost.exe 2516 explorer.exe 1212 svchost.exe 2516 explorer.exe 1212 svchost.exe 2516 explorer.exe 1212 svchost.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 2516 explorer.exe 1212 svchost.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 1988 ee2fd8cfd4cf2626509b165bd26eaccb406f8336ae23146bc231677f601b70f5.exe 1988 ee2fd8cfd4cf2626509b165bd26eaccb406f8336ae23146bc231677f601b70f5.exe 2516 explorer.exe 2516 explorer.exe 2996 spoolsv.exe 2996 spoolsv.exe 1212 svchost.exe 1212 svchost.exe 2564 spoolsv.exe 2564 spoolsv.exe -
Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 1988 wrote to memory of 2516 1988 ee2fd8cfd4cf2626509b165bd26eaccb406f8336ae23146bc231677f601b70f5.exe 28 PID 1988 wrote to memory of 2516 1988 ee2fd8cfd4cf2626509b165bd26eaccb406f8336ae23146bc231677f601b70f5.exe 28 PID 1988 wrote to memory of 2516 1988 ee2fd8cfd4cf2626509b165bd26eaccb406f8336ae23146bc231677f601b70f5.exe 28 PID 1988 wrote to memory of 2516 1988 ee2fd8cfd4cf2626509b165bd26eaccb406f8336ae23146bc231677f601b70f5.exe 28 PID 2516 wrote to memory of 2996 2516 explorer.exe 29 PID 2516 wrote to memory of 2996 2516 explorer.exe 29 PID 2516 wrote to memory of 2996 2516 explorer.exe 29 PID 2516 wrote to memory of 2996 2516 explorer.exe 29 PID 2996 wrote to memory of 1212 2996 spoolsv.exe 30 PID 2996 wrote to memory of 1212 2996 spoolsv.exe 30 PID 2996 wrote to memory of 1212 2996 spoolsv.exe 30 PID 2996 wrote to memory of 1212 2996 spoolsv.exe 30 PID 1212 wrote to memory of 2564 1212 svchost.exe 31 PID 1212 wrote to memory of 2564 1212 svchost.exe 31 PID 1212 wrote to memory of 2564 1212 svchost.exe 31 PID 1212 wrote to memory of 2564 1212 svchost.exe 31 PID 2516 wrote to memory of 2592 2516 explorer.exe 32 PID 2516 wrote to memory of 2592 2516 explorer.exe 32 PID 2516 wrote to memory of 2592 2516 explorer.exe 32 PID 2516 wrote to memory of 2592 2516 explorer.exe 32 PID 1212 wrote to memory of 2668 1212 svchost.exe 33 PID 1212 wrote to memory of 2668 1212 svchost.exe 33 PID 1212 wrote to memory of 2668 1212 svchost.exe 33 PID 1212 wrote to memory of 2668 1212 svchost.exe 33 PID 1212 wrote to memory of 2800 1212 svchost.exe 38 PID 1212 wrote to memory of 2800 1212 svchost.exe 38 PID 1212 wrote to memory of 2800 1212 svchost.exe 38 PID 1212 wrote to memory of 2800 1212 svchost.exe 38 PID 1212 wrote to memory of 2056 1212 svchost.exe 40 PID 1212 wrote to memory of 2056 1212 svchost.exe 40 PID 1212 wrote to memory of 2056 1212 svchost.exe 40 PID 1212 wrote to memory of 2056 1212 svchost.exe 40
Processes
-
C:\Users\Admin\AppData\Local\Temp\ee2fd8cfd4cf2626509b165bd26eaccb406f8336ae23146bc231677f601b70f5.exe"C:\Users\Admin\AppData\Local\Temp\ee2fd8cfd4cf2626509b165bd26eaccb406f8336ae23146bc231677f601b70f5.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1988 -
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe4⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1212 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2564
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 05:17 /f5⤵
- Creates scheduled task(s)
PID:2668
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 05:18 /f5⤵
- Creates scheduled task(s)
PID:2800
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 05:19 /f5⤵
- Creates scheduled task(s)
PID:2056
-
-
-
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe3⤵PID:2592
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
135KB
MD532868ddd73037bec8139722515a882da
SHA1a05484143ebf0bb8e1894a9e2f02e4351001a5a8
SHA256e617172885815dd981cf1fcb7dc2a87dcac040dece7f61781e239dc68918b77d
SHA5120827e583d77a11ae5775eda1b47c39affd3a756480f73d6b6c5094e3bf13669eb3c67ab55f13cf285d765bb2f48fc380915ff15a37403e67bd1297b445ea9e50
-
Filesize
135KB
MD5272285d4f97e19b327fbebf69ac0cc4c
SHA1176d9f3a42ded30df1e55f5c681d073f057f564b
SHA2564dd89ab440917113f34dd387c6dbf374c57b351697c918e4857da695da1c5152
SHA512a2748940c04ff56982f1a504c51a23c476a387f019682ea889fb8c294aa78ec8266147750481e6e2f384cf7abb091361337991b100cb1941075e40067e8dcdaf
-
Filesize
135KB
MD5fc5776a4303375d7897f94bd1967695f
SHA1bbc3b0dad303e6907171b93d68dbd88546822066
SHA2561d4119e424260bf1a5e74649f1886bd0a57cb306ab43bfe5159ceffecb894767
SHA51208cda49fc1a64f80d9188d95992b0e5a2ed676f15af3e6ffb95efc0dad013532c3d9029b86b4a6271a3a17594e47c0566b2cbda3484ab31ffa10d1823aae4db5