Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
136s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
25/05/2024, 02:56
Behavioral task
behavioral1
Sample
c0f6d311fbc5adc6a6978b6051d96d457acc75a453d79c8c48388cbe7d629cb5.exe
Resource
win7-20240221-en
General
-
Target
c0f6d311fbc5adc6a6978b6051d96d457acc75a453d79c8c48388cbe7d629cb5.exe
-
Size
1.2MB
-
MD5
5f3e7779c64333e9e4dbd3025c4714a3
-
SHA1
ee4dce6dab23620e2e0378e3e037bb6e7e17bd77
-
SHA256
c0f6d311fbc5adc6a6978b6051d96d457acc75a453d79c8c48388cbe7d629cb5
-
SHA512
7e822a05d669bd7bc20a0201780651dad94a2e027b5f68f808d602687713bc7721f095388486e455b78525d3c01ebff1a0d386b332298f9bda934c78b569e2a9
-
SSDEEP
24576:zQ5aILMCfmAUjzX6xQt+4En+bcMAOxA5zYlo1c51Wnf:E5aIwC+Agr6StVEnmcKxY/O12
Malware Config
Signatures
-
KPOT Core Executable 1 IoCs
resource yara_rule behavioral1/files/0x0008000000014e3d-20.dat family_kpot -
Trickbot x86 loader 1 IoCs
Detected Trickbot's x86 loader that unpacks the x86 payload.
resource yara_rule behavioral1/memory/1152-15-0x0000000000580000-0x00000000005A9000-memory.dmp trickbot_loader32 -
Executes dropped EXE 3 IoCs
pid Process 1992 c0f7d311fbc6adc7a7989b7061d97d468acc86a463d89c9c49399cbe8d729cb6.exe 1544 c0f7d311fbc6adc7a7989b7061d97d468acc86a463d89c9c49399cbe8d729cb6.exe 2132 c0f7d311fbc6adc7a7989b7061d97d468acc86a463d89c9c49399cbe8d729cb6.exe -
Loads dropped DLL 2 IoCs
pid Process 1152 c0f6d311fbc5adc6a6978b6051d96d457acc75a453d79c8c48388cbe7d629cb5.exe 1152 c0f6d311fbc5adc6a6978b6051d96d457acc75a453d79c8c48388cbe7d629cb5.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2568 sc.exe 2660 sc.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1152 c0f6d311fbc5adc6a6978b6051d96d457acc75a453d79c8c48388cbe7d629cb5.exe 1152 c0f6d311fbc5adc6a6978b6051d96d457acc75a453d79c8c48388cbe7d629cb5.exe 1152 c0f6d311fbc5adc6a6978b6051d96d457acc75a453d79c8c48388cbe7d629cb5.exe 2728 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2728 powershell.exe Token: SeTcbPrivilege 1544 c0f7d311fbc6adc7a7989b7061d97d468acc86a463d89c9c49399cbe8d729cb6.exe Token: SeTcbPrivilege 2132 c0f7d311fbc6adc7a7989b7061d97d468acc86a463d89c9c49399cbe8d729cb6.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1152 c0f6d311fbc5adc6a6978b6051d96d457acc75a453d79c8c48388cbe7d629cb5.exe 1992 c0f7d311fbc6adc7a7989b7061d97d468acc86a463d89c9c49399cbe8d729cb6.exe 1544 c0f7d311fbc6adc7a7989b7061d97d468acc86a463d89c9c49399cbe8d729cb6.exe 2132 c0f7d311fbc6adc7a7989b7061d97d468acc86a463d89c9c49399cbe8d729cb6.