Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
29/05/2024, 01:25
Static task
static1
Behavioral task
behavioral1
Sample
cfe5dcf1560ab027ba58c28bc351875a19d9be4b48c12a7ee8ffd3900142b7a4.exe
Resource
win7-20240215-en
General
-
Target
cfe5dcf1560ab027ba58c28bc351875a19d9be4b48c12a7ee8ffd3900142b7a4.exe
-
Size
3.7MB
-
MD5
990f0eb67605df4a888569855b9ef4bb
-
SHA1
2d19c0830200ff83358a86083314af0ff8459190
-
SHA256
cfe5dcf1560ab027ba58c28bc351875a19d9be4b48c12a7ee8ffd3900142b7a4
-
SHA512
18cb7d7f4b03e61332da86fffb66dc604fc6d46b1a488968e9914f29f17bc96e8129e485ce0c13c084e729c1469ea3225032288f5c7c99ced72071cd3650a8a4
-
SSDEEP
98304:Ws7WcPBPn9Y7bIkbp72jLT+tsPnl42Fo:YPIkdeHnllFo
Malware Config
Signatures
-
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\system32\MiniFilter.reg cfe5dcf1560ab027ba58c28bc351875a19d9be4b48c12a7ee8ffd3900142b7a4.exe File created C:\Windows\system32\Process.dat cfe5dcf1560ab027ba58c28bc351875a19d9be4b48c12a7ee8ffd3900142b7a4.exe -
Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 1160 sc.exe 1420 sc.exe -
Runs .reg file with regedit 1 IoCs
pid Process 2728 regedit.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2228 cfe5dcf1560ab027ba58c28bc351875a19d9be4b48c12a7ee8ffd3900142b7a4.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2228 cfe5dcf1560ab027ba58c28bc351875a19d9be4b48c12a7ee8ffd3900142b7a4.exe Token: SeDebugPrivilege 2228 cfe5dcf1560ab027ba58c28bc351875a19d9be4b48c12a7ee8ffd3900142b7a4.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2228 cfe5dcf1560ab027ba58c28bc351875a19d9be4b48c12a7ee8ffd3900142b7a4.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 2228 cfe5dcf1560ab027ba58c28bc351875a19d9be4b48c12a7ee8ffd3900142b7a4.exe -
Suspicious use of WriteProcessMemory 26 IoCs
description pid Process procid_target PID 2228 wrote to memory of 1420 2228 cfe5dcf1560ab027ba58c28bc351875a19d9be4b48c12a7ee8ffd3900142b7a4.exe 28 PID 2228 wrote to memory of 1420 2228 cfe5dcf1560ab027ba58c28bc351875a19d9be4b48c12a7ee8ffd3900142b7a4.exe 28 PID 2228 wrote to memory of 1420 2228 cfe5dcf1560ab027ba58c28bc351875a19d9be4b48c12a7ee8ffd3900142b7a4.exe 28 PID 2228 wrote to memory of 1420 2228 cfe5dcf1560ab027ba58c28bc351875a19d9be4b48c12a7ee8ffd3900142b7a4.exe 28 PID 2228 wrote to memory of 1160 2228 cfe5dcf1560ab027ba58c28bc351875a19d9be4b48c12a7ee8ffd3900142b7a4.exe 29 PID 2228 wrote to memory of 1160 2228 cfe5dcf1560ab027ba58c28bc351875a19d9be4b48c12a7ee8ffd3900142b7a4.exe 29 PID 2228 wrote to memory of 1160 2228 cfe5dcf1560ab027ba58c28bc351875a19d9be4b48c12a7ee8ffd3900142b7a4.exe 29 PID 2228 wrote to memory of 1160 2228 cfe5dcf1560ab027ba58c28bc351875a19d9be4b48c12a7ee8ffd3900142b7a4.exe 29 PID 2228 wrote to memory of 2060 2228 cfe5dcf1560ab027ba58c28bc351875a19d9be4b48c12a7ee8ffd3900142b7a4.exe 32 PID 2228 wrote to memory