Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
06/06/2024, 05:50
Behavioral task
behavioral1
Sample
c337a60974844bbe579fc933b065989fdb5a66350acfaa7952465c0e73a28ec0.exe
Resource
win7-20240508-en
windows7-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
c337a60974844bbe579fc933b065989fdb5a66350acfaa7952465c0e73a28ec0.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
15 signatures
150 seconds
General
-
Target
c337a60974844bbe579fc933b065989fdb5a66350acfaa7952465c0e73a28ec0.exe
-
Size
2.5MB
-
MD5
f908e496fd10a760b9fbdd64b2101c21
-
SHA1
aa32263197cfe9ce4d043d762547f45f2d8026b0
-
SHA256
c337a60974844bbe579fc933b065989fdb5a66350acfaa7952465c0e73a28ec0
-
SHA512
1a3407d52d319972f6fb780f1dce978feab9ef206ee12c0248c83d994ac027e5b9186971a3234e5983e7ac78e6fd0fe3d6c5fba3b79ef7dbb6435846d9fc7db7
-
SSDEEP
49152:MxmvumkQ9lY9sgUXdTPSxdQ8KX75IyuWuCjcCqWOyxy:Mxx9NUFkQx753uWuCyyxy
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Detects executables packed with Themida 17 IoCs
resource yara_rule behavioral1/memory/1916-0-0x0000000000400000-0x0000000000A0E000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral1/files/0x000f000000013432-7.dat INDICATOR_EXE_Packed_Themida behavioral1/memory/1724-11-0x0000000000400000-0x0000000000A0E000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral1/files/0x0009000000013a62-17.dat INDICATOR_EXE_Packed_Themida behavioral1/memory/2340-23-0x0000000000400000-0x0000000000A0E000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral1/files/0x0009000000013a74-30.dat INDICATOR_EXE_Packed_Themida behavioral1/memory/2684-35-0x0000000000400000-0x0000000000A0E000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral1/memory/2624-44-0x0000000000400000-0x0000000000A0E000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral1/memory/1916-43-0x0000000000400000-0x0000000000A0E000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral1/memory/2624-48-0x0000000000400000-0x0000000000A0E000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral1/memory/2340-50-0x0000000000400000-0x0000000000A0E000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral1/memory/1916-52-0x0000000000400000-0x0000000000A0E000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral1/memory/1724-53-0x0000000000400000-0x0000000000A0E000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral1/memory/2684-55-0x0000000000400000-0x0000000000A0E000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral1/memory/1724-63-0x0000000000400000-0x0000000000A0E000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral1/memory/1724-67-0x0000000000400000-0x0000000000A0E000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral1/memory/1724-73-0x0000000000400000-0x0000000000A0E000-memory.dmp INDICATOR_EXE_Packed_Themida -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ spoolsv.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ c337a60974844bbe579fc933b065989fdb5a66350acfaa7952465c0e73a28ec0.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorer.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ spoolsv.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ svchost.exe -
Checks BIOS information in registry 2 TTPs 10 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion spoolsv.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion spoolsv.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion spoolsv.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion c337a60974844bbe579fc933b065989fdb5a66350acfaa7952465c0e73a28ec0.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion spoolsv.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion c337a60974844bbe579fc933b065989fdb5a66350acfaa7952465c0e73a28ec0.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion svchost.exe -
Executes dropped EXE 4 IoCs
pid Process 1724 explorer.exe 2340 spoolsv.exe 2684 svchost.exe 2624 spoolsv.exe -
Loads dropped DLL 4 IoCs
pid Process 1916 c337a60974844bbe579fc933b065989fdb5a66350acfaa7952465c0e73a28ec0.exe 1724 explorer.exe 2340 spoolsv.exe 2684 svchost.exe -
