Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
21/05/2024, 23:15
Static task
static1
Behavioral task
behavioral1
Sample
5a3be66ef3388c282c62f690d770e08eee5ae4dd5c4d92178c4ef98553c00fea.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
5a3be66ef3388c282c62f690d770e08eee5ae4dd5c4d92178c4ef98553c00fea.exe
Resource
win10v2004-20240508-en
General
-
Target
5a3be66ef3388c282c62f690d770e08eee5ae4dd5c4d92178c4ef98553c00fea.exe
-
Size
211KB
-
MD5
6b2e5a2bf4036c3ffa44573cf402952f
-
SHA1
324211705a5167abab90d39b2eca7279836891d9
-
SHA256
5a3be66ef3388c282c62f690d770e08eee5ae4dd5c4d92178c4ef98553c00fea
-
SHA512
2be1d9e476496b37033fc5840f5bba3900f9f7da6e476c6291806dc26d0b635141b95d2764f30f1732043cf3a4fbedace945b3c8a87fb4c70f36aee032fa3e70
-
SSDEEP
3072:dDEPeJlYW1ea8HKHSRUN3jjXs9Y+MiMVB/w68PEAjAfIrAvGPZz6sPJBIiFe/Gcu:dSAl1IK1aY+MiMVBSeI
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\userinit.exe" userinit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\userinit.exe" swchost.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" swchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" userinit.exe -
Modifies Installed Components in the registry 2 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Local\\mrsys.exe MR" swchost.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} swchost.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} userinit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Local\\mrsys.exe MR" userinit.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} swchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Local\\mrsys.exe MR" swchost.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} swchost.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} swchost.exe -
Executes dropped EXE 4 IoCs
pid Process 3592 userinit.exe 2536 spoolsw.exe 4884 swchost.exe 2180 spoolsw.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Swchost = "c:\\windows\\swchost.exe RO" swchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\userinit = "c:\\windows\\userinit.exe RO" userinit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Swchost = "c:\\windows\\swchost.exe RO" userinit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\userinit = "c:\\windows\\userinit.exe RO" swchost.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\udsys.exe userinit.exe -
Drops file in Windows directory 5 IoCs
description ioc Process File opened for modification \??\c:\windows\swchost.exe swchost.exe File opened for modification \??\c:\windows\userinit.exe 5a3be66ef3388c282c62f690d770e08eee5ae4dd5c4d92178c4ef98553c00fea.exe File opened for modification \??\c:\windows\spoolsw.exe userinit.exe File opened for modification \??\c:\windows\swchost.exe spoolsw.exe File opened for modification \??\c:\windows\userinit.exe userinit.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4116 5a3be66ef3388c282c62f690d770e08eee5ae4dd5c4d92178c4ef98553c00fea.exe 4116 5a3be66ef3388c282c62f690d770e08eee5ae4dd5c4d92178c4ef98553c00fea.exe 3592 userinit.exe 3592 userinit.exe 3592 userinit.exe 3592 userinit.exe 3592 userinit.exe 3592 userinit.exe 4884 swchost.exe 4884 swchost.exe 4884 swchost.exe 4884 swchost.exe 3592 userinit.exe 3592 userinit.exe 4884 swchost.exe 4884 swchost.exe 3592 userinit.exe 3592 userinit.exe 4884 swchost.exe 4884 swchost.exe 3592 userinit.exe 3592 userinit.exe 4884 swchost.exe 4884 swchost.exe 3592 userinit.exe 3592 userinit.exe 4884 swchost.exe 4884 swchost.exe 3592 userinit.exe 3592 userinit.exe 4884 swchost.exe 4884 swchost.exe 3592 userinit.exe 3592 userinit.exe 4884 swchost.exe 4884 swchost.exe 3592 userinit.exe 3592 userinit.exe 4884 swchost.exe 4884 swchost.exe 3592 userinit.exe 3592 userinit.exe 4884 swchost.exe 4884 swchost.exe 3592 userinit.exe 3592 userinit.exe 4884 swchost.exe 4884 swchost.exe 3592 userinit.exe 3592 userinit.exe 4884 swchost.exe 4884 swchost.exe 3592 userinit.exe 3592 userinit.exe 4884 swchost.exe 4884 swchost.exe 3592 userinit.exe 3592 userinit.exe 4884 swchost.exe 4884 swchost.exe 3592 userinit.exe 3592 userinit.exe 4884 swchost.exe 4884 swchost.