of 2060 2228 cfe5dcf1560ab027ba58c28bc351875a19d9be4b48c12a7ee8ffd3900142b7a4.exe 32 PID 2228 wrote to memory of 2060 2228 cfe5dcf1560ab027ba58c28bc351875a19d9be4b48c12a7ee8ffd3900142b7a4.exe 32 PID 2228 wrote to memory of 2060 2228 cfe5dcf1560ab027ba58c28bc351875a19d9be4b48c12a7ee8ffd3900142b7a4.exe 32 PID 2228 wrote to memory of 2568 2228 cfe5dcf1560ab027ba58c28bc351875a19d9be4b48c12a7ee8ffd3900142b7a4.exe 33 PID 2228 wrote to memory of 2568 2228 cfe5dcf1560ab027ba58c28bc351875a19d9be4b48c12a7ee8ffd3900142b7a4.exe 33 PID 2228 wrote to memory of 2568 2228 cfe5dcf1560ab027ba58c28bc351875a19d9be4b48c12a7ee8ffd3900142b7a4.exe 33 PID 2228 wrote to memory of 2568 2228 cfe5dcf1560ab027ba58c28bc351875a19d9be4b48c12a7ee8ffd3900142b7a4.exe 33 PID 2060 wrote to memory of 2688 2060 cmd.exe 36 PID 2060 wrote to memory of 2688 2060 cmd.exe 36 PID 2060 wrote to memory of 2688 2060 cmd.exe 36 PID 2568 wrote to memory of 2728 2568 cmd.exe 37 PID 2568 wrote to memory of 2728 2568 cmd.exe 37 PID 2568 wrote to memory of 2728 2568 cmd.exe 37 PID 2228 wrote to memory of 2136 2228 cfe5dcf1560ab027ba58c28bc351875a19d9be4b48c12a7ee8ffd3900142b7a4.exe 38 PID 2228 wrote to memory of 2136 2228 cfe5dcf1560ab027ba58c28bc351875a19d9be4b48c12a7ee8ffd3900142b7a4.exe 38 PID 2228 wrote to memory of 2136 2228 cfe5dcf1560ab027ba58c28bc351875a19d9be4b48c12a7ee8ffd3900142b7a4.exe 38 PID 2228 wrote to memory of 2136 2228 cfe5dcf1560ab027ba58c28bc351875a19d9be4b48c12a7ee8ffd3900142b7a4.exe 38
Processes
-
C:\Users\Admin\AppData\Local\Temp\cfe5dcf1560ab027ba58c28bc351875a19d9be4b48c12a7ee8ffd3900142b7a4.exe"C:\Users\Admin\AppData\Local\Temp\cfe5dcf1560ab027ba58c28bc351875a19d9be4b48c12a7ee8ffd3900142b7a4.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Windows\SysWOW64\sc.exesc stop VmHard2⤵
- Launches sc.exe
PID:1420
-
-
C:\Windows\SysWOW64\sc.exesc stop juejin2⤵
- Launches sc.exe
PID:1160
-
-
C:\Windows\system32\cmd.execmd.exe /c reg import C:\Windows\system32\MiniFilter.reg2⤵
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Windows\system32\reg.exereg import C:\Windows\system32\MiniFilter.reg3⤵PID:2688
-
-
-
C:\Windows\system32\cmd.execmd.exe /c regedit /s C:\Windows\system32\MiniFilter.reg2⤵
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Windows\regedit.exeregedit /s C:\Windows\system32\MiniFilter.reg3⤵
- Runs .reg file with regedit
PID:2728
-
-
-
C:\Windows\system32\cmd.execmd.exe /c del /F /A /Q C:\Windows\system32\MiniFilter.reg2⤵PID:2136
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
530B
MD5b2fcaa4d5bef0af030b7d84283fec2cc
SHA15322091d90bd09e37eae90c9bc4404f5ca00ef39
SHA256c4062bb1ffa7ee7db60a118b187b0177d776362850d375e9fd2c2c469d418a6c
SHA5128dbf3654a4e8399efc5c1aaf2db7cb1c119e73fb81e4111ac87afd8b5b72348402792a6b5fdf6433ab6b7842b5181f3dc3848c9722009b68065fe3fc1faa560d