Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
24/05/2024, 20:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2e08a6f3a8ee4427b25aa23c02ea5771dfe9e921163e5aa1a329f9d233379a50.exe
Resource
win7-20240221-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2e08a6f3a8ee4427b25aa23c02ea5771dfe9e921163e5aa1a329f9d233379a50.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
2e08a6f3a8ee4427b25aa23c02ea5771dfe9e921163e5aa1a329f9d233379a50.exe
-
Size
72KB
-
MD5
2c5ab7f122ce9590dda2287269504a2f
-
SHA1
d6ba77dc83408baa2b26b2481fee78a51ad8558a
-
SHA256
2e08a6f3a8ee4427b25aa23c02ea5771dfe9e921163e5aa1a329f9d233379a50
-
SHA512
3c779801c17590a56fdd5b38821b10cb44355122d2c356bc61c7cb43833e3c1f89394c8adf83740bc09edb5a790b81d39a53e972df3a5dd2e399992ec38e9b4f
-
SSDEEP
1536:xAyToPledgGkAlSt9yzkwUk6Nr5kEHIwAr:3hgRAlStYzkrJNFkEHC
Score
10/10
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" ealleabab-egix.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" ealleabab-egix.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" ealleabab-egix.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" ealleabab-egix.exe -
Modifies Installed Components in the registry 2 TTPs 4 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4B584950-5043-4b46-4B58-495050434b46}\IsInstalled = "1" ealleabab-egix.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4B584950-5043-4b46-4B58-495050434b46}\StubPath = "C:\\Windows\\system32\\ubrooveam.exe" ealleabab-egix.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4B584950-5043-4b46-4B58-495050434b46} ealleabab-egix.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4B584950-5043-4b46-4B58-495050434b46}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a" ealleabab-egix.exe -
Sets file execution options in registry 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe ealleabab-egix.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a" ealleabab-egix.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\uhkakus.exe" ealleabab-egix.exe -
Executes dropped EXE 2 IoCs
pid Process 3036 ealleabab-egix.exe 2968 ealleabab-egix.exe -
Loads dropped DLL 3 IoCs
pid Process 2216 2e08a6f3a8ee4427b25aa23c02ea5771dfe9e921163e5aa1a329f9d233379a50.exe 2216 2e08a6f3a8ee4427b25aa23c02ea5771dfe9e921163e5aa1a329f9d233379a50.exe 3036 ealleabab-egix.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" ealleabab-egix.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" ealleabab-egix.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" ealleabab-egix.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" ealleabab-egix.exe -
Modifies WinLogon 2 TTPs 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify ealleabab-egix.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a" ealleabab-egix.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\oskeakoar-avoas.dll" ealleabab-egix.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup" ealleabab-egix.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B} ealleabab-egix.exe -
Drops file in System32 directory 9 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\oskeakoar-avoas.dll ealleabab-egix.exe File opened for modification C:\Windows\SysWOW64\ealleabab-egix.exe ealleabab-egix.exe File opened for modification C:\Windows\SysWOW64\ealleabab-egix.exe 2e08a6f3a8ee4427b25aa23c02ea5771dfe9e921163e5aa1a329f9d233379a50.exe File opened for modification C:\Windows\SysWOW64\uhkakus.exe ealleabab-egix.exe File opened for modification C:\Windows\SysWOW64\ubrooveam.exe ealleabab-egix.exe File created C:\Windows\SysWOW64\ubrooveam.exe ealleabab-egix.exe File created C:\Windows\SysWOW64\ealleabab-egix.exe 2e08a6f3a8ee4427b25aa23c02ea5771dfe9e921163e5aa1a329f9d233379a50.exe File created C:\Windows\SysWOW64\uhkakus.exe ealleabab-egix.exe File created C:\Windows\SysWOW64\oskeakoar-avoas.dll ealleabab-egix.