Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
135s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
25/05/2024, 00:01
Behavioral task
behavioral1
Sample
83e83607db8353b1fbaca2e1b2bc75b88d92514b9919f9175aa22757795dd874.exe
Resource
win7-20240508-en
General
-
Target
83e83607db8353b1fbaca2e1b2bc75b88d92514b9919f9175aa22757795dd874.exe
-
Size
1.2MB
-
MD5
0c0f676f6c3bcd61937ea706a89a3272
-
SHA1
e2cf3f0092ae306d5d1e68660a64980cd49ef7af
-
SHA256
83e83607db8353b1fbaca2e1b2bc75b88d92514b9919f9175aa22757795dd874
-
SHA512
ae701c36c6b8860ac85300d47a5738c59398bd169f1b2aee7c93b493f52fd10efe43eea4cc5a9f7781f0762d8b9ccf18def3c66bbde35037c061927caa034441
-
SSDEEP
24576:zQ5aILMCfmAUjzX6xQt+4En+bcMAOxA5zYlo1c51WnSx:E5aIwC+Agr6StVEnmcKxY/O1B
Malware Config
Signatures
-
KPOT Core Executable 1 IoCs
resource yara_rule behavioral1/files/0x0008000000014b9e-20.dat family_kpot -
Trickbot x86 loader 1 IoCs
Detected Trickbot's x86 loader that unpacks the x86 payload.
resource yara_rule behavioral1/memory/836-15-0x0000000000350000-0x0000000000379000-memory.dmp trickbot_loader32 -
Executes dropped EXE 3 IoCs
pid Process 2744 93e93708db9363b1fbaca2e1b2bc86b99d92614b9919f9186aa22868896dd984.exe 2408 93e93708db9363b1fbaca2e1b2bc86b99d92614b9919f9186aa22868896dd984.exe 2332 93e93708db9363b1fbaca2e1b2bc86b99d92614b9919f9186aa22868896dd984.exe -
Loads dropped DLL 2 IoCs
pid Process 836 83e83607db8353b1fbaca2e1b2bc75b88d92514b9919f9175aa22757795dd874.exe 836 83e83607db8353b1fbaca2e1b2bc75b88d92514b9919f9175aa22757795dd874.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2664 sc.exe 2640 sc.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 836 83e83607db8353b1fbaca2e1b2bc75b88d92514b9919f9175aa22757795dd874.exe 836 83e83607db8353b1fbaca2e1b2bc75b88d92514b9919f9175aa22757795dd874.exe 836 83e83607db8353b1fbaca2e1b2bc75b88d92514b9919f9175aa22757795dd874.exe 2892 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2892 powershell.exe Token: SeTcbPrivilege 2408 93e93708db9363b1fbaca2e1b2bc86b99d92614b9919f9186aa22868896dd984.exe Token: SeTcbPrivilege 2332 93e93708db9363b1fbaca2e1b2bc86b99d92614b9919f9186aa22868896dd984.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 836 83e83607db8353b1fbaca2e1b2bc75b88d92514b9919f9175aa22757795dd874.exe 2744 93e93708db9363b1fbaca2e1b2bc86b99d92614b9919f9186aa22868896dd984.exe 2408 93e93708db9363b1fbaca2e1b2bc86b99d92614b9919f9186aa22868896dd984.exe 2332 93e93708db9363b1fbaca2e1b2bc86b99d92614b9919f9186aa22868896dd984.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 836 wrote to memory of 3036 836 83e83607db8353b1fbaca2e1b2bc75b88d92514b9919f9175aa22757795dd874.exe 28 PID 836 wrote to memory of 3036 836 83e83607db8353b1fbaca2e1b2bc75b88d92514b9919f9175aa22757795dd874.exe 28 PID 836 wrote to memory of 3036 836 83e83607db8353b1fbaca2e1b2bc75b88d92514b9919f9175aa22757795dd874.exe 28 PID 836 wrote to memory of 3036 836 83e83607db8353b1fbaca2e1b2bc75b88d92514b9919f9175aa22757795dd874.exe 28 PID 836 wrote to memory of 2796 836 83e83607db8353b1fbaca2e1b2bc75b88d92514b9919f9175aa22757795dd874.exe 29 PID 836 wrote to memory of 2796 836 83e83607db8353b1fbaca2e1b2bc75b88d92514b9919f9175aa22757795dd874.exe 29 PID 836 wrote to memory of 2796 836 83e83607db8353b1fbaca2e1b2bc75b88d92514b9919f9175aa22757795dd874.exe 29 PID 836 wrote to memory of 2796 836 83e83607db8353b1fbaca2e1b2bc75b88d92514b9919f9175aa22757795dd874.exe 29 PID 836 wrote to memory of 2604 836 83e83607db8353b1fbaca2e1b2bc75b88d92514b9919f9175aa22757795dd874.exe 31 PID 836 wrote to memory of 2604 836 83e83607db8353b1fbaca2e1b2bc75b88d92514b9919f9175aa22757795dd874.exe 31 PID 836 wrote to memory of 2604 836 