Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
135s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
22/05/2024, 21:07
Behavioral task
behavioral1
Sample
4528d2a084013ebaa2c3526e3a07e77a65a0484fee2dd65227d45ead01244e5f.exe
Resource
win7-20240508-en
General
-
Target
4528d2a084013ebaa2c3526e3a07e77a65a0484fee2dd65227d45ead01244e5f.exe
-
Size
1.1MB
-
MD5
1aee717ecfeaae4a113f6d0a2e3209f1
-
SHA1
79ce52468b618b6e76aea967f1839ff7353609dc
-
SHA256
4528d2a084013ebaa2c3526e3a07e77a65a0484fee2dd65227d45ead01244e5f
-
SHA512
c61c0f9134f14cad8ce89dc441d4e465cf10134dfc3112303e46de730646a8c4c563bf853470040b3f6ed52ea7618486e5e9ce789a40463c3ed0ada0483e672b
-
SSDEEP
24576:zQ5aILMCfmAUjzX6xQGCZLFdGm1StE10/Zc9gger:E5aIwC+Agr6S/FFC+I
Malware Config
Signatures
-
KPOT Core Executable 1 IoCs
resource yara_rule behavioral1/files/0x0008000000016d2c-20.dat family_kpot -
Trickbot x86 loader 1 IoCs
Detected Trickbot's x86 loader that unpacks the x86 payload.
resource yara_rule behavioral1/memory/3056-15-0x0000000000350000-0x0000000000379000-memory.dmp trickbot_loader32 -
Executes dropped EXE 3 IoCs
pid Process 2284 4629d2a094013ebaa2c3627e3a08e88a76a0494fee2dd76228d46ead01244e6f.exe 2620 4629d2a094013ebaa2c3627e3a08e88a76a0494fee2dd76228d46ead01244e6f.exe 1104 4629d2a094013ebaa2c3627e3a08e88a76a0494fee2dd76228d46ead01244e6f.exe -
Loads dropped DLL 2 IoCs
pid Process 3056 4528d2a084013ebaa2c3526e3a07e77a65a0484fee2dd65227d45ead01244e5f.exe 3056 4528d2a084013ebaa2c3526e3a07e77a65a0484fee2dd65227d45ead01244e5f.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2788 sc.exe 2796 sc.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3056 4528d2a084013ebaa2c3526e3a07e77a65a0484fee2dd65227d45ead01244e5f.exe 3056 4528d2a084013ebaa2c3526e3a07e77a65a0484fee2dd65227d45ead01244e5f.exe 3056 4528d2a084013ebaa2c3526e3a07e77a65a0484fee2dd65227d45ead01244e5f.exe 2904 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2904 powershell.exe Token: SeTcbPrivilege 2620 4629d2a094013ebaa2c3627e3a08e88a76a0494fee2dd76228d46ead01244e6f.exe Token: SeTcbPrivilege 1104 4629d2a094013ebaa2c3627e3a08e88a76a0494fee2dd76228d46ead01244e6f.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 3056 4528d2a084013ebaa2c3526e3a07e77a65a0484fee2dd65227d45ead01244e5f.exe 2284 4629d2a094013ebaa2c3627e3a08e88a76a0494fee2dd76228d46ead01244e6f.exe 2620 4629d2a094013ebaa2c3627e3a08e88a76a0494fee2dd76228d46ead01244e6f.exe 1104 4629d2a094013ebaa2c3627e3a08e88a76a0494fee2dd76228d46ead01244e6f.