Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
10/06/2024, 18:16
Static task
static1
Behavioral task
behavioral1
Sample
04d389168ddfda234692dc180bc23228fc87302c6efdfe68dfe921dd32df787d.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
04d389168ddfda234692dc180bc23228fc87302c6efdfe68dfe921dd32df787d.exe
Resource
win10v2004-20240426-en
General
-
Target
04d389168ddfda234692dc180bc23228fc87302c6efdfe68dfe921dd32df787d.exe
-
Size
66KB
-
MD5
3e2428db2164bb359d7c6f4d6245bd85
-
SHA1
5f0f3bfdd00b08e98011597e179b9f58fd510b81
-
SHA256
04d389168ddfda234692dc180bc23228fc87302c6efdfe68dfe921dd32df787d
-
SHA512
0a88545e7755eac6be3ef832b2bd6f76c12e9a97e01bd57729618fb0ce519c9d163b1c277d8809dbfc4dbb46dde433b61dcc0992c5a887e77539a18adbe73c13
-
SSDEEP
1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXih:IeklMMYJhqezw/pXzH9ih
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" svchost.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe -
Modifies Installed Components in the registry 2 TTPs 8 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" svchost.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} svchost.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" svchost.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} svchost.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe -
Executes dropped EXE 4 IoCs
pid Process 940 explorer.exe 2712 spoolsv.exe 1548 svchost.exe 2520 spoolsv.exe -
Loads dropped DLL 8 IoCs
pid Process 2724 04d389168ddfda234692dc180bc23228fc87302c6efdfe68dfe921dd32df787d.exe 2724 04d389168ddfda234692dc180bc23228fc87302c6efdfe68dfe921dd32df787d.exe 940 explorer.exe 940 explorer.exe 2712 spoolsv.exe 2712 spoolsv.exe 1548 svchost.exe 1548 svchost.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe -
Drops file in Windows directory 6 IoCs
description ioc Process File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\system\svchost.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\svchost.exe svchost.exe File opened for modification C:\Windows\system\udsys.exe explorer.exe File opened for modification \??\c:\windows\system\explorer.exe 04d389168ddfda234692dc180bc23228fc87302c6efdfe68dfe921dd32df787d.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2724 04d389168ddfda234692dc180bc23228fc87302c6efdfe68dfe921dd32df787d.exe 940 explorer.exe 940 explorer.exe 940 explorer.exe 940 explorer.exe 940 explorer.exe 1548 svchost.exe 1548 svchost.exe 940 explorer.exe 1548 svchost.exe 940 explorer.exe 1548 svchost.exe 940 explorer.exe 1548 svchost.exe 940 explorer.exe 1548 svchost.exe 940 explorer.exe 1548 svchost.exe 940 explorer.exe 1548 svchost.exe 940 explorer.exe 1548 svchost.exe 940 explorer.exe 1548 svchost.exe 940 explorer.exe 1548 svchost.exe 940 explorer.exe 1548 svchost.exe 940 explorer.exe 1548 svchost.exe 940 explorer.exe 1548 svchost.exe 940 explorer.exe 1548 svchost.exe 940 explorer.exe 1548 svchost.exe 940 explorer.exe 1548 svchost.exe 940 explorer.exe 1548 svchost.exe 940 explorer.exe 1548 svchost.exe 940 explorer.exe 1548 svchost.exe 940 explorer.exe 1548 svchost.exe 940 explorer.exe 1548 svchost.exe 940 explorer.exe 1548 svchost.exe 940 explorer.exe 1548 svchost.exe 940 explorer.exe 1548 svchost.exe 940 explorer.exe 1548 svchost.exe 940 explorer.exe 1548 svchost.exe 940 explorer.exe 1548 svchost.exe 940 explorer.exe 1548 svchost.exe 940 explorer.exe 1548 svchost.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 940 explorer.exe 1548 svchost.exe -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 2724 04d389168ddfda234692dc180bc23228fc87302c6efdfe68dfe921dd32df787d.exe 2724 04d389168ddfda234692dc180bc23228fc87302c6efdfe68dfe921dd32df787d.exe 940 explorer.exe 940 explorer.exe 2712 spoolsv.exe 2712 spoolsv.exe 1548 svchost.exe 1548 svchost.exe 2520 spoolsv.exe 2520 spoolsv.exe 940 explorer.exe 940 explorer.