Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
24/06/2024, 09:08
Static task
static1
Behavioral task
behavioral1
Sample
b919b61737aad351b5b5842780bdb71ba2ace45b6e4bcea136b09f90461f5ae7.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
b919b61737aad351b5b5842780bdb71ba2ace45b6e4bcea136b09f90461f5ae7.exe
Resource
win10v2004-20240611-en
General
-
Target
b919b61737aad351b5b5842780bdb71ba2ace45b6e4bcea136b09f90461f5ae7.exe
-
Size
317KB
-
MD5
83780e63f48cb21bea3e734857892bc1
-
SHA1
2dcd36b040a882756d85616edc92cacbdeaa4067
-
SHA256
b919b61737aad351b5b5842780bdb71ba2ace45b6e4bcea136b09f90461f5ae7
-
SHA512
6ef619064cc2422051efa081446fa5545920a829bf080bd6362a20d4ccb459e9abcf7e8c8131c3e357b710e4730f49e3256e54d74f42d523f44bbaf8929cdc5b
-
SSDEEP
6144:haTKwZxUmcOf5Zht6W46r9YOz+RpXKr9qNRyk7kLDyqqiJ6n4+OUP7cu8hPIRDxC:wTtTUmhZr6q9NqDGDypiK5O9hjn
Malware Config
Signatures
-
Modifies security service 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MpsSvc\Parameters\PortKeywords\DHCP Process not Found Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\DHCP\Collection Process not Found -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\e7ae39fa = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\{1CE17C3B-FE65-4C48-BE2C-B041480DC647}\\e7ae39fa.exe" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\e7ae39fa = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\{1CE17C3B-FE65-4C48-BE2C-B041480DC647}\\e7ae39fa.exe" explorer.exe -
Drops file in System32 directory 16 IoCs
description ioc Process File created C:\Windows\system32\perfh009.dat WMIADAP.EXE File created C:\Windows\system32\perfh010.dat WMIADAP.EXE File created C:\Windows\system32\perfh011.dat WMIADAP.EXE File created C:\Windows\system32\wbem\Performance\WmiApRpl_new.h WMIADAP.EXE File created C:\Windows\system32\wbem\Performance\WmiApRpl_new.ini WMIADAP.EXE File created C:\Windows\system32\perfc009.dat WMIADAP.EXE File created C:\Windows\system32\perfc007.dat WMIADAP.EXE File created C:\Windows\system32\perfh007.dat WMIADAP.EXE File created C:\Windows\system32\perfh00C.dat WMIADAP.EXE File created C:\Windows\system32\perfc011.dat WMIADAP.EXE File created C:\Windows\system32\PerfStringBackup.TMP WMIADAP.EXE File created C:\Windows\system32\perfc00A.dat WMIADAP.EXE File created C:\Windows\system32\perfh00A.dat WMIADAP.EXE File created C:\Windows\system32\perfc010.dat WMIADAP.EXE File created C:\Windows\system32\perfc00C.dat WMIADAP.EXE File opened for modification C:\Windows\system32\PerfStringBackup.INI WMIADAP.EXE -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1200 set thread context of 2144 1200 b919b61737aad351b5b5842780bdb71ba2ace45b6e4bcea136b09f90461f5ae7.exe 28 PID 864 set thread context of 1884 864 Process not Found 30 PID 596 set thread context of 1340 596 Process not Found 31 -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\appcompat\programs\RecentFileCache.bcf Process not Found File created C:\Windows\inf\WmiApRpl\WmiApRpl.h WMIADAP.EXE File opened for modification C:\Windows\inf\WmiApRpl\WmiApRpl.h WMIADAP.EXE File created C:\Windows\inf\WmiApRpl\0009\WmiApRpl.ini WMIADAP.