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3056 wrote to memory of 2360 3056 4528d2a084013ebaa2c3526e3a07e77a65a0484fee2dd65227d45ead01244e5f.exe 28 PID 3056 wrote to memory of 2360 3056 4528d2a084013ebaa2c3526e3a07e77a65a0484fee2dd65227d45ead01244e5f.exe 28 PID 3056 wrote to memory of 2360 3056 4528d2a084013ebaa2c3526e3a07e77a65a0484fee2dd65227d45ead01244e5f.exe 28 PID 3056 wrote to memory of 2360 3056 4528d2a084013ebaa2c3526e3a07e77a65a0484fee2dd65227d45ead01244e5f.exe 28 PID 3056 wrote to memory of 3040 3056 4528d2a084013ebaa2c3526e3a07e77a65a0484fee2dd65227d45ead01244e5f.exe 29 PID 3056 wrote to memory of 3040 3056 4528d2a084013ebaa2c3526e3a07e77a65a0484fee2dd65227d45ead01244e5f.exe 29 PID 3056 wrote to memory of 3040 3056 4528d2a084013ebaa2c3526e3a07e77a65a0484fee2dd65227d45ead01244e5f.exe 29 PID 3056 wrote to memory of 3040 3056 4528d2a084013ebaa2c3526e3a07e77a65a0484fee2dd65227d45ead01244e5f.exe 29 PID 3056 wrote to memory of 2848 3056 4528d2a084013ebaa2c3526e3a07e77a65a0484fee2dd65227d45ead01244e5f.exe 31 PID 3056 wrote to memory of 2848 3056 4528d2a084013ebaa2c3526e3a07e77a65a0484fee2dd65227d45ead01244e5f.exe 31 PID 3056 wrote to memory of 2848 3056 4528d2a084013ebaa2c3526e3a07e77a65a0484fee2dd65227d45ead01244e5f.exe 31 PID 3056 wrote to memory of 2848 3056 4528d2a084013ebaa2c3526e3a07e77a65a0484fee2dd65227d45ead01244e5f.exe 31 PID 3056 wrote to memory of 2284 3056 4528d2a084013ebaa2c3526e3a07e77a65a0484fee2dd65227d45ead01244e5f.exe 34 PID 3056 wrote to memory of 2284 3056 4528d2a084013ebaa2c3526e3a07e77a65a0484fee2dd65227d45ead01244e5f.exe 34 PID 3056 wrote to memory of 2284 3056 4528d2a084013ebaa2c3526e3a07e77a65a0484fee2dd65227d45ead01244e5f.exe 34 PID 3056 wrote to memory of 2284 3056 4528d2a084013ebaa2c3526e3a07e77a65a0484fee2dd65227d45ead01244e5f.exe 34 PID 2360 wrote to memory of 2788 2360 cmd.exe 35 PID 2360 wrote to memory of 2788 2360 cmd.exe 35 PID 2360 wrote to memory of 2788 2360 cmd.exe 35 PID 2360 wrote to memory of 2788 2360 cmd.exe 35 PID 3040 wrote to memory of 2796 3040 cmd.exe 36 PID 3040 wrote to memory of 2796 3040 cmd.exe 36 PID 3040 wrote to memory of 2796 3040 cmd.exe 36 PID 3040 wrote to memory of 2796 3040 cmd.exe 36 PID 2848 wrote to memory of 2904 2848 cmd.exe 37 PID 2848 wrote to memory of 2904 2848 cmd.exe 37 PID 2848 wrote to memory of 2904 2848 cmd.exe 37 PID 2848 wrote to memory of 2904 2848 cmd.exe 37 PID 2284 wrote to memory of 2700 2284 4629d2a094013ebaa2c3627e3a08e88a76a0494fee2dd76228d46ead01244e6f.exe 38 PID 2284 wrote to memory of 2700 2284 4629d2a094013ebaa2c3627e3a08e88a76a0494fee2dd76228d46ead01244e6f.exe 38 PID 2284 wrote to memory of 2700 2284 4629d2a094013ebaa2c3627e3a08e88a76a0494fee2dd76228d46ead01244e6f.exe 38 PID 2284 wrote to memory of 2700 2284 4629d2a094013ebaa2c3627e3a08e88a76a0494fee2dd76228d46ead01244e6f.exe 38 PID 2284 wrote to memory of 2700 2284 4629d2a094013ebaa2c3627e3a08e88a76a0494fee2dd76228d46ead01244e6f.exe 38 PID 2284 wrote to memory of 2700 2284 