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1152 wrote to memory of 1988 1152 c0f6d311fbc5adc6a6978b6051d96d457acc75a453d79c8c48388cbe7d629cb5.exe 28 PID 1152 wrote to memory of 1988 1152 c0f6d311fbc5adc6a6978b6051d96d457acc75a453d79c8c48388cbe7d629cb5.exe 28 PID 1152 wrote to memory of 1988 1152 c0f6d311fbc5adc6a6978b6051d96d457acc75a453d79c8c48388cbe7d629cb5.exe 28 PID 1152 wrote to memory of 1988 1152 c0f6d311fbc5adc6a6978b6051d96d457acc75a453d79c8c48388cbe7d629cb5.exe 28 PID 1152 wrote to memory of 2776 1152 c0f6d311fbc5adc6a6978b6051d96d457acc75a453d79c8c48388cbe7d629cb5.exe 29 PID 1152 wrote to memory of 2776 1152 c0f6d311fbc5adc6a6978b6051d96d457acc75a453d79c8c48388cbe7d629cb5.exe 29 PID 1152 wrote to memory of 2776 1152 c0f6d311fbc5adc6a6978b6051d96d457acc75a453d79c8c48388cbe7d629cb5.exe 29 PID 1152 wrote to memory of 2776 1152 c0f6d311fbc5adc6a6978b6051d96d457acc75a453d79c8c48388cbe7d629cb5.exe 29 PID 1152 wrote to memory of 2816 1152 c0f6d311fbc5adc6a6978b6051d96d457acc75a453d79c8c48388cbe7d629cb5.exe 31 PID 1152 wrote to memory of 2816 1152 c0f6d311fbc5adc6a6978b6051d96d457acc75a453d79c8c48388cbe7d629cb5.exe 31 PID 1152 wrote to memory of 2816 1152 c0f6d311fbc5adc6a6978b6051d96d457acc75a453d79c8c48388cbe7d629cb5.exe 31 PID 1152 wrote to memory of 2816 1152 c0f6d311fbc5adc6a6978b6051d96d457acc75a453d79c8c48388cbe7d629cb5.exe 31 PID 1152 wrote to memory of 1992 1152 c0f6d311fbc5adc6a6978b6051d96d457acc75a453d79c8c48388cbe7d629cb5.exe 34 PID 1152 wrote to memory of 1992 1152 c0f6d311fbc5adc6a6978b6051d96d457acc75a453d79c8c48388cbe7d629cb5.exe 34 PID 1152 wrote to memory of 1992 1152 c0f6d311fbc5adc6a6978b6051d96d457acc75a453d79c8c48388cbe7d629cb5.exe 34 PID 1152 wrote to memory of 1992 1152 c0f6d311fbc5adc6a6978b6051d96d457acc75a453d79c8c48388cbe7d629cb5.exe 34 PID 1988 wrote to memory of 2660 1988 cmd.exe 35 PID 1988 wrote to memory of 2660 1988 cmd.exe 35 PID 1988 wrote to memory of 2660 1988 cmd.exe 35 PID 1988 wrote to memory of 2660 1988 cmd.exe 35 PID 2776 wrote to memory of 2568 2776 cmd.exe 36 PID 2776 wrote to memory of 2568 2776 cmd.exe 36 PID 2776 wrote to memory of 2568 2776 cmd.exe 36 PID 2776 wrote to memory of 2568 2776 cmd.exe 36 PID 2816 wrote to memory of 2728 2816 cmd.exe 37 PID 2816 wrote to memory of 2728 2816 cmd.exe 37 PID 2816 wrote to memory of 2728 2816 cmd.exe 37 PID 2816 wrote to memory of 2728 2816 cmd.exe 37 PID 1992 wrote to memory of 2528 1992 c0f7d311fbc6adc7a7989b7061d97d468acc86a463d89c9c49399cbe8d729cb6.exe 38 PID 1992 wrote to memory of 2528 1992 c0f7d311fbc6adc7a7989b7061d97d468acc86a463d89c9c49399cbe8d729cb6.exe 38 PID 1992 wrote to memory of 2528 1992 c0f7d311fbc6adc7a7989b7061d97d468acc86a463d89c9c49399cbe8d729cb6.exe 38 PID 1992 wrote to memory of 2528 1992 c0f7d311fbc6adc7a7989b7061d97d468acc86a463d89c9c49399cbe8d729cb6.exe 38 PID 1992 wrote to memory of 2528 1992 c0f7d311fbc6adc7a7989b7061d97d468acc86a463d89c9c49399cbe8d729cb6.exe 38 PID 1992 wrote to memory of 2528 1992 