Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
7Big tits a...ss.scr
windows7-x64
10Big tits a...ss.scr
windows10-2004-x64
10Choky Ice ...on.scr
windows7-x64
10Choky Ice ...on.scr
windows10-2004-x64
10Come Inside.scr
windows7-x64
10Come Inside.scr
windows10-2004-x64
10Ivana Suga...se.scr
windows7-x64
10Ivana Suga...se.scr
windows10-2004-x64
10Surprise f...oy.scr
windows7-x64
10Surprise f...oy.scr
windows10-2004-x64
10Analysis
-
max time kernel
140s -
max time network
139s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
14/05/2024, 23:23
Behavioral task
behavioral1
Sample
Big tits and deep ass.scr
Resource
win7-20240221-en
windows7-x64
21 signatures
150 seconds
Behavioral task
behavioral2
Sample
Big tits and deep ass.scr
Resource
win10v2004-20240426-en
windows10-2004-x64
21 signatures
150 seconds
Behavioral task
behavioral3
Sample
Choky Ice And His Best Friend Max A Surprising Us With Great Threesome Action.scr
Resource
win7-20240221-en
windows7-x64
21 signatures
150 seconds
Behavioral task
behavioral4
Sample
Choky Ice And His Best Friend Max A Surprising Us With Great Threesome Action.scr
Resource
win10v2004-20240508-en
windows10-2004-x64
21 signatures
150 seconds
Behavioral task
behavioral5
Sample
Come Inside.scr
Resource
win7-20240221-en
windows7-x64
21 signatures
150 seconds
Behavioral task
behavioral6
Sample
Come Inside.scr
Resource
win10v2004-20240426-en
windows10-2004-x64
21 signatures
150 seconds
Behavioral task
behavioral7
Sample
Ivana Sugar Dp By Surprise.scr
Resource
win7-20240215-en
windows7-x64
21 signatures
150 seconds
Behavioral task
behavioral8
Sample
Ivana Sugar Dp By Surprise.scr
Resource
win10v2004-20240426-en
windows10-2004-x64
21 signatures
150 seconds
Behavioral task
behavioral9
Sample
Surprise for playful boy.scr
Resource
win7-20231129-en
windows7-x64
21 signatures
150 seconds
Behavioral task
behavioral10
Sample
Surprise for playful boy.scr
Resource
win10v2004-20240508-en
windows10-2004-x64
21 signatures
150 seconds
General
-
Target
Ivana Sugar Dp By Surprise.scr
-
Size
353KB
-
MD5
eff52e89d1c8a06bf424aff28b223fa0
-
SHA1
0062481b5fd62fef7596f11e2f2ba03f7a16d003
-
SHA256
4d747b1bbd2ca3e220ecb10ed5dcdb082d6df4b020396dd3b0c5cdca1af66457
-
SHA512
fcc81714e286f6da7e6ef235f1264bb4a4009595031f78677ca3cd93d19e6ebb85034b271d1e9d71de3bf48ad29ed6a0247640993e1457bbc0578f54510f42c4
-
SSDEEP
6144:Ona2zAz+I6KcaPVHAuBWSbemainOQ3iAt1FGdX3/6PrawAuVvJqZz7i8qZ+Y2xrO:ONWz1AUZbht1FGdX3+O7uVvJqJi8qZjb
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,,C:\\Program Files (x86)\\Windows Mail\\irKOzVCo.exe" Ivana Sugar Dp By Surprise.scr Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,,C:\\Program Files (x86)\\Windows Mail\\irKOzVCo.exe" Ivana Sugar Dp By Surprise.scr -
Modifies firewall policy service 2 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" eUOtazbL.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" eUOtazbL.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" eUOtazbL.exe -