4629d2a094013ebaa2c3627e3a08e88a76a0494fee2dd76228d46ead01244e6f.exe 38 PID 2284 wrote to memory of 2700 2284 4629d2a094013ebaa2c3627e3a08e88a76a0494fee2dd76228d46ead01244e6f.exe 38 PID 2284 wrote to memory of 2700 2284 4629d2a094013ebaa2c3627e3a08e88a76a0494fee2dd76228d46ead01244e6f.exe 38 PID 2284 wrote to memory of 2700 2284 4629d2a094013ebaa2c3627e3a08e88a76a0494fee2dd76228d46ead01244e6f.exe 38 PID 2284 wrote to memory of 2700 2284 4629d2a094013ebaa2c3627e3a08e88a76a0494fee2dd76228d46ead01244e6f.exe 38 PID 2284 wrote to memory of 2700 2284 4629d2a094013ebaa2c3627e3a08e88a76a0494fee2dd76228d46ead01244e6f.exe 38 PID 2284 wrote to memory of 2700 2284 4629d2a094013ebaa2c3627e3a08e88a76a0494fee2dd76228d46ead01244e6f.exe 38 PID 2284 wrote to memory of 2700 2284 4629d2a094013ebaa2c3627e3a08e88a76a0494fee2dd76228d46ead01244e6f.exe 38 PID 2284 wrote to memory of 2700 2284 4629d2a094013ebaa2c3627e3a08e88a76a0494fee2dd76228d46ead01244e6f.exe 38 PID 2284 wrote to memory of 2700 2284 4629d2a094013ebaa2c3627e3a08e88a76a0494fee2dd76228d46ead01244e6f.exe 38 PID 2284 wrote to memory of 2700 2284 4629d2a094013ebaa2c3627e3a08e88a76a0494fee2dd76228d46ead01244e6f.exe 38 PID 2284 wrote to memory of 2700 2284 4629d2a094013ebaa2c3627e3a08e88a76a0494fee2dd76228d46ead01244e6f.exe 38 PID 2284 wrote to memory of 2700 2284 4629d2a094013ebaa2c3627e3a08e88a76a0494fee2dd76228d46ead01244e6f.exe 38 PID 2284 wrote to memory of 2700 2284 4629d2a094013ebaa2c3627e3a08e88a76a0494fee2dd76228d46ead01244e6f.exe 38 PID 2284 wrote to memory of 2700 2284 4629d2a094013ebaa2c3627e3a08e88a76a0494fee2dd76228d46ead01244e6f.exe 38 PID 2284 wrote to memory of 2700 2284 4629d2a094013ebaa2c3627e3a08e88a76a0494fee2dd76228d46ead01244e6f.exe 38 PID 2284 wrote to memory of 2700 2284 4629d2a094013ebaa2c3627e3a08e88a76a0494fee2dd76228d46ead01244e6f.exe 38 PID 2284 wrote to memory of 2700 2284 4629d2a094013ebaa2c3627e3a08e88a76a0494fee2dd76228d46ead01244e6f.exe 38 PID 2284 wrote to memory of 2700 2284 4629d2a094013ebaa2c3627e3a08e88a76a0494fee2dd76228d46ead01244e6f.exe 38 PID 2284 wrote to memory of 2700 2284 4629d2a094013ebaa2c3627e3a08e88a76a0494fee2dd76228d46ead01244e6f.exe 38 PID 2284 wrote to memory of 2700 2284 4629d2a094013ebaa2c3627e3a08e88a76a0494fee2dd76228d46ead01244e6f.exe 38 PID 2284 wrote to memory of 2700 2284 4629d2a094013ebaa2c3627e3a08e88a76a0494fee2dd76228d46ead01244e6f.exe 38 PID 2284 wrote to memory of 2700 2284 4629d2a094013ebaa2c3627e3a08e88a76a0494fee2dd76228d46ead01244e6f.exe 38 PID 1500 wrote to memory of 2620 1500 taskeng.exe 42 PID 1500 wrote to memory of 2620 1500 taskeng.exe 42 PID 1500 wrote to memory of 2620 1500 taskeng.exe 42 PID 1500 wrote to memory of 2620 1500 taskeng.exe 42 PID 2620 wrote to memory of 776 2620 