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2724 wrote to memory of 940 2724 04d389168ddfda234692dc180bc23228fc87302c6efdfe68dfe921dd32df787d.exe 28 PID 2724 wrote to memory of 940 2724 04d389168ddfda234692dc180bc23228fc87302c6efdfe68dfe921dd32df787d.exe 28 PID 2724 wrote to memory of 940 2724 04d389168ddfda234692dc180bc23228fc87302c6efdfe68dfe921dd32df787d.exe 28 PID 2724 wrote to memory of 940 2724 04d389168ddfda234692dc180bc23228fc87302c6efdfe68dfe921dd32df787d.exe 28 PID 940 wrote to memory of 2712 940 explorer.exe 29 PID 940 wrote to memory of 2712 940 explorer.exe 29 PID 940 wrote to memory of 2712 940 explorer.exe 29 PID 940 wrote to memory of 2712 940 explorer.exe 29 PID 2712 wrote to memory of 1548 2712 spoolsv.exe 30 PID 2712 wrote to memory of 1548 2712 spoolsv.exe 30 PID 2712 wrote to memory of 1548 2712 spoolsv.exe 30 PID 2712 wrote to memory of 1548 2712 spoolsv.exe 30 PID 1548 wrote to memory of 2520 1548 svchost.exe 31 PID 1548 wrote to memory of 2520 1548 svchost.exe 31 PID 1548 wrote to memory of 2520 1548 svchost.exe 31 PID 1548 wrote to memory of 2520 1548 svchost.exe 31 PID 1548 wrote to memory of 2452 1548 svchost.exe 32 PID 1548 wrote to memory of 2452 1548 svchost.exe 32 PID 1548 wrote to memory of 2452 1548 svchost.exe 32 PID 1548 wrote to memory of 2452 1548 svchost.exe 32 PID 1548 wrote to memory of 2368 1548 svchost.exe 36 PID 1548 wrote to memory of 2368 1548 svchost.exe 36 PID 1548 wrote to memory of 2368 1548 svchost.exe 36 PID 1548 wrote to memory of 2368 1548 svchost.exe 36 PID 1548 wrote to memory of 2292 1548 svchost.exe 38 PID 1548 wrote to memory of 2292 1548 svchost.exe 38 PID 1548 wrote to memory of 2292 1548 svchost.exe 38 PID 1548 wrote to memory of 2292 1548 svchost.exe 38
Processes
-
C:\Users\Admin\AppData\Local\Temp\04d389168ddfda234692dc180bc23228fc87302c6efdfe68dfe921dd32df787d.exe"C:\Users\Admin\AppData\Local\Temp\04d389168ddfda234692dc180bc23228fc87302c6efdfe68dfe921dd32df787d.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe2⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:940 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1548 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe PR5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2520
-
-
C:\Windows\SysWOW64\at.exeat 18:18 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe5⤵PID:2452
-
-
C:\Windows\SysWOW64\at.exeat 18:19 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe5⤵PID:2368
-
-
C:\Windows\SysWOW64\at.exeat 18:20 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe5⤵PID:2292
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
66KB
MD5567d680abac687b7780b738681ae27d1
SHA147518e309a144f7c1bcdbfb66c978b2990710706
SHA2564f733fcd024991f416df3d9af48cde7252a2a3b075c6cf06022db2d07d0bd9dd
SHA51205bf17adf5e44b49c0c4ff393adbdb52bf41cdad302b8203fa82fe9fd29e6fdf5a3654609fcd3366f1e18b2b3cb49508cdc34d26ba0eac0333693482d956ed17
-
Filesize
66KB
MD52961a4013a53f09d80a584cbc428f349
SHA1e29c69b22cfaebb823f8f3252606a9a8b2bbb0d4
SHA2562cc77969890d52918fa2a362a21b952280ff217f519c074ed22d3d42d4f6cdcc
SHA5125a4e0267349d44b8e20d819043b3b15534e662dd37144ab5d22de0535684f9cef755772a12224c62e971bd8b4ae72f105ef7a40670f03f53d9261a2b860c75cf
-
Filesize
66KB
MD549ab39548e7eaa686c4eac1228f87216
SHA182036e34234e8789acabb3d3f6c649c05d975bc3
SHA256dca402af341c60d8fc451b6f45b7fb5f07db3b4c7369c8f0e8b9689a02de1361
SHA51291d0a9a861276bcc049bc702cd6e02f23c0cbbf971b8c02553d2d5b975536741959230f5cb3736e07ebdd377cf486bf10c5eecd9b12c99addc7f01290e304732
-
Filesize
66KB
MD5b60432ccc8e2acd60993609f898b9902
SHA1abd43678e33f98c6c5f457d268173b21efdfb17f
SHA256a27b8aa8066717c51fd65229b7e0e77ea598c4466f7faf202c820648be7251c6
SHA512db02783c16ac1a44276dae03d92cb2c7352febde94b73c928623d7da1645ffc742f8a049d30b3c244ed6ec685471b939b24b9223234f6b83f485fe57ade2a5af