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2624 explorer.exe 2624 explorer.exe 2624 explorer.exe 2624 explorer.exe 2624 explorer.exe 2624 explorer.exe 2624 explorer.exe 2624 explorer.exe 2624 explorer.exe 2624 explorer.exe 2624 explorer.exe 2624 explorer.exe 2624 explorer.exe 2624 explorer.exe 2624 explorer.exe 2624 explorer.exe 2624 explorer.exe 2624 explorer.exe 2624 explorer.exe 2624 explorer.exe 2624 explorer.exe 2624 explorer.exe 2624 explorer.exe 2624 explorer.exe 2624 explorer.exe 2624 explorer.exe 2624 explorer.exe 2624 explorer.exe 2624 explorer.exe 2624 explorer.exe 2624 explorer.exe 2624 explorer.exe 2624 explorer.exe 2624 explorer.exe 2624 explorer.exe 2624 explorer.exe 2624 explorer.exe 2624 explorer.exe 2624 explorer.exe 2624 explorer.exe 2624 explorer.exe 2624 explorer.exe 2624 explorer.exe 2624 explorer.exe 2624 explorer.exe 2624 explorer.exe 2624 explorer.exe 2624 explorer.exe 2624 explorer.exe 2624 explorer.exe 2624 explorer.exe 2624 explorer.exe 2624 explorer.exe 2624 explorer.exe 2624 explorer.exe 2624 explorer.exe 2624 explorer.exe 2624 explorer.exe 2624 explorer.exe 2624 explorer.exe 2624 explorer.exe 2624 explorer.exe 2624 explorer.exe 2624 explorer.exe -
Suspicious behavior: MapViewOfSection 26 IoCs
pid Process 2144 b919b61737aad351b5b5842780bdb71ba2ace45b6e4bcea136b09f90461f5ae7.exe 2144 b919b61737aad351b5b5842780bdb71ba2ace45b6e4bcea136b09f90461f5ae7.exe 2624 explorer.exe 2624 explorer.exe 2624 explorer.exe 2624 explorer.exe 2624 explorer.exe 2624 explorer.exe 2624 explorer.exe 2624 explorer.exe 2624 explorer.exe 2624 explorer.exe 2624 explorer.exe 2624 explorer.exe 2624 explorer.exe 2624 explorer.exe 2624 explorer.exe 2624 explorer.exe 2624 explorer.exe 2624 explorer.exe 2624 explorer.exe 2624 explorer.exe 2624 explorer.exe 2624 explorer.exe 864 Process not Found 596 Process not Found -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2624 explorer.exe Token: SeDebugPrivilege 2624 explorer.exe Token: SeDebugPrivilege 2624 explorer.exe Token: SeDebugPrivilege 2624 explorer.exe Token: SeDebugPrivilege 2624 explorer.exe Token: SeDebugPrivilege 2624 explorer.exe Token: SeDebugPrivilege 2624 explorer.exe Token: SeDebugPrivilege 2624 explorer.exe Token: SeDebugPrivilege 2624 explorer.exe Token: SeDebugPrivilege 2624 explorer.exe Token: SeDebugPrivilege 2624 explorer.exe Token: SeDebugPrivilege 2624 explorer.exe Token: SeDebugPrivilege 2624 explorer.exe Token: SeDebugPrivilege 2624 explorer.exe Token: SeDebugPrivilege 2624 explorer.exe Token: SeDebugPrivilege 2624 explorer.exe Token: SeDebugPrivilege 2624 explorer.exe Token: SeDebugPrivilege 2624 explorer.exe Token: SeDebugPrivilege 2624 explorer.exe Token: SeDebugPrivilege 2624 explorer.exe Token: SeDebugPrivilege 2624 explorer.exe Token: SeDebugPrivilege 2624 explorer.exe Token: SeDebugPrivilege 2624 explorer.exe Token: SeDebugPrivilege 2624 explorer.exe Token: SeDebugPrivilege 2624 explorer.exe Token: SeDebugPrivilege 2624 explorer.exe Token: SeAuditPrivilege 864 Process not