c0f7d311fbc6adc7a7989b7061d97d468acc86a463d89c9c49399cbe8d729cb6.exe 38 PID 1992 wrote to memory of 2528 1992 c0f7d311fbc6adc7a7989b7061d97d468acc86a463d89c9c49399cbe8d729cb6.exe 38 PID 1992 wrote to memory of 2528 1992 c0f7d311fbc6adc7a7989b7061d97d468acc86a463d89c9c49399cbe8d729cb6.exe 38 PID 1992 wrote to memory of 2528 1992 c0f7d311fbc6adc7a7989b7061d97d468acc86a463d89c9c49399cbe8d729cb6.exe 38 PID 1992 wrote to memory of 2528 1992 c0f7d311fbc6adc7a7989b7061d97d468acc86a463d89c9c49399cbe8d729cb6.exe 38 PID 1992 wrote to memory of 2528 1992 c0f7d311fbc6adc7a7989b7061d97d468acc86a463d89c9c49399cbe8d729cb6.exe 38 PID 1992 wrote to memory of 2528 1992 c0f7d311fbc6adc7a7989b7061d97d468acc86a463d89c9c49399cbe8d729cb6.exe 38 PID 1992 wrote to memory of 2528 1992 c0f7d311fbc6adc7a7989b7061d97d468acc86a463d89c9c49399cbe8d729cb6.exe 38 PID 1992 wrote to memory of 2528 1992 c0f7d311fbc6adc7a7989b7061d97d468acc86a463d89c9c49399cbe8d729cb6.exe 38 PID 1992 wrote to memory of 2528 1992 c0f7d311fbc6adc7a7989b7061d97d468acc86a463d89c9c49399cbe8d729cb6.exe 38 PID 1992 wrote to memory of 2528 1992 c0f7d311fbc6adc7a7989b7061d97d468acc86a463d89c9c49399cbe8d729cb6.exe 38 PID 1992 wrote to memory of 2528 1992 c0f7d311fbc6adc7a7989b7061d97d468acc86a463d89c9c49399cbe8d729cb6.exe 38 PID 1992 wrote to memory of 2528 1992 c0f7d311fbc6adc7a7989b7061d97d468acc86a463d89c9c49399cbe8d729cb6.exe 38 PID 1992 wrote to memory of 2528 1992 c0f7d311fbc6adc7a7989b7061d97d468acc86a463d89c9c49399cbe8d729cb6.exe 38 PID 1992 wrote to memory of 2528 1992 c0f7d311fbc6adc7a7989b7061d97d468acc86a463d89c9c49399cbe8d729cb6.exe 38 PID 1992 wrote to memory of 2528 1992 c0f7d311fbc6adc7a7989b7061d97d468acc86a463d89c9c49399cbe8d729cb6.exe 38 PID 1992 wrote to memory of 2528 1992 c0f7d311fbc6adc7a7989b7061d97d468acc86a463d89c9c49399cbe8d729cb6.exe 38 PID 1992 wrote to memory of 2528 1992 c0f7d311fbc6adc7a7989b7061d97d468acc86a463d89c9c49399cbe8d729cb6.exe 38 PID 1992 wrote to memory of 2528 1992 c0f7d311fbc6adc7a7989b7061d97d468acc86a463d89c9c49399cbe8d729cb6.exe 38 PID 1992 wrote to memory of 2528 1992 c0f7d311fbc6adc7a7989b7061d97d468acc86a463d89c9c49399cbe8d729cb6.exe 38 PID 1992 wrote to memory of 2528 1992 c0f7d311fbc6adc7a7989b7061d97d468acc86a463d89c9c49399cbe8d729cb6.exe 38 PID 1992 wrote to memory of 2528 1992 c0f7d311fbc6adc7a7989b7061d97d468acc86a463d89c9c49399cbe8d729cb6.exe 38 PID 1992 wrote to memory of 2528 1992 c0f7d311fbc6adc7a7989b7061d97d468acc86a463d89c9c49399cbe8d729cb6.exe 38 PID 1432 wrote to memory of 1544 1432 taskeng.exe 42 PID 1432 wrote to memory of 1544 1432 taskeng.exe 42 PID 1432 wrote to memory of 1544 1432 taskeng.exe 42 PID 1432 wrote to memory of 1544 1432 taskeng.exe 42 PID 1544 wrote to memory of 1340 1544 