Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
03/08/2024, 07:42
Behavioral task
behavioral1
Sample
6d35ee202396f3c884f540485b431a20N.exe
Resource
win7-20240705-en
windows7-x64
15 signatures
120 seconds
Behavioral task
behavioral2
Sample
6d35ee202396f3c884f540485b431a20N.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
14 signatures
120 seconds
General
-
Target
6d35ee202396f3c884f540485b431a20N.exe
-
Size
33KB
-
MD5
6d35ee202396f3c884f540485b431a20
-
SHA1
a115ec49fece8efda40c2c7910eb17ec953c5d82
-
SHA256
229849741b475b4aa52d42c61e8e11b580d36695cf190843ec2ab46f8351dfc5
-
SHA512
e1ccbf974d7d6f6aedccd73f00ddc1a835b3ac2fdb73fb12ed53b21f665cbfc26c6302354cd284e4f16931883c703a797c3ed2f783a87d49c4add1fb8b2e02e9
-
SSDEEP
768:tQbuQRy2UjmUndnlTttxDn+3jiSkjRY6AB7kKfYoJ+ifBEewzKOm:QuQRylaUDTDxDXjy6AB7koYy2Tm
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "24064" eakmoodoab-ourac.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "24064" eakmoodoab-ourac.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "24064" eakmoodoab-ourac.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "24064" eakmoodoab-ourac.exe -
Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{50534251-5746-5954-5053-425157465954} eakmoodoab-ourac.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{50534251-5746-5954-5053-425157465954}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a" eakmoodoab-ourac.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{50534251-5746-5954-5053-425157465954}\IsInstalled = "1" eakmoodoab-ourac.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{50534251-5746-5954-5053-425157465954}\StubPath = "C:\\Windows\\system32\\idmeagat-acum.exe" eakmoodoab-ourac.exe -
Event Triggered Execution: Image File Execution Options Injection 1 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe eakmoodoab-ourac.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a" eakmoodoab-ourac.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\attoseav.exe" eakmoodoab-ourac.exe -
Executes dropped EXE 2 IoCs
pid Process 2700 eakmoodoab-ourac.exe 2404 eakmoodoab-ourac.exe -
Loads dropped DLL 3 IoCs
pid Process 2648 6d35ee202396f3c884f540485b431a20N.exe 2648 6d35ee202396f3c884f540485b431a20N.exe 2700 eakmoodoab-ourac.exe -
resource yara_rule behavioral1/memory/2648-0-0x0000000000400000-0x0000000000417000-memory.dmp upx behavioral1/files/0x0008000000012118-6.dat upx behavioral1/memory/2700-22-0x0000000000400000-0x0000000000417000-memory.dmp upx behavioral1/memory/2648-11-0x0000000000400000-0x0000000000417000-memory.dmp upx behavioral1/memory/2404-25-0x0000000000400000-0x0000000000417000-memory.dmp upx behavioral1/memory/2700-59-0x0000000000400000-0x0000000000417000-memory.dmp upx behavioral1/memory/2404-60-0x0000000000400000-0x0000000000417000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "24064" eakmoodoab-ourac.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "24064" eakmoodoab-ourac.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "24064" eakmoodoab-ourac.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "24064" eakmoodoab-ourac.exe -
description ioc Process Delete value \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger eakmoodoab-ourac.exe -
Modifies WinLogon 2 TTPs 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B} eakmoodoab-ourac.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify eakmoodoab-ourac.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a" eakmoodoab-ourac.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\esteroag-ecoab.dll" eakmoodoab-ourac.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup" eakmoodoab-ourac.exe -