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3036 ealleabab-egix.exe 3036 ealleabab-egix.exe 3036 ealleabab-egix.exe 3036 ealleabab-egix.exe 2968 ealleabab-egix.exe 3036 ealleabab-egix.exe 3036 ealleabab-egix.exe 3036 ealleabab-egix.exe 3036 ealleabab-egix.exe 3036 ealleabab-egix.exe 3036 ealleabab-egix.exe 3036 ealleabab-egix.exe 3036 ealleabab-egix.exe 3036 ealleabab-egix.exe 3036 ealleabab-egix.exe 3036 ealleabab-egix.exe 3036 ealleabab-egix.exe 3036 ealleabab-egix.exe 3036 ealleabab-egix.exe 3036 ealleabab-egix.exe 3036 ealleabab-egix.exe 3036 ealleabab-egix.exe 3036 ealleabab-egix.exe 3036 ealleabab-egix.exe 3036 ealleabab-egix.exe 3036 ealleabab-egix.exe 3036 ealleabab-egix.exe 3036 ealleabab-egix.exe 3036 ealleabab-egix.exe 3036 ealleabab-egix.exe 3036 ealleabab-egix.exe 3036 ealleabab-egix.exe 3036 ealleabab-egix.exe 3036 ealleabab-egix.exe 3036 ealleabab-egix.exe 3036 ealleabab-egix.exe 3036 ealleabab-egix.exe 3036 ealleabab-egix.exe 3036 ealleabab-egix.exe 3036 ealleabab-egix.exe 3036 ealleabab-egix.exe 3036 ealleabab-egix.exe 3036 ealleabab-egix.exe 3036 ealleabab-egix.exe 3036 ealleabab-egix.exe 3036 ealleabab-egix.exe 3036 ealleabab-egix.exe 3036 ealleabab-egix.exe 3036 ealleabab-egix.exe 3036 ealleabab-egix.exe 3036 ealleabab-egix.exe 3036 ealleabab-egix.exe 3036 ealleabab-egix.exe 3036 ealleabab-egix.exe 3036 ealleabab-egix.exe 3036 ealleabab-egix.exe 3036 ealleabab-egix.exe 3036 ealleabab-egix.exe 3036 ealleabab-egix.exe 3036 ealleabab-egix.exe 3036 ealleabab-egix.exe 3036 ealleabab-egix.exe 3036 ealleabab-egix.exe 3036 ealleabab-egix.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3036 ealleabab-egix.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2216 wrote to memory of 3036 2216 2e08a6f3a8ee4427b25aa23c02ea5771dfe9e921163e5aa1a329f9d233379a50.exe 28 PID 2216 wrote to memory of 3036 2216 2e08a6f3a8ee4427b25aa23c02ea5771dfe9e921163e5aa1a329f9d233379a50.exe 28 PID 2216 wrote to memory of 3036 2216 2e08a6f3a8ee4427b25aa23c02ea5771dfe9e921163e5aa1a329f9d233379a50.exe 28 PID 2216 wrote to memory of 3036 2216 2e08a6f3a8ee4427b25aa23c02ea5771dfe9e921163e5aa1a329f9d233379a50.exe 28 PID 3036 wrote to memory of 420 3036 ealleabab-egix.exe 5 PID 3036 wrote to memory of 1176 3036 ealleabab-egix.exe 21 PID 3036 wrote to memory of 1176 3036 ealleabab-egix.exe 21 PID 3036 wrote to memory of 2968 3036 ealleabab-egix.exe 29 PID 3036 wrote to memory of 2968 3036 ealleabab-egix.exe 29 PID 3036 wrote to memory of 2968 3036 ealleabab-egix.exe 29 PID 3036 wrote to memory of 2968 3036 ealleabab-egix.exe 29 PID 3036 wrote to memory of 1176 3036 ealleabab-egix.exe 21 PID 3036 wrote to memory of 1176 3036 ealleabab-egix.exe 21 PID 3036 wrote to memory of 1176 3036 ealleabab-egix.exe 21 PID 3036 wrote to memory of 1176 3036 ealleabab-egix.exe 21 PID 3036 wrote to memory of 1176 3036 ealleabab-egix.exe 21 PID 3036 wrote to memory of 1176 3036 ealleabab-egix.exe 21 PID 3036 wrote to memory of 1176 3036 ealleabab-egix.exe 21 PID 3036 wrote to memory of 1176 3036 ealleabab-egix.exe 21 PID 3036 wrote to memory of 1176 3036 ealleabab-egix.exe 21 PID 3036 wrote to memory of 1176 3036 ealleabab-egix.exe 21 PID 3036 wrote to memory of 1176 3036 ealleabab-egix.exe 21 PID 3036 wrote to memory of 1176 3036 ealleabab-egix.exe 21 PID 3036 wrote to memory of 1176 3036 ealleabab-egix.exe 21 PID 3036 wrote to memory of 1176 3036 ealleabab-egix.exe 21 PID 3036 wrote to memory of 1176 3036 ealleabab-egix.exe 21 PID 3036 wrote to memory of 1176 3036 ealleabab-egix.exe 21 PID 3036 wrote to memory of 1176 3036 ealleabab-egix.exe 21 PID 3036 wrote to memory of 1176 3036 ealleabab-egix.exe 21 PID 3036 wrote to memory of 1176 3036 ealleabab-egix.exe 21 PID 3036 wrote to memory of 1176 3036 ealleabab-egix.exe 21 PID 3036 wrote to memory of 1176 3036 ealleabab-egix.exe 