Found Token: SeAssignPrimaryTokenPrivilege 864 Process not Found Token: SeIncreaseQuotaPrivilege 864 Process not Found Token: SeSecurityPrivilege 864 Process not Found Token: SeTakeOwnershipPrivilege 864 Process not Found Token: SeLoadDriverPrivilege 864 Process not Found Token: SeSystemtimePrivilege 864 Process not Found Token: SeBackupPrivilege 864 Process not Found Token: SeRestorePrivilege 864 Process not Found Token: SeShutdownPrivilege 864 Process not Found Token: SeSystemEnvironmentPrivilege 864 Process not Found Token: SeUndockPrivilege 864 Process not Found Token: SeManageVolumePrivilege 864 Process not Found Token: SeAssignPrimaryTokenPrivilege 864 Process not Found Token: SeIncreaseQuotaPrivilege 864 Process not Found Token: SeSecurityPrivilege 864 Process not Found Token: SeTakeOwnershipPrivilege 864 Process not Found Token: SeLoadDriverPrivilege 864 Process not Found Token: SeSystemtimePrivilege 864 Process not Found Token: SeBackupPrivilege 864 Process not Found Token: SeRestorePrivilege 864 Process not Found Token: SeShutdownPrivilege 864 Process not Found Token: SeSystemEnvironmentPrivilege 864 Process not Found Token: SeUndockPrivilege 864 Process not Found Token: SeManageVolumePrivilege 864 Process not Found Token: SeAssignPrimaryTokenPrivilege 864 Process not Found Token: SeIncreaseQuotaPrivilege 864 Process not Found Token: SeSecurityPrivilege 864 Process not Found Token: SeTakeOwnershipPrivilege 864 Process not Found Token: SeLoadDriverPrivilege 864 Process not Found Token: SeSystemtimePrivilege 864 Process not Found Token: SeBackupPrivilege 864 Process not Found Token: SeRestorePrivilege 864 Process not Found Token: SeShutdownPrivilege 864 Process not Found Token: SeSystemEnvironmentPrivilege 864 Process not Found Token: SeUndockPrivilege 864 Process not Found Token: SeManageVolumePrivilege 864 Process not Found Token: SeAssignPrimaryTokenPrivilege 864 Process not Found -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1200 b919b61737aad351b5b5842780bdb71ba2ace45b6e4bcea136b09f90461f5ae7.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 756 Process not Found -
Suspicious use of WriteProcessMemory 25 IoCs
description pid Process procid_target PID 1200 wrote to memory of 2144 1200 b919b61737aad351b5b5842780bdb71ba2ace45b6e4bcea136b09f90461f5ae7.exe 28 PID 1200 wrote to memory of 2144 1200 b919b61737aad351b5b5842780bdb71ba2ace45b6e4bcea136b09f90461f5ae7.exe 28 PID 1200 wrote to memory of 2144 1200 b919b61737aad351b5b5842780bdb71ba2ace45b6e4bcea136b09f90461f5ae7.exe 28 PID 1200 wrote to memory of 2144 1200 b919b61737aad351b5b5842780bdb71ba2ace45b6e4bcea136b09f90461f5ae7.exe 28 PID 1200 wrote to memory of 2144 1200 b919b61737aad351b5b5842780bdb71ba2ace45b6e4bcea136b09f90461f5ae7.exe 28 PID 1200 wrote to memory of 2144 1200 b919b61737aad351b5b5842780bdb71ba2ace45b6e4bcea136b09f90461f5ae7.exe 28 PID 1200 wrote to memory of 2144 1200 b919b61737aad351b5b5842780bdb71ba2ace45b6e4bcea136b09f90461f5ae7.exe 28 PID 1200 wrote to memory of 2144 1200 b919b61737aad351b5b5842780bdb71ba2ace45b6e4bcea136b09f90461f5ae7.exe 