Drops file in System32 directory 17 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\winrnt.exe eakmoodoab-ourac.exe File opened for modification C:\Windows\SysWOW64\ahuy.exe eakmoodoab-ourac.exe File opened for modification C:\Windows\SysWOW64\ntdbg.exe eakmoodoab-ourac.exe File opened for modification C:\Windows\SysWOW64\gymspzd.dll eakmoodoab-ourac.exe File created C:\Windows\SysWOW64\eakmoodoab-ourac.exe 6d35ee202396f3c884f540485b431a20N.exe File created C:\Windows\SysWOW64\idmeagat-acum.exe eakmoodoab-ourac.exe File opened for modification C:\Windows\SysWOW64\esteroag-ecoab.dll eakmoodoab-ourac.exe File opened for modification C:\Windows\SysWOW64\RECOVER32.DLL eakmoodoab-ourac.exe File opened for modification C:\Windows\SysWOW64\attoseav.exe eakmoodoab-ourac.exe File opened for modification C:\Windows\SysWOW64\idmeagat-acum.exe eakmoodoab-ourac.exe File opened for modification C:\Windows\SysWOW64\eakmoodoab-ourac.exe eakmoodoab-ourac.exe File opened for modification C:\Windows\SysWOW64\aset32.exe eakmoodoab-ourac.exe File opened for modification C:\Windows\SysWOW64\idbg32.exe eakmoodoab-ourac.exe File opened for modification C:\Windows\SysWOW64\eakmoodoab-ourac.exe 6d35ee202396f3c884f540485b431a20N.exe File created C:\Windows\SysWOW64\attoseav.exe eakmoodoab-ourac.exe File created C:\Windows\SysWOW64\esteroag-ecoab.dll eakmoodoab-ourac.exe File opened for modification C:\Windows\SysWOW64\rmass.exe eakmoodoab-ourac.exe -
Drops file in Program Files directory 8 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Common Files\System\idbg32.exe eakmoodoab-ourac.exe File opened for modification C:\Program Files (x86)\Common Files\System\ntdbg.exe eakmoodoab-ourac.exe File opened for modification C:\Program Files (x86)\Common Files\System\RECOVER32.DLL eakmoodoab-ourac.exe File opened for modification C:\Program Files (x86)\Common Files\System\gymspzd.dll eakmoodoab-ourac.exe File opened for modification C:\Program Files (x86)\Common Files\System\winrnt.exe eakmoodoab-ourac.exe File opened for modification C:\Program Files (x86)\Common Files\System\rmass.exe eakmoodoab-ourac.exe File opened for modification C:\Program Files (x86)\Common Files\System\aset32.exe eakmoodoab-ourac.exe File opened for modification C:\Program Files (x86)\Common Files\System\ahuy.exe eakmoodoab-ourac.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6d35ee202396f3c884f540485b431a20N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language eakmoodoab-ourac.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2700 eakmoodoab-ourac.exe 2700 eakmoodoab-ourac.exe 2700 eakmoodoab-ourac.exe 2700 eakmoodoab-ourac.exe 2404 eakmoodoab-ourac.exe 2700 eakmoodoab-ourac.exe 2700 eakmoodoab-ourac.exe 2700 eakmoodoab-ourac.exe 2700 eakmoodoab-ourac.exe 2700 eakmoodoab-ourac.exe 2700 eakmoodoab-ourac.exe 2700 eakmoodoab-ourac.exe 2700 eakmoodoab-ourac.exe 2700 eakmoodoab-ourac.exe 2700 eakmoodoab-ourac.exe 2700 eakmoodoab-ourac.exe 2700 eakmoodoab-ourac.exe 2700 eakmoodoab-ourac.exe 2700 eakmoodoab-ourac.exe 2700 eakmoodoab-ourac.exe 2700 eakmoodoab-ourac.exe 2700 eakmoodoab-ourac.exe 2700 eakmoodoab-ourac.exe 2700 eakmoodoab-ourac.exe 2700 eakmoodoab-ourac.exe 2700 eakmoodoab-ourac.exe 2700 eakmoodoab-ourac.exe 2700 eakmoodoab-ourac.exe 2700 eakmoodoab-ourac.exe 2700 eakmoodoab-ourac.exe 2700 eakmoodoab-ourac.exe 2700 eakmoodoab-ourac.exe 2700 eakmoodoab-ourac.exe 2700 eakmoodoab-ourac.exe 2700 eakmoodoab-ourac.exe 2700 eakmoodoab-ourac.exe 2700 eakmoodoab-ourac.exe 2700 eakmoodoab-ourac.exe 