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 3592 userinit.exe 4884 swchost.exe -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 4116 5a3be66ef3388c282c62f690d770e08eee5ae4dd5c4d92178c4ef98553c00fea.exe 4116 5a3be66ef3388c282c62f690d770e08eee5ae4dd5c4d92178c4ef98553c00fea.exe 3592 userinit.exe 3592 userinit.exe 2536 spoolsw.exe 2536 spoolsw.exe 4884 swchost.exe 4884 swchost.exe 2180 spoolsw.exe 2180 spoolsw.exe 3592 userinit.exe 3592 userinit.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 4116 wrote to memory of 3592 4116 5a3be66ef3388c282c62f690d770e08eee5ae4dd5c4d92178c4ef98553c00fea.exe 83 PID 4116 wrote to memory of 3592 4116 5a3be66ef3388c282c62f690d770e08eee5ae4dd5c4d92178c4ef98553c00fea.exe 83 PID 4116 wrote to memory of 3592 4116 5a3be66ef3388c282c62f690d770e08eee5ae4dd5c4d92178c4ef98553c00fea.exe 83 PID 3592 wrote to memory of 2536 3592 userinit.exe 84 PID 3592 wrote to memory of 2536 3592 userinit.exe 84 PID 3592 wrote to memory of 2536 3592 userinit.exe 84 PID 2536 wrote to memory of 4884 2536 spoolsw.exe 85 PID 2536 wrote to memory of 4884 2536 spoolsw.exe 85 PID 2536 wrote to memory of 4884 2536 spoolsw.exe 85 PID 4884 wrote to memory of 2180 4884 swchost.exe 87 PID 4884 wrote to memory of 2180 4884 swchost.exe 87 PID 4884 wrote to memory of 2180 4884 swchost.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\5a3be66ef3388c282c62f690d770e08eee5ae4dd5c4d92178c4ef98553c00fea.exe"C:\Users\Admin\AppData\Local\Temp\5a3be66ef3388c282c62f690d770e08eee5ae4dd5c4d92178c4ef98553c00fea.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4116 -
\??\c:\windows\userinit.exec:\windows\userinit.exe2⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3592 -
\??\c:\windows\spoolsw.exec:\windows\spoolsw.exe SE3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\windows\swchost.exec:\windows\swchost.exe4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4884 -
\??\c:\windows\spoolsw.exec:\windows\spoolsw.exe PR5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2180
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
211KB
MD539f8424cf70d4ebd6a762c5b8d3dc3e8
SHA14065c6f2a1d11f016d458e325a65ae7e8ef87f34
SHA2565fd29aaf0ff5fa5c7d4435d1a7748d0a050d7b36221f39eb8482f051c75a8c84
SHA5122d220f088dcbfc289601f057b02a4db66fb2f143be4d6a22e7b85dd4518970d8d23c1b7c43da35f8986c9a96e8237f36c743b81b0ae7aa42933cd0c4bd0415e1
-
Filesize
211KB
MD5dd8dc3f1bfa0880585eb19b7f0465b89
SHA18a44ed2023108740f121925b47d4c4a2de297cd3
SHA25668eedf6936287c916d7f356c1f9aa53a71765f8cd4ec680b38f617a08f42350c
SHA5126d75aa0f4cc27bda80c9c31e8c2276eb92adfa0f54530c42e9820b81fb03fd0bde363c90d3624971009e2528d56446bb7eabd32bc00e024d10194b690c7d689a
-
Filesize
211KB
MD56707274dc630dbf572c3e7a47b0b26e0
SHA16bd21584f323ea7ddbe3c6197101e91d47a03d7e
SHA256b5291776b04d2dff0a07f97e95793fd29ae9b6c5272e42f94685f80f77503885
SHA5126efcde68ce88fcbfe0262c10bbf328f7903c9c6cf7b2055d2aae4e6a7cd402c9aa09fb2509efc5caf1ddd3d223bce9a54d91d1da3b6dec6f6e3f8ac906d6c61b
-
Filesize
211KB
MD5526e33de2a2d7f0e5c001880c377b7de
SHA19963ea2cd1aecf25b484abcc2c83ccbc586dac29
SHA2566260c150b5a9a586388c00328f24162227c6f25f2a92e01f831c8048c59d9abe
SHA512f93031040f0483479d7b9fbb322417235721eccfd053102cb4fa78d2dfc4e097f002028a6f8173b89380a5d7c515fa813c568013a2747cbc69a00f443cc562a6