Modifies security service 2 TTPs 4 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" eUOtazbL.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\Start = "4" eUOtazbL.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4" eUOtazbL.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Start = "4" eUOtazbL.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" eUOtazbL.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" eUOtazbL.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" eUOtazbL.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" eUOtazbL.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" eUOtazbL.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" eUOtazbL.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" eUOtazbL.exe -
Disables Task Manager via registry modification
-
resource yara_rule behavioral7/files/0x0006000000015c93-17.dat aspack_v212_v242 -
Drops startup file 4 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ImywRDnC.exe Ivana Sugar Dp By Surprise.scr File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ImywRDnC.exe Ivana Sugar Dp By Surprise.scr File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ImywRDnC.exe eUOtazbL.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ImywRDnC.exe eUOtazbL.exe -
Executes dropped EXE 2 IoCs
pid Process 2608 eUOtazbL.exe 2696 eUOtazbL.exe -
Loads dropped DLL 2 IoCs
pid Process 2064 Ivana Sugar Dp By Surprise.scr 2608 eUOtazbL.exe -
resource yara_rule behavioral7/memory/2064-12-0x0000000000400000-0x0000000000416000-memory.dmp upx behavioral7/memory/2064-11-0x0000000000400000-0x0000000000416000-memory.dmp upx behavioral7/memory/2064-10-0x0000000000400000-0x0000000000416000-memory.dmp upx behavioral7/memory/2064-6-0x0000000000400000-0x0000000000416000-memory.dmp upx behavioral7/memory/2696-39-0x0000000000400000-0x0000000000416000-memory.dmp upx behavioral7/memory/2064-45-0x0000000000400000-0x0000000000416000-memory.dmp upx behavioral7/memory/2696-47-0x0000000000400000-0x0000000000416000-memory.dmp upx behavioral7/memory/2696-52-0x0000000000400000-0x0000000000416000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" eUOtazbL.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" eUOtazbL.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" eUOtazbL.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" eUOtazbL.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" eUOtazbL.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" eUOtazbL.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\QtvCziLH = "C:\\Users\\Admin\\AppData\\Local\\Mozilla\\QzKSWijn.exe" Ivana Sugar Dp By Surprise.scr Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\QtvCziLH = "C:\\Users\\Admin\\AppData\\Local\\Mozilla\\QzKSWijn.exe" eUOtazbL.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" eUOtazbL.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1756 set thread context of 2064 1756 Ivana Sugar Dp By Surprise.scr 28 PID 2608 set thread context of 2696 2608 eUOtazbL.exe 30 -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\Windows Mail\irKOzVCo.exe Ivana Sugar Dp By Surprise.scr File opened for modification C:\Program Files (x86)\Windows Mail\irKOzVCo.exe Ivana Sugar Dp By Surprise.scr -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2696 eUOtazbL.exe 2696 eUOtazbL.exe 2696 eUOtazbL.exe 2696 eUOtazbL.exe 2696 eUOtazbL.exe 2696 eUOtazbL.exe 2696 eUOtazbL.exe 2696 eUOtazbL.exe 2696 eUOtazbL.exe 2696 eUOtazbL.exe 2696 eUOtazbL.exe 2696 eUOtazbL.exe 2696 eUOtazbL.exe 2696 eUOtazbL.exe 2696 eUOtazbL.exe 2696 eUOtazbL.exe 2696 eUOtazbL.exe 2696 eUOtazbL.exe 2696 eUOtazbL.exe 2696 eUOtazbL.exe 2696 eUOtazbL.exe 2696 eUOtazbL.exe 2696 eUOtazbL.exe 2696 