2700 eakmoodoab-ourac.exe 2700 eakmoodoab-ourac.exe 2700 eakmoodoab-ourac.exe 2700 eakmoodoab-ourac.exe 2700 eakmoodoab-ourac.exe 2700 eakmoodoab-ourac.exe 2700 eakmoodoab-ourac.exe 2700 eakmoodoab-ourac.exe 2700 eakmoodoab-ourac.exe 2700 eakmoodoab-ourac.exe 2700 eakmoodoab-ourac.exe 2700 eakmoodoab-ourac.exe 2700 eakmoodoab-ourac.exe 2700 eakmoodoab-ourac.exe 2700 eakmoodoab-ourac.exe 2700 eakmoodoab-ourac.exe 2700 eakmoodoab-ourac.exe 2700 eakmoodoab-ourac.exe 2700 eakmoodoab-ourac.exe 2700 eakmoodoab-ourac.exe 2700 eakmoodoab-ourac.exe 2700 eakmoodoab-ourac.exe 2700 eakmoodoab-ourac.exe 2700 eakmoodoab-ourac.exe 2700 eakmoodoab-ourac.exe 2700 eakmoodoab-ourac.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2648 6d35ee202396f3c884f540485b431a20N.exe Token: SeDebugPrivilege 2700 eakmoodoab-ourac.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2648 wrote to memory of 2700 2648 6d35ee202396f3c884f540485b431a20N.exe 30 PID 2648 wrote to memory of 2700 2648 6d35ee202396f3c884f540485b431a20N.exe 30 PID 2648 wrote to memory of 2700 2648 6d35ee202396f3c884f540485b431a20N.exe 30 PID 2648 wrote to memory of 2700 2648 6d35ee202396f3c884f540485b431a20N.exe 30 PID 2700 wrote to memory of 428 2700 eakmoodoab-ourac.exe 5 PID 2700 wrote to memory of 1228 2700 eakmoodoab-ourac.exe 21 PID 2700 wrote to memory of 1228 2700 eakmoodoab-ourac.exe 21 PID 2700 wrote to memory of 2404 2700 eakmoodoab-ourac.exe 31 PID 2700 wrote to memory of 2404 2700 eakmoodoab-ourac.exe 31 PID 2700 wrote to memory of 2404 2700 eakmoodoab-ourac.exe 31 PID 2700 wrote to memory of 2404 2700 eakmoodoab-ourac.exe 31 PID 2700 wrote to memory of 1228 2700 eakmoodoab-ourac.exe 21 PID 2700 wrote to memory of 1228 2700 eakmoodoab-ourac.exe 21 PID 2700 wrote to memory of 1228 2700 eakmoodoab-ourac.exe 21 PID 2700 wrote to memory of 1228 2700 eakmoodoab-ourac.exe 21 PID 2700 wrote to memory of 1228 2700 eakmoodoab-ourac.exe 21 PID 2700 wrote to memory of 1228 2700 eakmoodoab-ourac.exe 21 PID 2700 wrote to memory of 1228 2700 eakmoodoab-ourac.exe 21 PID 2700 wrote to memory of 1228 2700 eakmoodoab-ourac.exe 21 PID 2700 wrote to memory of 1228 2700 eakmoodoab-ourac.exe 21 PID 2700 wrote to memory of 1228 2700 eakmoodoab-ourac.exe 21 PID 2700 wrote to memory of 1228 2700 eakmoodoab-ourac.exe 21 PID 2700 wrote to memory of 1228 2700 eakmoodoab-ourac.exe 21 PID 2700 wrote to memory of 1228 2700 eakmoodoab-ourac.exe 21 PID 2700 wrote to memory of 1228 2700 eakmoodoab-ourac.exe 21 PID 2700 wrote to memory of 1228 2700 eakmoodoab-ourac.exe 21 PID 2700 wrote to memory of 1228 2700 eakmoodoab-ourac.exe 21 PID 2700 wrote to memory of 1228 2700 eakmoodoab-ourac.exe 21 PID 2700 wrote to memory of 1228 2700 eakmoodoab-ourac.exe 21 PID 2700 wrote to memory of 1228 2700 eakmoodoab-ourac.exe 21 PID 2700 wrote to memory of 1228 2700 eakmoodoab-ourac.exe 21 PID 2700 wrote to memory of 1228 2700 eakmoodoab-ourac.exe 21 PID 2700 wrote to memory of 1228 2700 eakmoodoab-ourac.exe 21 PID 2700 wrote to memory of 1228 2700 eakmoodoab-ourac.exe 21 PID 2700 wrote to memory of 1228 2700 eakmoodoab-ourac.exe 21 PID 2700 wrote to memory of 1228 2700 eakmoodoab-ourac.exe 21 PID 2700 wrote to memory of 1228 2700 eakmoodoab-ourac.exe 21 PID 2700 wrote to memory of 1228 2700 eakmoodoab-ourac.exe 21 PID 2700 wrote to memory of 1228 2700 eakmoodoab-ourac.exe 21 PID 2700 wrote to memory of 1228 2700 eakmoodoab-ourac.exe 21 PID 2700 wrote to memory of 1228 2700 eakmoodoab-ourac.exe 21 PID 2700 wrote to memory of 1228 2700 eakmoodoab-ourac.exe 21 PID 2700 wrote to memory of 1228 2700 