c0f7d311fbc6adc7a7989b7061d97d468acc86a463d89c9c49399cbe8d729cb6.exe 43 PID 1544 wrote to memory of 1340 1544 c0f7d311fbc6adc7a7989b7061d97d468acc86a463d89c9c49399cbe8d729cb6.exe 43 PID 1544 wrote to memory of 1340 1544 c0f7d311fbc6adc7a7989b7061d97d468acc86a463d89c9c49399cbe8d729cb6.exe 43 PID 1544 wrote to memory of 1340 1544 c0f7d311fbc6adc7a7989b7061d97d468acc86a463d89c9c49399cbe8d729cb6.exe 43 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\c0f6d311fbc5adc6a6978b6051d96d457acc75a453d79c8c48388cbe7d629cb5.exe"C:\Users\Admin\AppData\Local\Temp\c0f6d311fbc5adc6a6978b6051d96d457acc75a453d79c8c48388cbe7d629cb5.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Windows\SysWOW64\cmd.exe/c sc stop WinDefend2⤵
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Windows\SysWOW64\sc.exesc stop WinDefend3⤵
- Launches sc.exe
PID:2660
-
-
-
C:\Windows\SysWOW64\cmd.exe/c sc delete WinDefend2⤵
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Windows\SysWOW64\sc.exesc delete WinDefend3⤵
- Launches sc.exe
PID:2568
-
-
-
C:\Windows\SysWOW64\cmd.exe/c powershell Set-MpPreference -DisableRealtimeMonitoring $true2⤵
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableRealtimeMonitoring $true3⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2728
-
-
-
C:\Users\Admin\AppData\Roaming\WinSocket\c0f7d311fbc6adc7a7989b7061d97d468acc86a463d89c9c49399cbe8d729cb6.exeC:\Users\Admin\AppData\Roaming\WinSocket\c0f7d311fbc6adc7a7989b7061d97d468acc86a463d89c9c49399cbe8d729cb6.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵PID:2528
-
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {2460D4E5-53D2-44D6-B0D3-D8BD9EC7CD91} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
PID:1432 -
C:\Users\Admin\AppData\Roaming\WinSocket\c0f7d311fbc6adc7a7989b7061d97d468acc86a463d89c9c49399cbe8d729cb6.exeC:\Users\Admin\AppData\Roaming\WinSocket\c0f7d311fbc6adc7a7989b7061d97d468acc86a463d89c9c49399cbe8d729cb6.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵PID:1340
-
-
-
C:\Users\Admin\AppData\Roaming\WinSocket\c0f7d311fbc6adc7a7989b7061d97d468acc86a463d89c9c49399cbe8d729cb6.exeC:\Users\Admin\AppData\Roaming\WinSocket\c0f7d311fbc6adc7a7989b7061d97d468acc86a463d89c9c49399cbe8d729cb6.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2132 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵PID:960
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Roaming\WinSocket\c0f7d311fbc6adc7a7989b7061d97d468acc86a463d89c9c49399cbe8d729cb6.exe
Filesize1.2MB
MD55f3e7779c64333e9e4dbd3025c4714a3
SHA1ee4dce6dab23620e2e0378e3e037bb6e7e17bd77
SHA256c0f6d311fbc5adc6a6978b6051d96d457acc75a453d79c8c48388cbe7d629cb5
SHA5127e822a05d669bd7bc20a0201780651dad94a2e027b5f68f808d602687713bc7721f095388486e455b78525d3c01ebff1a0d386b332298f9bda934c78b569e2a9