Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
14/06/2024, 01:40
Static task
static1
Behavioral task
behavioral1
Sample
9c581c4cec9f25a55ee985d08ad3ba40a268aff6ea05aebff399c31f86b98065.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
9c581c4cec9f25a55ee985d08ad3ba40a268aff6ea05aebff399c31f86b98065.exe
Resource
win10v2004-20240508-en
General
-
Target
9c581c4cec9f25a55ee985d08ad3ba40a268aff6ea05aebff399c31f86b98065.exe
-
Size
3.3MB
-
MD5
1869978103ed372145fbf14975f8c56e
-
SHA1
a15f53cb65e2ecfd3c5112711cceb30b9ab88257
-
SHA256
9c581c4cec9f25a55ee985d08ad3ba40a268aff6ea05aebff399c31f86b98065
-
SHA512
b306f831e52bc468ee862afc5909dd6e98f3fab2dca12cb2536f2f4dcdfd919bdf6290dee8dc9c5bffc5a52d808834a5489cb3f403af053bb805d66ce6ecd6a6
-
SSDEEP
24576:0Ln4nHjmrtOSkcMfMFQtpHv85qvdE/ta/7SyI:0LnUHjmb0EFQtpHE5qvdE/ADSb
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 9c581c4cec9f25a55ee985d08ad3ba40a268aff6ea05aebff399c31f86b98065.exe -
Detects executables packed with or use KoiVM 1 IoCs
resource yara_rule behavioral1/memory/2552-3-0x0000000000CE0000-0x0000000000D7A000-memory.dmp INDICATOR_EXE_Packed_KoiVM -
Adds policy Run key to start application 2 TTPs 1 IoCs
description ioc Process Key created \Registry\User\S-1-5-21-268080393-3149932598-1824759070-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run grpconv.exe -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2224 powershell.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\MHF4TB = "C:\\Program Files (x86)\\Windows Mail\\wab.exe" grpconv.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 9c581c4cec9f25a55ee985d08ad3ba40a268aff6ea05aebff399c31f86b98065.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 9c581c4cec9f25a55ee985d08ad3ba40a268aff6ea05aebff399c31f86b98065.exe -
Suspicious use of SetThreadContext 7 IoCs
description pid Process procid_target PID 2552 set thread context of 2652 2552 9c581c4cec9f25a55ee985d08ad3ba40a268aff6ea05aebff399c31f86b98065.exe 30 PID 2652 set thread context of 2552 2652 wab.exe 27 PID 2652 set thread context of 2552 2652 wab.exe 27 PID 2652 set thread context of 2552 2652 wab.exe 27 PID 2652 set thread context of 1184 2652 wab.exe 21 PID 2652 set thread context of 2984 2652 wab.exe 34 PID 2984 set thread context of 2552 2984 grpconv.exe 27 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 16 IoCs
pid Process 2224 powershell.exe 2652 wab.exe 2652 wab.exe 2652 wab.exe 2652 wab.exe 2652 wab.exe 2652 wab.exe 2652 wab.exe 2652 wab.exe 2652 wab.exe 2652 wab.exe 2652 wab.exe 2984 grpconv.exe 2984 grpconv.exe 2984 grpconv.exe 2984 grpconv.exe -
Suspicious behavior: MapViewOfSection 8 IoCs
pid Process 2652 wab.exe 2652 wab.exe 2652 wab.exe 2652 wab.exe 1184 Explorer.EXE 1184 Explorer.EXE 2984 grpconv.exe 2984 grpconv.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2224 powershell.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 2552 wrote to memory of 2224 2552 9c581c4cec9f25a55ee985d08ad3ba40a268aff6ea05aebff399c31f86b98065.exe 28 PID 2552 wrote to memory of 2224 2552 9c581c4cec9f25a55ee985d08ad3ba40a268aff6ea05aebff399c31f86b98065.exe 28 PID 2552 wrote to memory of 2224 2552 9c581c4cec9f25a55ee985d08ad3ba40a268aff6ea05aebff399c31f86b98065.exe 28 PID 2552 wrote to memory of 2652 2552 9c581c4cec9f25a55ee985d08ad3ba40a268aff6ea05aebff399c31f86b98065.exe 30 PID 2552 wrote to memory of 2652 2552 9c581c4cec9f25a55ee985d08ad3ba40a268aff6ea05aebff399c31f86b98065.exe 30 PID 2552 wrote to memory of 2652 2552 9c581c4cec9f25a55ee985d08ad3ba40a268aff6ea05aebff399c31f86b98065.exe 30 PID 2552 wrote to memory of 2652 2552 9c581c4cec9f25a55ee985d08ad3ba40a268aff6ea05aebff399c31f86b98065.exe 30 PID 2552 wrote to memory of 2652 2552 9c581c4cec9f25a55ee985d08ad3ba40a268aff6ea05aebff399c31f86b98065.exe 30 PID 2552 wrote to memory of 2652 2552 9c581c4cec9f25a55ee985d08ad3ba40a268aff6ea05aebff399c31f86b98065.exe 30 PID 2552 wrote to memory of 2652 2552 9c581c4cec9f25a55ee985d08ad3ba40a268aff6ea05aebff399c31f86b98065.exe 30 PID 2552 wrote to memory of 2668 2552 9c581c4cec9f25a55ee985d08ad3ba40a268aff6ea05aebff399c31f86b98065.exe 31 PID 2552 wrote to memory of 2668 2552 9c581c4cec9f25a55ee985d08ad3ba40a268aff6ea05aebff399c31f86b98065.exe 31 PID 2552 wrote to memory of 2668 2552 9c581c4cec9f25a55ee985d08ad3ba40a268aff6ea05aebff399c31f86b98065.exe 31 PID 1184 wrote to memory of 2984 1184 Explorer.EXE 34 PID 1184 wrote to memory of 2984 1184 Explorer.EXE 34 PID 1184 wrote to memory of 2984 1184 Explorer.EXE 34 PID 1184 wrote to memory of 2984 1184 Explorer.EXE 34 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 9c581c4cec9f25a55ee985d08ad3ba40a268aff6ea05aebff399c31f86b98065.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\Users\Admin\AppData\Local\Temp\9c581c4cec9f25a55ee985d08ad3ba40a268aff6ea05aebff399c31f86b98065.exe"C:\Users\Admin\AppData\Local\Temp\9c581c4cec9f25a55ee985d08ad3ba40a268aff6ea05aebff399c31f86b98065.exe"2⤵
- UAC bypass
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2552 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\9c581c4cec9f25a55ee985d08ad3ba40a268aff6ea05aebff399c31f86b98065.exe" -Force3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2224
-
-
C:\Program Files (x86)\Windows Mail\wab.exe"C:\Program Files (x86)\Windows Mail\wab.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2652
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2552 -s 7683⤵PID:2668
-
-
-
C:\Windows\SysWOW64\grpconv.exe"C:\Windows\SysWOW64\grpconv.exe"2⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2984
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2