83e83607db8353b1fbaca2e1b2bc75b88d92514b9919f9175aa22757795dd874.exe 31 PID 836 wrote to memory of 2604 836 83e83607db8353b1fbaca2e1b2bc75b88d92514b9919f9175aa22757795dd874.exe 31 PID 836 wrote to memory of 2744 836 83e83607db8353b1fbaca2e1b2bc75b88d92514b9919f9175aa22757795dd874.exe 34 PID 836 wrote to memory of 2744 836 83e83607db8353b1fbaca2e1b2bc75b88d92514b9919f9175aa22757795dd874.exe 34 PID 836 wrote to memory of 2744 836 83e83607db8353b1fbaca2e1b2bc75b88d92514b9919f9175aa22757795dd874.exe 34 PID 836 wrote to memory of 2744 836 83e83607db8353b1fbaca2e1b2bc75b88d92514b9919f9175aa22757795dd874.exe 34 PID 3036 wrote to memory of 2664 3036 cmd.exe 35 PID 3036 wrote to memory of 2664 3036 cmd.exe 35 PID 3036 wrote to memory of 2664 3036 cmd.exe 35 PID 3036 wrote to memory of 2664 3036 cmd.exe 35 PID 2796 wrote to memory of 2640 2796 cmd.exe 36 PID 2796 wrote to memory of 2640 2796 cmd.exe 36 PID 2796 wrote to memory of 2640 2796 cmd.exe 36 PID 2796 wrote to memory of 2640 2796 cmd.exe 36 PID 2604 wrote to memory of 2892 2604 cmd.exe 37 PID 2604 wrote to memory of 2892 2604 cmd.exe 37 PID 2604 wrote to memory of 2892 2604 cmd.exe 37 PID 2604 wrote to memory of 2892 2604 cmd.exe 37 PID 2744 wrote to memory of 2704 2744 93e93708db9363b1fbaca2e1b2bc86b99d92614b9919f9186aa22868896dd984.exe 38 PID 2744 wrote to memory of 2704 2744 93e93708db9363b1fbaca2e1b2bc86b99d92614b9919f9186aa22868896dd984.exe 38 PID 2744 wrote to memory of 2704 2744 93e93708db9363b1fbaca2e1b2bc86b99d92614b9919f9186aa22868896dd984.exe 38 PID 2744 wrote to memory of 2704 2744 93e93708db9363b1fbaca2e1b2bc86b99d92614b9919f9186aa22868896dd984.exe 38 PID 2744 wrote to memory of 2704 2744 93e93708db9363b1fbaca2e1b2bc86b99d92614b9919f9186aa22868896dd984.exe 38 PID 2744 wrote to memory of 2704 2744 93e93708db9363b1fbaca2e1b2bc86b99d92614b9919f9186aa22868896dd984.exe 38 PID 2744 wrote to memory of 2704 2744 93e93708db9363b1fbaca2e1b2bc86b99d92614b9919f9186aa22868896dd984.exe 38 PID 2744 wrote to memory of 2704 2744 93e93708db9363b1fbaca2e1b2bc86b99d92614b9919f9186aa22868896dd984.exe 38 PID 2744 wrote to memory of 2704 2744 93e93708db9363b1fbaca2e1b2bc86b99d92614b9919f9186aa22868896dd984.exe 38 PID 2744 wrote to memory of 2704 2744 93e93708db9363b1fbaca2e1b2bc86b99d92614b9919f9186aa22868896dd984.exe 38 PID 2744 wrote to memory of 2704 2744 93e93708db9363b1fbaca2e1b2bc86b99d92614b9919f9186aa22868896dd984.exe 38 PID 2744 wrote to memory of 2704 2744 93e93708db9363b1fbaca2e1b2bc86b99d92614b9919f9186aa22868896dd984.exe 38 PID 2744 wrote to memory of 2704 2744 93e93708db9363b1fbaca2e1b2bc86b99d92614b9919f9186aa22868896dd984.exe 38 PID 2744 wrote to memory of 2704 2744 93e93708db9363b1fbaca2e1b2bc86b99d92614b9919f9186aa22868896dd984.exe 38 PID 2744 wrote to memory of 2704 2744 93e93708db9363b1fbaca2e1b2bc86b99d92614b9919f9186aa22868896dd984.exe 38 PID 2744 wrote to memory of 2704 2744 93e93708db9363b1fbaca2e1b2bc86b99d92614b9919f9186aa22868896dd984.exe 38 PID 2744 wrote to memory of 2704 2744 93e93708db9363b1fbaca2e1b2bc86b99d92614b9919f9186aa22868896dd984.exe 38 PID 2744 wrote to memory of 2704 2744 93e93708db9363b1fbaca2e1b2bc86b99d92614b9919f9186aa22868896dd984.exe 38 PID 2744 wrote to memory of 2704 2744 93e93708db9363b1fbaca2e1b2bc86b99d92614b9919f9186aa22868896dd984.exe 38 PID 2744 wrote to memory of 2704 2744 93e93708db9363b1fbaca2e1b2bc86b99d92614b9919f9186aa22868896dd984.exe 38 PID 2744 wrote to memory of 2704 2744 93e93708db9363b1fbaca2e1b2bc86b99d92614b9919f9186aa22868896dd984.exe 38 PID 2744 wrote to memory of 2704 2744 93e93708db9363b1fbaca2e1b2bc86b99d92614b9919f9186aa22868896dd984.exe 38 PID 2744 wrote to memory of 