28 PID 1200 wrote to memory of 2144 1200 b919b61737aad351b5b5842780bdb71ba2ace45b6e4bcea136b09f90461f5ae7.exe 28 PID 1200 wrote to memory of 2144 1200 b919b61737aad351b5b5842780bdb71ba2ace45b6e4bcea136b09f90461f5ae7.exe 28 PID 1200 wrote to memory of 2144 1200 b919b61737aad351b5b5842780bdb71ba2ace45b6e4bcea136b09f90461f5ae7.exe 28 PID 2144 wrote to memory of 2624 2144 b919b61737aad351b5b5842780bdb71ba2ace45b6e4bcea136b09f90461f5ae7.exe 29 PID 2144 wrote to memory of 2624 2144 b919b61737aad351b5b5842780bdb71ba2ace45b6e4bcea136b09f90461f5ae7.exe 29 PID 2144 wrote to memory of 2624 2144 b919b61737aad351b5b5842780bdb71ba2ace45b6e4bcea136b09f90461f5ae7.exe 29 PID 2144 wrote to memory of 2624 2144 b919b61737aad351b5b5842780bdb71ba2ace45b6e4bcea136b09f90461f5ae7.exe 29 PID 332 wrote to memory of 1884 332 Process not Found 30 PID 332 wrote to memory of 1884 332 Process not Found 30 PID 864 wrote to memory of 1884 864 Process not Found 30 PID 864 wrote to memory of 1884 864 Process not Found 30 PID 864 wrote to memory of 1884 864 Process not Found 30 PID 332 wrote to memory of 1340 332 Process not Found 31 PID 332 wrote to memory of 1340 332 Process not Found 31 PID 596 wrote to memory of 1340 596 Process not Found 31 PID 596 wrote to memory of 1340 596 Process not Found 31 PID 596 wrote to memory of 1340 596 Process not Found 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\b919b61737aad351b5b5842780bdb71ba2ace45b6e4bcea136b09f90461f5ae7.exe"C:\Users\Admin\AppData\Local\Temp\b919b61737aad351b5b5842780bdb71ba2ace45b6e4bcea136b09f90461f5ae7.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\b919b61737aad351b5b5842780bdb71ba2ace45b6e4bcea136b09f90461f5ae7.exe"C:\Users\Admin\AppData\Local\Temp\b919b61737aad351b5b5842780bdb71ba2ace45b6e4bcea136b09f90461f5ae7.exe"2⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"3⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2624
-
-
-
C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /F /T /R1⤵
- Drops file in System32 directory
- Drops file in Windows directory
PID:1884
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -Embedding1⤵PID:1340
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
141KB
MD50f3d76321f0a7986b42b25a3aa554f82
SHA17036bba62109cc25da5d6a84d22b6edb954987c0
SHA256dfad62e3372760d303f7337fe290e4cb28e714caadd3c59294b77968d81fe460
SHA512bb02a3f14d47d233fbda046f61bbf5612ebc6213b156af9c47f56733a03df1bb484d1c3576569eb4499d7b378eb01f4d6e906c36c6f71738482584c2e84b47d0
-
Filesize
154KB
MD5f0ecfbfa3e3e59fd02197018f7e9cb84
SHA1961e9367a4ef3a189466c0a0a186faf8958bdbc4
SHA256cfa293532a1b865b95093437d82bf8b682132aa335957f0c6d95edfbcc372324
SHA512116e648cb3b591a6a94da5ef11234778924a2ff9e0b3d7f6f00310d8a58914d12f5ee1b63c2f88701bb00538ad0e42ae2561575333c5a1d63bb8c86863ac6294
-
Filesize
145KB
MD5ce233fa5dc5adcb87a5185617a0ff6ac
SHA12e2747284b1204d3ab08733a29fdbabdf8dc55b9
SHA25668d4de5e72cfd117151c44dd6ec74cf46fafd6c51357895d3025d7dac570ce31
SHA5121e9c8e7f12d7c87b4faa0d587a8b374e491cd44f23e13fdb64bde3bc6bf3f2a2d3aba5444a13b199a19737a8170ee8d4ead17a883fbaee66b8b32b35b7577fc2