resource yara_rule behavioral1/memory/1916-0-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral1/files/0x000f000000013432-7.dat themida behavioral1/memory/1724-11-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral1/files/0x0009000000013a62-17.dat themida behavioral1/memory/2340-23-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral1/files/0x0009000000013a74-30.dat themida behavioral1/memory/2684-35-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral1/memory/2624-44-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral1/memory/1916-43-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral1/memory/2624-48-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral1/memory/2340-50-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral1/memory/1916-52-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral1/memory/1724-53-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral1/memory/2684-55-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral1/memory/1724-63-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral1/memory/1724-67-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral1/memory/1724-73-0x0000000000400000-0x0000000000A0E000-memory.dmp themida -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" explorer.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA c337a60974844bbe579fc933b065989fdb5a66350acfaa7952465c0e73a28ec0.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA explorer.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA spoolsv.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA svchost.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA spoolsv.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\explorer.exe svchost.exe File opened for modification C:\Windows\SysWOW64\explorer.exe explorer.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
pid Process 1916 c337a60974844bbe579fc933b065989fdb5a66350acfaa7952465c0e73a28ec0.exe 1724 explorer.exe 2340 spoolsv.exe 2684 svchost.exe 2624 spoolsv.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification \??\c:\windows\resources\themes\explorer.exe c337a60974844bbe579fc933b065989fdb5a66350acfaa7952465c0e73a28ec0.exe File opened for modification \??\c:\windows\resources\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\resources\svchost.exe spoolsv.exe File opened for modification C:\Windows\Resources\tjud.exe explorer.exe -
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2656 schtasks.exe 2776 schtasks.exe 1524 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1916 c337a60974844bbe579fc933b065989fdb5a66350acfaa7952465c0e73a28ec0.exe 1916 c337a60974844bbe579fc933b065989fdb5a66350acfaa7952465c0e73a28ec0.exe 1916 c337a60974844bbe579fc933b065989fdb5a66350acfaa7952465c0e73a28ec0.exe 1916 c337a60974844bbe579fc933b065989fdb5a66350acfaa7952465c0e73a28ec0.exe 1916 c337a60974844bbe579fc933b065989fdb5a66350acfaa7952465c0e73a28ec0.exe 1916 c337a60974844bbe579fc933b065989fdb5a66350acfaa7952465c0e73a28ec0.exe 1916 c337a60974844bbe579fc933b065989fdb5a66350acfaa7952465c0e73a28ec0.exe 1916 c337a60974844bbe579fc933b065989fdb5a66350acfaa7952465c0e73a28ec0.exe 1916 c337a60974844bbe579fc933b065989fdb5a66350acfaa7952465c0e73a28ec0.exe 1916 c337a60974844bbe579fc933b065989fdb5a66350acfaa7952465c0e73a28ec0.exe 1916 c337a60974844bbe579fc933b065989fdb5a66350acfaa7952465c0e73a28ec0.exe 1916 c337a60974844bbe579fc933b065989fdb5a66350acfaa7952465c0e73a28ec0.exe 1916 c337a60974844bbe579fc933b065989fdb5a66350acfaa7952465c0e73a28ec0.exe 1916 c337a60974844bbe579fc933b065989fdb5a66350acfaa7952465c0e73a28ec0.exe 1916 c337a60974844bbe579fc933b065989fdb5a66350acfaa7952465c0e73a28ec0.exe 1916 c337a60974844bbe579fc933b065989fdb5a66350acfaa7952465c0e73a28ec0.exe 1916 c337a60974844bbe579fc933b065989fdb5a66350acfaa7952465c0e73a28ec0.exe 1724 explorer.exe 1724 explorer.exe 1724 explorer.exe 1724 explorer.exe 1724 explorer.exe 1724 explorer.exe 1724 explorer.exe 1724 explorer.exe 1724 explorer.exe 1724 explorer.exe 1724 explorer.exe 1724 explorer.exe 1724 explorer.exe 1724 explorer.exe 1724 explorer.exe 1724 explorer.exe 2684 svchost.exe 2684 svchost.exe 2684 svchost.exe 2684 svchost.exe 2684 svchost.exe 2684 svchost.exe 2684 svchost.exe 2684 svchost.exe 2684 svchost.exe 2684 svchost.exe 2684 svchost.exe 2684 svchost.exe 2684 svchost.exe 2684 svchost.exe 2684 svchost.exe 2684 svchost.exe 1724 explorer.exe 2684 svchost.exe 2684 svchost.exe 1724 explorer.exe 1724 explorer.exe 1724 explorer.exe 2684 svchost.exe 1724 explorer.exe 2684 svchost.exe 1724 explorer.exe 2684 svchost.exe 2684 svchost.exe 1724 explorer.exe 1724 explorer.exe 2684 svchost.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 2684 svchost.exe 1724 explorer.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 1916 c337a60974844bbe579fc933b065989fdb5a66350acfaa7952465c0e73a28ec0.exe 1916 c337a60974844bbe579fc933b065989fdb5a66350acfaa7952465c0e73a28ec0.exe 1724 explorer.exe 1724 explorer.exe 2340 spoolsv.exe 2340 spoolsv.exe 2684 svchost.exe 2684 svchost.exe 2624 spoolsv.exe 2624 spoolsv.exe -
Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 1916 wrote to memory of 1724 1916 c337a60974844bbe579fc933b065989fdb5a66350acfaa7952465c0e73a28ec0.exe 28 PID 1916 wrote to memory of 1724 1916 c337a60974844bbe579fc933b065989fdb5a66350acfaa7952465c0e73a28ec0.exe 28 PID 1916 wrote to memory of 1724 1916 c337a60974844bbe579fc933b065989fdb5a66350acfaa7952465c0e73a28ec0.exe 28 PID 1916 wrote to memory of 1724 1916 c337a60974844bbe579fc933b065989fdb5a66350acfaa7952465c0e73a28ec0.exe 28 PID 1724 wrote to memory of 2340 1724 explorer.exe 29 PID 1724 wrote to memory of 2340 1724 explorer.exe 29 PID 1724 wrote to memory of 2340 1724 explorer.exe 29 PID 1724 wrote to memory of 2340 1724 explorer.exe 29 PID 2340 wrote to memory of 2684 2340 spoolsv.exe 30 PID 2340 wrote to memory of 2684 2340 spoolsv.exe 30 PID 2340 wrote to memory of 2684 2340 spoolsv.exe 30 PID 2340 wrote to memory of 2684 2340 spoolsv.exe 30 PID 2684 wrote to memory of 2624 2684 svchost.exe 31 PID 2684 wrote to memory of 2624 2684 svchost.exe 31 PID 2684 wrote to memory of 2624 2684 svchost.exe 31 PID 2684 wrote to memory of 2624 2684 svchost.exe 31 PID 1724 wrote to memory of 2936 1724 explorer.exe 32 PID 1724 wrote to memory of 2936 1724 explorer.exe 32 PID 1724 wrote to memory of 2936 1724 explorer.exe 32 PID 1724 wrote to memory of 2936 1724 explorer.exe 32 PID 2684 wrote to memory of 2656 2684 svchost.exe 33 PID 2684 wrote to memory of 2656 2684 svchost.exe 33 PID 2684 wrote to memory of 2656 2684 svchost.exe 33 PID 2684 wrote to memory of 2656 2684 svchost.exe 33 PID 2684 wrote to memory of 2776 2684 svchost.exe 38 PID 2684 wrote to memory of 2776 2684 svchost.exe 38 PID 2684 wrote to memory of 2776 2684 svchost.exe 38 PID 2684 wrote to memory of 2776 2684 svchost.exe 38 PID 2684 wrote to memory of 1524 2684 svchost.exe 40 PID 2684 wrote to memory of 1524 2684 svchost.exe 40 PID 2684 wrote to memory of 1524 2684 svchost.exe 40 PID 2684 wrote to memory of 1524 2684 svchost.exe 40
Processes
-
C:\Users\Admin\AppData\Local\Temp\c337a60974844bbe579fc933b065989fdb5a66350acfaa7952465c0e73a28ec0.exe"C:\Users\Admin\AppData\Local\Temp\c337a60974844bbe579fc933b065989fdb5a66350acfaa7952465c0e73a28ec0.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1916 -
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1724 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2340 -
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe4⤵
- Modifies visiblity of hidden/system files in Explorer
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR5⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
PID:2624
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 05:52 /f5⤵
- Creates scheduled task(s)
PID:2656
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 05:53 /f5⤵
- Creates scheduled task(s)
PID:2776
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 05:54 /f5⤵
- Creates scheduled task(s)
PID:1524
-
-
-
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe3⤵PID:2936
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Virtualization/Sandbox Evasion
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.5MB
MD5c98173cc37640d58f909029d89e2b697
SHA19bac9b92941b93af9e7332f0b3c8f856dbd8ea0f
SHA256a86738a236c57557d2119503cc19ef1242c637793f6b228da6d5a14ada1c8ed3
SHA5127d091c7cfed5eff06e9eab75face1d6e4f7a771df4800e700bd23aef8309babf8f12376265585cf943c88ad0e4ca2a6d1193a96ae1620e505e486adbaa6f6b2a
-
Filesize
2.5MB
MD5402ecdb7a4726071bbe83cd86567d597
SHA1c8502611d2b6acfeef790567a13a4dfb887a5ecf
SHA2564fc2e3448614ed58372ebbb3b21e7981990e41c1c3782c3a82aba7135125eeb9
SHA51238d43369b39e422e2430c444a5ba52e6444b3e12562b999daeef03353f46d907fdb756a881e41967500da0f054b49d88852966768267fd79663465795d0fc452
-
Filesize
2.5MB
MD51e2f55556f1be28c3e7c5ca4d1b2ee3a
SHA144343f0917d5a1470742a46e3acb00d16f869d64
SHA256b5d2c1763105d4a6b583d99f015c36a25b11def6d9a9ce0105178b4cdf8d1c37
SHA5123c98f5b8170c498590042ae3a1b540fee94d03ca6e43835a2cf45408bd7ec5f259e18db3b38493a4a9c31c90eba05a1de399b55ffc5a1f822dcd15a7628e84e2