Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
94s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20240730-en -
resource tags
arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system -
submitted
30/07/2024, 20:38
Static task
static1
Behavioral task
behavioral1
Sample
oof.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
oof.exe
Resource
win10v2004-20240730-en
General
-
Target
oof.exe
-
Size
662KB
-
MD5
0760d43d4adebe20fa0b5e5a7bca1714
-
SHA1
a0a9dae5e9be39bca31021dd9cf565fcdefb8474
-
SHA256
8f9067f2bd4a374539a40fddb8915600c9fd6ba3e5db20cbddcb3c5f22d9da44
-
SHA512
7e60c2726711bb8e822375f93cfb9ced7d172f3f0ae07041cbeea8c4cdb45488d1de90ee77dfef52aa86722a5dcbe521d1affeace3aec8811e851f693d74ef77
-
SSDEEP
12288:9TEUsvsVEcwaFNaxr7IwFnm1p7BmC10sHo0AhHL:9oBvRcxuxrksqRNI0i
Malware Config
Signatures
-
Modifies firewall policy service 3 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile explorer.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" explorer.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile explorer.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\EnableFirewall = "0" explorer.exe -
Event Triggered Execution: Image File Execution Options Injection 1 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\37o95iyyawqo.exe\DisableExceptionChainValidation oof.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\Debugger = "nss.exe" explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\37o95iyyawqo.exe oof.exe -
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorer.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-113082768-653872390-2867000172-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google Updater 2.0 = "\"C:\\ProgramData\\Google Updater 2.0\\37o95iyyawqo.exe\"" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-113082768-653872390-2867000172-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Google Updater 2.0 = "C:\\ProgramData\\Google Updater 2.0\\37o95iyyawqo.exe" explorer.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA oof.exe -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\37o95iyyawqo.exe\DisableExceptionChainValidation oof.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs
pid Process 4300 oof.exe 404 explorer.exe 404 explorer.exe 404 explorer.exe 404 explorer.exe 404 explorer.exe 404 explorer.exe 404 explorer.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2572 set thread context of 4300 2572 oof.exe 85 -
Program crash 1 IoCs
pid pid_target Process procid_target 1192 404 WerFault.exe 86 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language oof.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language oof.exe -
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString explorer.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 oof.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString oof.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 explorer.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer explorer.exe -
Modifies Internet Explorer Protected Mode 1 TTPs 4 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-113082768-653872390-2867000172-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-113082768-653872390-2867000172-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 = "3" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-113082768-653872390-2867000172-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-113082768-653872390-2867000172-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2500 = "3" explorer.exe -
Modifies Internet Explorer Protected Mode Banner 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-113082768-653872390-2867000172-1000\SOFTWARE\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1" explorer.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-113082768-653872390-2867000172-1000\Software\Microsoft\Internet Explorer\Main explorer.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2572 oof.exe 2572 oof.exe 404 explorer.exe 404 explorer.exe 404 explorer.exe 404 explorer.exe -
Suspicious behavior: MapViewOfSection 4 IoCs
pid Process 2572 oof.exe 2572 oof.exe 4300 oof.exe 4300 oof.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 4300 oof.exe -
Suspicious use of AdjustPrivilegeToken 28 IoCs
description pid Process Token: SeDebugPrivilege 4300 oof.exe Token: SeRestorePrivilege 4300 oof.exe Token: SeBackupPrivilege 4300 oof.exe Token: SeLoadDriverPrivilege 4300 oof.exe Token: SeCreatePagefilePrivilege 4300 oof.exe Token: SeShutdownPrivilege 4300 oof.exe Token: SeTakeOwnershipPrivilege 4300 oof.exe Token: SeChangeNotifyPrivilege 4300 oof.exe Token: SeCreateTokenPrivilege 4300 oof.exe Token: SeMachineAccountPrivilege 4300 oof.exe Token: SeSecurityPrivilege 4300 oof.exe Token: SeAssignPrimaryTokenPrivilege 4300 oof.exe Token: SeCreateGlobalPrivilege 4300 oof.exe Token: 33 4300 oof.exe Token: SeDebugPrivilege 404 explorer.exe Token: SeRestorePrivilege 404 explorer.exe Token: SeBackupPrivilege 404 explorer.exe Token: SeLoadDriverPrivilege 404 explorer.exe Token: SeCreatePagefilePrivilege 404 explorer.exe Token: SeShutdownPrivilege 404 explorer.exe Token: SeTakeOwnershipPrivilege 404 explorer.exe Token: SeChangeNotifyPrivilege 404 explorer.exe Token: SeCreateTokenPrivilege 404 explorer.exe Token: SeMachineAccountPrivilege 404 explorer.exe Token: SeSecurityPrivilege 404 explorer.exe Token: SeAssignPrimaryTokenPrivilege 404 explorer.exe Token: SeCreateGlobalPrivilege 404 explorer.exe Token: 33 404 explorer.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2572 wrote to memory of 4300 2572 oof.exe 85 PID 2572 wrote to memory of 4300 2572 oof.exe 85 PID 2572 wrote to memory of 4300 2572 oof.exe 85 PID 4300 wrote to memory of 404 4300 oof.exe 86 PID 4300 wrote to memory of 404 4300 oof.exe 86 PID 4300 wrote to memory of 404 4300 oof.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\oof.exe"C:\Users\Admin\AppData\Local\Temp\oof.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\oof.exe"C:\Users\Admin\AppData\Local\Temp\oof.exe"2⤵
- Event Triggered Execution: Image File Execution Options Injection
- Checks whether UAC is enabled
- Indicator Removal: Clear Persistence
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: MapViewOfSection
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Modifies firewall policy service
- Event Triggered Execution: Image File Execution Options Injection
- Checks BIOS information in registry
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer Protected Mode
- Modifies Internet Explorer Protected Mode Banner
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:404 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 404 -s 11404⤵
- Program crash
PID:1192
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 404 -ip 4041⤵PID:2728
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Image File Execution Options Injection
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Image File Execution Options Injection
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Indicator Removal
1Clear Persistence
1Modify Registry
5