2704 2744 93e93708db9363b1fbaca2e1b2bc86b99d92614b9919f9186aa22868896dd984.exe 38 PID 2744 wrote to memory of 2704 2744 93e93708db9363b1fbaca2e1b2bc86b99d92614b9919f9186aa22868896dd984.exe 38 PID 2744 wrote to memory of 2704 2744 93e93708db9363b1fbaca2e1b2bc86b99d92614b9919f9186aa22868896dd984.exe 38 PID 2744 wrote to memory of 2704 2744 93e93708db9363b1fbaca2e1b2bc86b99d92614b9919f9186aa22868896dd984.exe 38 PID 2744 wrote to memory of 2704 2744 93e93708db9363b1fbaca2e1b2bc86b99d92614b9919f9186aa22868896dd984.exe 38 PID 2744 wrote to memory of 2704 2744 93e93708db9363b1fbaca2e1b2bc86b99d92614b9919f9186aa22868896dd984.exe 38 PID 2488 wrote to memory of 2408 2488 taskeng.exe 42 PID 2488 wrote to memory of 2408 2488 taskeng.exe 42 PID 2488 wrote to memory of 2408 2488 taskeng.exe 42 PID 2488 wrote to memory of 2408 2488 taskeng.exe 42 PID 2408 wrote to memory of 2340 2408 93e93708db9363b1fbaca2e1b2bc86b99d92614b9919f9186aa22868896dd984.exe 43 PID 2408 wrote to memory of 2340 2408 93e93708db9363b1fbaca2e1b2bc86b99d92614b9919f9186aa22868896dd984.exe 43 PID 2408 wrote to memory of 2340 2408 93e93708db9363b1fbaca2e1b2bc86b99d92614b9919f9186aa22868896dd984.exe 43 PID 2408 wrote to memory of 2340 2408 93e93708db9363b1fbaca2e1b2bc86b99d92614b9919f9186aa22868896dd984.exe 43 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\83e83607db8353b1fbaca2e1b2bc75b88d92514b9919f9175aa22757795dd874.exe"C:\Users\Admin\AppData\Local\Temp\83e83607db8353b1fbaca2e1b2bc75b88d92514b9919f9175aa22757795dd874.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:836 -
C:\Windows\SysWOW64\cmd.exe/c sc stop WinDefend2⤵
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Windows\SysWOW64\sc.exesc stop WinDefend3⤵
- Launches sc.exe
PID:2664
-
-
-
C:\Windows\SysWOW64\cmd.exe/c sc delete WinDefend2⤵
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Windows\SysWOW64\sc.exesc delete WinDefend3⤵
- Launches sc.exe
PID:2640
-
-
-
C:\Windows\SysWOW64\cmd.exe/c powershell Set-MpPreference -DisableRealtimeMonitoring $true2⤵
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableRealtimeMonitoring $true3⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2892
-
-
-
C:\Users\Admin\AppData\Roaming\WinSocket\93e93708db9363b1fbaca2e1b2bc86b99d92614b9919f9186aa22868896dd984.exeC:\Users\Admin\AppData\Roaming\WinSocket\93e93708db9363b1fbaca2e1b2bc86b99d92614b9919f9186aa22868896dd984.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵PID:2704
-
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {5FBB954B-E07E-42B3-B92F-4665D1869A95} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Users\Admin\AppData\Roaming\WinSocket\93e93708db9363b1fbaca2e1b2bc86b99d92614b9919f9186aa22868896dd984.exeC:\Users\Admin\AppData\Roaming\WinSocket\93e93708db9363b1fbaca2e1b2bc86b99d92614b9919f9186aa22868896dd984.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵PID:2340
-
-
-
C:\Users\Admin\AppData\Roaming\WinSocket\93e93708db9363b1fbaca2e1b2bc86b99d92614b9919f9186aa22868896dd984.exeC:\Users\Admin\AppData\Roaming\WinSocket\93e93708db9363b1fbaca2e1b2bc86b99d92614b9919f9186aa22868896dd984.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2332 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵PID:1920
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Roaming\WinSocket\93e93708db9363b1fbaca2e1b2bc86b99d92614b9919f9186aa22868896dd984.exe
Filesize1.2MB
MD50c0f676f6c3bcd61937ea706a89a3272
SHA1e2cf3f0092ae306d5d1e68660a64980cd49ef7af
SHA25683e83607db8353b1fbaca2e1b2bc75b88d92514b9919f9175aa22757795dd874
SHA512ae701c36c6b8860ac85300d47a5738c59398bd169f1b2aee7c93b493f52fd10efe43eea4cc5a9f7781f0762d8b9ccf18def3c66bbde35037c061927caa034441