-
Filesize
142KB
MD5d73172c6cb697755f87cd047c474cf91
SHA1abc5c7194abe32885a170ca666b7cce8251ac1d6
SHA2569de801eebbe32699630f74082c9adea15069acd5afb138c9ecd5d4904e3cdc57
SHA5127c9e4126bed6bc94a211281eed45cee30452519f125b82b143f78da32a3aac72d94d31757e1da22fb2f8a25099ffddec992e2c60987efb9da9b7a17831eafdf6
-
Filesize
114KB
MD51f998386566e5f9b7f11cc79254d1820
SHA1e1da5fe1f305099b94de565d06bc6f36c6794481
SHA2561665d97fb8786b94745295feb616a30c27af84e8a5e1d25cd1bcaf70723040ea
SHA512a7c9702dd5833f4d6d27ce293efb9507948a3b05db350fc9909af6a48bd649c7578f856b4d64d87df451d0efbe202c62da7fffcac03b3fe72c7caaea553de75f
-
Filesize
668KB
MD55026297c7c445e7f6f705906a6f57c02
SHA14ec3b66d44b0d44ec139bd1475afd100748f9e91
SHA256506d3bec72805973df3b2e11aba4d074aeb4b26b7335536e79ea1145108817cc
SHA5125be8e51ecacda465b905df3e38ac114240d8fa6bae5bb17e8e53a87630454b57514ca0abbd8afefd798d450cd4ee89caf4391eeb837ced384260c188482fb48d
-
Filesize
646KB
MD5aecab86cc5c705d7a036cba758c1d7b0
SHA1e88cf81fd282d91c7fc0efae13c13c55f4857b5e
SHA2569bab92e274fcc0af88a7fdd143c9045b9d3a13cac2c00b63f00b320128dcc066
SHA512e0aa8da41373fc64d0e3dc86c9e92a9dd5232f6bcae42dfe6f79012d7e780de85511a9ec6941cb39476632972573a18063d3ecd8b059b1d008d34f585d9edbe8
-
Filesize
727KB
MD57d0bac4e796872daa3f6dc82c57f4ca8
SHA1b4f6bbe08fa8cd0784a94ac442ff937a3d3eea0a
SHA256ce2ef9fc248965f1408d4b7a1e6db67494ba07a7bbdfa810418b30be66ad5879
SHA512145a0e8543e0d79fe1a5ce268d710c807834a05da1e948f84d6a1818171cd4ef077ea44ba1fe439b07b095721e0109cbf7e4cfd7b57519ee44d9fd9fe1169a3e
-
Filesize
727KB
MD55f684ce126de17a7d4433ed2494c5ca9
SHA1ce1a30a477daa1bac2ec358ce58731429eafe911
SHA2562e2ba0c47e71991d646ec380cde47f44318d695e6f3f56ec095955a129af1c2c
SHA5124d0c2669b5002da14d44c21dc2f521fb37b6b41b61bca7b2a9af7c03f616dda9ca825f79a81d3401af626a90017654f9221a6ccc83010ff73de71967fc2f3f5b
-
Filesize
722KB
MD54623482c106cf6cc1bac198f31787b65
SHA15abb0decf7b42ef5daf7db012a742311932f6dad
SHA256eceda45aedbf6454b79f010c891bead3844d43189972f6beeb5ccddb13cc0349
SHA512afecefcec652856dd8b4275f11d75a68a582337b682309c4b61fd26ed7038b92e6b9aa72c1bfc350ce2caf5e357098b54eb1e448a4392960f9f82e01c447669f
-
Filesize
406KB
MD554c674d19c0ff72816402f66f6c3d37c
SHA12dcc0269545a213648d59dc84916d9ec2d62a138
SHA256646d4ea2f0670691aa5b998c26626ede7623886ed3ac9bc9679018f85e584bb5
SHA5124d451e9bef2c451cb9e86c7f4d705be65787c88df5281da94012bfbe5af496718ec3e48099ec3dff1d06fee7133293f10d649866fe59daa7951aebe2e5e67c1f
-
Filesize
3KB
MD5b133a676d139032a27de3d9619e70091
SHA11248aa89938a13640252a79113930ede2f26f1fa
SHA256ae2b6236d3eeb4822835714ae9444e5dcd21bc60f7a909f2962c43bc743c7b15
SHA512c6b99e13d854ce7a6874497473614ee4bd81c490802783db1349ab851cd80d1dc06df8c1f6e434aba873a5bbf6125cc64104709064e19a9dc1c66dcde3f898f5
-
Filesize
27KB
MD546d08e3a55f007c523ac64dce6dcf478
SHA162edf88697e98d43f32090a2197bead7e7244245
SHA2565b15b1fc32713447c3fbc952a0fb02f1fd78c6f9ac69087bdb240625b0282614
SHA512b1f42e70c0ba866a9ed34eb531dbcbae1a659d7349c1e1a14b18b9e23d8cbd302d8509c6d3a28bc7509dd92e83bcb400201fb5d5a70f613421d81fe649d02e42