eUOtazbL.exe 2696 eUOtazbL.exe 2696 eUOtazbL.exe 2696 eUOtazbL.exe 2696 eUOtazbL.exe 2696 eUOtazbL.exe 2696 eUOtazbL.exe 2696 eUOtazbL.exe 2696 eUOtazbL.exe 2696 eUOtazbL.exe 2696 eUOtazbL.exe 2696 eUOtazbL.exe 2696 eUOtazbL.exe 2696 eUOtazbL.exe 2696 eUOtazbL.exe 2696 eUOtazbL.exe 2696 eUOtazbL.exe 2696 eUOtazbL.exe 2696 eUOtazbL.exe 2696 eUOtazbL.exe 2696 eUOtazbL.exe 2696 eUOtazbL.exe 2696 eUOtazbL.exe 2696 eUOtazbL.exe 2696 eUOtazbL.exe 2696 eUOtazbL.exe 2696 eUOtazbL.exe 2696 eUOtazbL.exe 2696 eUOtazbL.exe 2696 eUOtazbL.exe 2696 eUOtazbL.exe 2696 eUOtazbL.exe 2696 eUOtazbL.exe 2696 eUOtazbL.exe 2696 eUOtazbL.exe 2696 eUOtazbL.exe 2696 eUOtazbL.exe 2696 eUOtazbL.exe 2696 eUOtazbL.exe 2696 eUOtazbL.exe 2696 eUOtazbL.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeSecurityPrivilege 2064 Ivana Sugar Dp By Surprise.scr Token: SeDebugPrivilege 2064 Ivana Sugar Dp By Surprise.scr Token: SeTcbPrivilege 2064 Ivana Sugar Dp By Surprise.scr Token: SeSecurityPrivilege 2696 eUOtazbL.exe Token: SeDebugPrivilege 2696 eUOtazbL.exe Token: SeTcbPrivilege 2696 eUOtazbL.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 1756 wrote to memory of 2064 1756 Ivana Sugar Dp By Surprise.scr 28 PID 1756 wrote to memory of 2064 1756 Ivana Sugar Dp By Surprise.scr 28 PID 1756 wrote to memory of 2064 1756 Ivana Sugar Dp By Surprise.scr 28 PID 1756 wrote to memory of 2064 1756 Ivana Sugar Dp By Surprise.scr 28 PID 1756 wrote to memory of 2064 1756 Ivana Sugar Dp By Surprise.scr 28 PID 1756 wrote to memory of 2064 1756 Ivana Sugar Dp By Surprise.scr 28 PID 2064 wrote to memory of 2608 2064 Ivana Sugar Dp By Surprise.scr 29 PID 2064 wrote to memory of 2608 2064 Ivana Sugar Dp By Surprise.scr 29 PID 2064 wrote to memory of 2608 2064 Ivana Sugar Dp By Surprise.scr 29 PID 2064 wrote to memory of 2608 2064 Ivana Sugar Dp By Surprise.scr 29 PID 2608 wrote to memory of 2696 2608 eUOtazbL.exe 30 PID 2608 wrote to memory of 2696 2608 eUOtazbL.exe 30 PID 2608 wrote to memory of 2696 2608 eUOtazbL.exe 30 PID 2608 wrote to memory of 2696 2608 eUOtazbL.exe 30 PID 2608 wrote to memory of 2696 2608 eUOtazbL.exe 30 PID 2608 wrote to memory of 2696 2608 eUOtazbL.exe 30 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" eUOtazbL.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Ivana Sugar Dp By Surprise.scr"C:\Users\Admin\AppData\Local\Temp\Ivana Sugar Dp By Surprise.scr" /S1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\Ivana Sugar Dp By Surprise.scr"C:\Users\Admin\AppData\Local\Temp\Ivana Sugar Dp By Surprise.scr"2⤵
- Modifies WinLogon for persistence
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\eUOtazbL.exe"C:\Users\Admin\AppData\Local\Temp\eUOtazbL.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\eUOtazbL.exe"C:\Users\Admin\AppData\Local\Temp\eUOtazbL.exe"4⤵
- Modifies firewall policy service
- Modifies security service
- UAC bypass
- Windows security bypass
- Drops startup file
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:2696
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
353KB
MD5eff52e89d1c8a06bf424aff28b223fa0
SHA10062481b5fd62fef7596f11e2f2ba03f7a16d003
SHA2564d747b1bbd2ca3e220ecb10ed5dcdb082d6df4b020396dd3b0c5cdca1af66457
SHA512fcc81714e286f6da7e6ef235f1264bb4a4009595031f78677ca3cd93d19e6ebb85034b271d1e9d71de3bf48ad29ed6a0247640993e1457bbc0578f54510f42c4