21 PID 3036 wrote to memory of 1176 3036 ealleabab-egix.exe 21 PID 3036 wrote to memory of 1176 3036 ealleabab-egix.exe 21 PID 3036 wrote to memory of 1176 3036 ealleabab-egix.exe 21 PID 3036 wrote to memory of 1176 3036 ealleabab-egix.exe 21 PID 3036 wrote to memory of 1176 3036 ealleabab-egix.exe 21 PID 3036 wrote to memory of 1176 3036 ealleabab-egix.exe 21 PID 3036 wrote to memory of 1176 3036 ealleabab-egix.exe 21 PID 3036 wrote to memory of 1176 3036 ealleabab-egix.exe 21 PID 3036 wrote to memory of 1176 3036 ealleabab-egix.exe 21 PID 3036 wrote to memory of 1176 3036 ealleabab-egix.exe 21 PID 3036 wrote to memory of 1176 3036 ealleabab-egix.exe 21 PID 3036 wrote to memory of 1176 3036 ealleabab-egix.exe 21 PID 3036 wrote to memory of 1176 3036 ealleabab-egix.exe 21 PID 3036 wrote to memory of 1176 3036 ealleabab-egix.exe 21 PID 3036 wrote to memory of 1176 3036 ealleabab-egix.exe 21 PID 3036 wrote to memory of 1176 3036 ealleabab-egix.exe 21 PID 3036 wrote to memory of 1176 3036 ealleabab-egix.exe 21 PID 3036 wrote to memory of 1176 3036 ealleabab-egix.exe 21 PID 3036 wrote to memory of 1176 3036 ealleabab-egix.exe 21 PID 3036 wrote to memory of 1176 3036 ealleabab-egix.exe 21 PID 3036 wrote to memory of 1176 3036 ealleabab-egix.exe 21 PID 3036 wrote to memory of 1176 3036 ealleabab-egix.exe 21 PID 3036 wrote to memory of 1176 3036 ealleabab-egix.exe 21 PID 3036 wrote to memory of 1176 3036 ealleabab-egix.exe 21 PID 3036 wrote to memory of 1176 3036 ealleabab-egix.exe 21 PID 3036 wrote to memory of 1176 3036 ealleabab-egix.exe 21 PID 3036 wrote to memory of 1176 3036 ealleabab-egix.exe 21 PID 3036 wrote to memory of 1176 3036 ealleabab-egix.exe 21 PID 3036 wrote to memory of 1176 3036 ealleabab-egix.exe 21 PID 3036 wrote to memory of 1176 3036 ealleabab-egix.exe 21 PID 3036 wrote to memory of 1176 3036 ealleabab-egix.exe 21 PID 3036 wrote to memory of 1176 3036 ealleabab-egix.exe 21
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:420
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1176
-
C:\Users\Admin\AppData\Local\Temp\2e08a6f3a8ee4427b25aa23c02ea5771dfe9e921163e5aa1a329f9d233379a50.exe"C:\Users\Admin\AppData\Local\Temp\2e08a6f3a8ee4427b25aa23c02ea5771dfe9e921163e5aa1a329f9d233379a50.exe"2⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Windows\SysWOW64\ealleabab-egix.exe"C:\Windows\SysWOW64\ealleabab-egix.exe"3⤵
- Windows security bypass
- Modifies Installed Components in the registry
- Sets file execution options in registry
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Windows\SysWOW64\ealleabab-egix.exe--k33p4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2968
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD5f37b21c00fd81bd93c89ce741a88f183
SHA1b2796500597c68e2f5638e1101b46eaf32676c1c
SHA25676cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0
SHA512252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4
-
Filesize
72KB
MD51f7dc9e2748d90b68eafacf05a5ca40d
SHA1b4b511b9f654c2c69e2f1a21ff35c960afaf17aa
SHA2566f81ceddf1ef13e0ffb23006fcd88ed226c09d93191f491e70550d407db59515
SHA512772e90710011e624b0c38ae601101bb30965b87f9063f0a978469497d257a260ad2130b2d57125e50bd876dbf1736808c90b377e28ae428ddc5a00f9261efe99
-
Filesize
73KB
MD52d18f60630dbc164081c70e7d494d431
SHA1f83109cc845fc737e71e56723a17b6ecc51856df
SHA256c5748f73f307e476db0c8e6609f633efa3da77ff7d99771fc7dcade649b57490
SHA5126821ccfea87af7426ff45672c921066925bbb33485d90ca3908aa1afcf3c7b5910142c5d790cb3d04516278bd4143a45b5d206041c0dcb59088e1c6c935f80f7
-
Filesize
70KB
MD587f47f45e3c076d02a5fb4db12247dd8
SHA19fba74a9df64ce0a61903ff51d34d38270686575
SHA2568d38b4f0aab60ad02fcfbc3ab38f5b84e2eca20270129511de7a7e635e9a831b
SHA5126e8737ef05436b3687ed3b7ae5a53d531d77d1bd8c68b81de93cf6a1938b77bf0e1de0e9f317221c9e529390d19843fb6dc958e3a4a39a961ec93beb210c39a6