4629d2a094013ebaa2c3627e3a08e88a76a0494fee2dd76228d46ead01244e6f.exe 43 PID 2620 wrote to memory of 776 2620 4629d2a094013ebaa2c3627e3a08e88a76a0494fee2dd76228d46ead01244e6f.exe 43 PID 2620 wrote to memory of 776 2620 4629d2a094013ebaa2c3627e3a08e88a76a0494fee2dd76228d46ead01244e6f.exe 43 PID 2620 wrote to memory of 776 2620 4629d2a094013ebaa2c3627e3a08e88a76a0494fee2dd76228d46ead01244e6f.exe 43 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\4528d2a084013ebaa2c3526e3a07e77a65a0484fee2dd65227d45ead01244e5f.exe"C:\Users\Admin\AppData\Local\Temp\4528d2a084013ebaa2c3526e3a07e77a65a0484fee2dd65227d45ead01244e5f.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Windows\SysWOW64\cmd.exe/c sc stop WinDefend2⤵
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Windows\SysWOW64\sc.exesc stop WinDefend3⤵
- Launches sc.exe
PID:2788
-
-
-
C:\Windows\SysWOW64\cmd.exe/c sc delete WinDefend2⤵
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Windows\SysWOW64\sc.exesc delete WinDefend3⤵
- Launches sc.exe
PID:2796
-
-
-
C:\Windows\SysWOW64\cmd.exe/c powershell Set-MpPreference -DisableRealtimeMonitoring $true2⤵
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableRealtimeMonitoring $true3⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2904
-
-
-
C:\Users\Admin\AppData\Roaming\WinSocket\4629d2a094013ebaa2c3627e3a08e88a76a0494fee2dd76228d46ead01244e6f.exeC:\Users\Admin\AppData\Roaming\WinSocket\4629d2a094013ebaa2c3627e3a08e88a76a0494fee2dd76228d46ead01244e6f.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵PID:2700
-
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {580F1564-D8F5-4957-9515-8EC03CA4DD8E} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Users\Admin\AppData\Roaming\WinSocket\4629d2a094013ebaa2c3627e3a08e88a76a0494fee2dd76228d46ead01244e6f.exeC:\Users\Admin\AppData\Roaming\WinSocket\4629d2a094013ebaa2c3627e3a08e88a76a0494fee2dd76228d46ead01244e6f.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵PID:776
-
-
-
C:\Users\Admin\AppData\Roaming\WinSocket\4629d2a094013ebaa2c3627e3a08e88a76a0494fee2dd76228d46ead01244e6f.exeC:\Users\Admin\AppData\Roaming\WinSocket\4629d2a094013ebaa2c3627e3a08e88a76a0494fee2dd76228d46ead01244e6f.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1104 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵PID:1348
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Roaming\WinSocket\4629d2a094013ebaa2c3627e3a08e88a76a0494fee2dd76228d46ead01244e6f.exe
Filesize1.1MB
MD51aee717ecfeaae4a113f6d0a2e3209f1
SHA179ce52468b618b6e76aea967f1839ff7353609dc
SHA2564528d2a084013ebaa2c3526e3a07e77a65a0484fee2dd65227d45ead01244e5f
SHA512c61c0f9134f14cad8ce89dc441d4e465cf10134dfc3112303e46de730646a8c4c563bf853470040b3f6ed52ea7618486e5e9ce789a40463c3ed0ada0483e672b