eakmoodoab-ourac.exe 21 PID 2700 wrote to memory of 1228 2700 eakmoodoab-ourac.exe 21 PID 2700 wrote to memory of 1228 2700 eakmoodoab-ourac.exe 21 PID 2700 wrote to memory of 1228 2700 eakmoodoab-ourac.exe 21 PID 2700 wrote to memory of 1228 2700 eakmoodoab-ourac.exe 21 PID 2700 wrote to memory of 1228 2700 eakmoodoab-ourac.exe 21 PID 2700 wrote to memory of 1228 2700 eakmoodoab-ourac.exe 21 PID 2700 wrote to memory of 1228 2700 eakmoodoab-ourac.exe 21 PID 2700 wrote to memory of 1228 2700 eakmoodoab-ourac.exe 21 PID 2700 wrote to memory of 1228 2700 eakmoodoab-ourac.exe 21 PID 2700 wrote to memory of 1228 2700 eakmoodoab-ourac.exe 21 PID 2700 wrote to memory of 1228 2700 eakmoodoab-ourac.exe 21 PID 2700 wrote to memory of 1228 2700 eakmoodoab-ourac.exe 21 PID 2700 wrote to memory of 1228 2700 eakmoodoab-ourac.exe 21 PID 2700 wrote to memory of 1228 2700 eakmoodoab-ourac.exe 21 PID 2700 wrote to memory of 1228 2700 eakmoodoab-ourac.exe 21 PID 2700 wrote to memory of 1228 2700 eakmoodoab-ourac.exe 21 PID 2700 wrote to memory of 1228 2700 eakmoodoab-ourac.exe 21 PID 2700 wrote to memory of 1228 2700 eakmoodoab-ourac.exe 21 PID 2700 wrote to memory of 1228 2700 eakmoodoab-ourac.exe 21 PID 2700 wrote to memory of 1228 2700 eakmoodoab-ourac.exe 21 PID 2700 wrote to memory of 1228 2700 eakmoodoab-ourac.exe 21
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:428
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1228
-
C:\Users\Admin\AppData\Local\Temp\6d35ee202396f3c884f540485b431a20N.exe"C:\Users\Admin\AppData\Local\Temp\6d35ee202396f3c884f540485b431a20N.exe"2⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Windows\SysWOW64\eakmoodoab-ourac.exe"C:\Windows\system32\eakmoodoab-ourac.exe"3⤵
- Windows security bypass
- Boot or Logon Autostart Execution: Active Setup
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Indicator Removal: Clear Persistence
- Modifies WinLogon
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Windows\SysWOW64\eakmoodoab-ourac.exe--k33p4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2404
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Winlogon Helper DLL
1Event Triggered Execution
1Image File Execution Options Injection
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Winlogon Helper DLL
1Event Triggered Execution
1Image File Execution Options Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
36KB
MD5449af745d2eb16086536e82e7d825823
SHA1e86918ff0c0675c2071f5241d8f7a0aee850bbf5
SHA2560f5a1b11154f34720983ba996184d69d26ce51e2097579b5711be0dc3923f496
SHA51264145321b572326e4c50d6f599dcfb8a3ef86a7c6347816e64e0896ec223e1889c3c97732f99fb4effdc428375c7f122c03cefd776b3a9e505cfd1fc824a1087
-
Filesize
5KB
MD5c8521a5fdd1c9387d536f599d850b195
SHA1a543080665107b7e32bcc1ed19dbfbc1d2931356
SHA256fa8f77b6daf775d66de9d27c1d896168a792057358e518c00e72b8964b966ca5
SHA512541500e2cd502852a007d29badc1a1848d187245f78ec272281bab290cc6e308f0ae6d1b96863e0c30a176b16c6cf7e63e08a8de81a84615e4710e7164a805cd
-
Filesize
35KB
MD5edf44fd1c290e2a3acc4ad2ec5458af1
SHA11a4850a1051973f06b22b8b56029021b702f7b55
SHA2562b546f7fe500f0d8d639ffc47918be6f246d995cf00e24abb5e370c8fa492d33
SHA512c51efb59319bd1878f36d30713b938e0ec93249fdf030a8997f2aa7e6c0bddab297cfc0f84a54dee27952a44a7f367eea4fa00dd2f39f03d56d49c6aeff821ba
-
Filesize
33KB
MD56d35ee202396f3c884f540485b431a20
SHA1a115ec49fece8efda40c2c7910eb17ec953c5d82
SHA256229849741b475b4aa52d42c61e8e11b580d36695cf190843ec2ab46f8351dfc5
SHA512e1ccbf974d7d6f6aedccd73f00ddc1a835b3ac2fdb73fb12ed53b21f665cbfc26c6302354cd284e4f16931883c703a797c3ed2f783a87d49c4add1fb8b2e02e9