Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
05/08/2024, 18:25
240805-w2sftsxhlf 1005/08/2024, 18:19
240805-wybznstglq 1004/08/2024, 18:22
240804-wzvs6ssamq 10Analysis
-
max time kernel
40s -
max time network
41s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
04/08/2024, 18:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
753d66621ae168b5968406b8c2ad1845f1c9bf42f47556e7646d14e8484adeb8.exe
Resource
win7-20240704-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
753d66621ae168b5968406b8c2ad1845f1c9bf42f47556e7646d14e8484adeb8.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
15 signatures
150 seconds
General
-
Target
753d66621ae168b5968406b8c2ad1845f1c9bf42f47556e7646d14e8484adeb8.exe
-
Size
474KB
-
MD5
ce49656e048c43c60317431abd383dff
-
SHA1
1f84d9865cfb08aeff1f995bc1eb90a6d87a0d9d
-
SHA256
753d66621ae168b5968406b8c2ad1845f1c9bf42f47556e7646d14e8484adeb8
-
SHA512
070385029413bb7d8ce31e235ae6800d69fe1070596a5886b23e9b65c0eaf26bd70203afdf99ef369e4bab39ed850fcd991eb0bdf74224bf873d47ecde120fdc
-
SSDEEP
6144:Ezv+ezl2A8GuozDKJDe6VlWT8b9IeArZCh3Z64sgmo9VkGIb3yuaPIPXb:ET+TfWzDKJDPVle8mvrZgmUmVam
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Windows\\TrustedInstaller.exe" 753d66621ae168b5968406b8c2ad1845f1c9bf42f47556e7646d14e8484adeb8.exe -
Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
-
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
-
Loads dropped DLL 4 IoCs
pid Process 4920 Process not Found 2924 WmiApSrv.exe 3640 Process not Found 4936 svchost.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\TrustedInstaller.exe 753d66621ae168b5968406b8c2ad1845f1c9bf42f47556e7646d14e8484adeb8.exe File opened for modification C:\Windows\TrustedInstaller.exe 753d66621ae168b5968406b8c2ad1845f1c9bf42f47556e7646d14e8484adeb8.exe File created C:\Windows\xdwd.dll 753d66621ae168b5968406b8c2ad1845f1c9bf42f47556e7646d14e8484adeb8.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3148 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 2244 753d66621ae168b5968406b8c2ad1845f1c9bf42f47556e7646d14e8484adeb8.exe 2244 753d66621ae168b5968406b8c2ad1845f1c9bf42f47556e7646d14e8484adeb8.exe 2244 753d66621ae168b5968406b8c2ad1845f1c9bf42f47556e7646d14e8484adeb8.exe 2244 753d66621ae168b5968406b8c2ad1845f1c9bf42f47556e7646d14e8484adeb8.exe 2244 753d66621ae168b5968406b8c2ad1845f1c9bf42f47556e7646d14e8484adeb8.exe 2244 753d66621ae168b5968406b8c2ad1845f1c9bf42f47556e7646d14e8484adeb8.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 2244 753d66621ae168b5968406b8c2ad1845f1c9bf42f47556e7646d14e8484adeb8.exe 2244 753d66621ae168b5968406b8c2ad1845f1c9bf42f47556e7646d14e8484adeb8.exe 2244 753d66621ae168b5968406b8c2ad1845f1c9bf42f47556e7646d14e8484adeb8.exe 2244 753d66621ae168b5968406b8c2ad1845f1c9bf42f47556e7646d14e8484adeb8.exe 2244 753d66621ae168b5968406b8c2ad1845f1c9bf42f47556e7646d14e8484adeb8.exe 2244 753d66621ae168b5968406b8c2ad1845f1c9bf42f47556e7646d14e8484adeb8.exe 2244 753d66621ae168b5968406b8c2ad1845f1c9bf42f47556e7646d14e8484adeb8.exe 2244 753d66621ae168b5968406b8c2ad1845f1c9bf42f47556e7646d14e8484adeb8.exe 2244 753d66621ae168b5968406b8c2ad1845f1c9bf42f47556e7646d14e8484adeb8.exe 2244 753d66621ae168b5968406b8c2ad1845f1c9bf42f47556e7646d14e8484adeb8.exe 2244 753d66621ae168b5968406b8c2ad1845f1c9bf42f47556e7646d14e8484adeb8.exe 2244 753d66621ae168b5968406b8c2ad1845f1c9bf42f47556e7646d14e8484adeb8.exe 2244 753d66621ae168b5968406b8c2ad1845f1c9bf42f47556e7646d14e8484adeb8.exe 2244 753d66621ae168b5968406b8c2ad1845f1c9bf42f47556e7646d14e8484adeb8.exe 2244 753d66621ae168b5968406b8c2ad1845f1c9bf42f47556e7646d14e8484adeb8.exe 2244 753d66621ae168b5968406b8c2ad1845f1c9bf42f47556e7646d14e8484adeb8.exe 2244 753d66621ae168b5968406b8c2ad1845f1c9bf42f47556e7646d14e8484adeb8.exe 2244 753d66621ae168b5968406b8c2ad1845f1c9bf42f47556e7646d14e8484adeb8.exe 2244 753d66621ae168b5968406b8c2ad1845f1c9bf42f47556e7646d14e8484adeb8.exe 2244 753d66621ae168b5968406b8c2ad1845f1c9bf42f47556e7646d14e8484adeb8.exe 2244 753d66621ae168b5968406b8c2ad1845f1c9bf42f47556e7646d14e8484adeb8.exe 2924 WmiApSrv.exe 2924 WmiApSrv.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4016 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 11 IoCs
description pid Process Token: SeDebugPrivilege 2244 753d66621ae168b5968406b8c2ad1845f1c9bf42f47556e7646d14e8484adeb8.exe Token: SeDebugPrivilege 4016 taskmgr.exe Token: SeSystemProfilePrivilege 4016 taskmgr.exe Token: SeCreateGlobalPrivilege 4016 taskmgr.exe Token: SeSecurityPrivilege 4016 taskmgr.exe Token: SeTakeOwnershipPrivilege 4016 taskmgr.exe Token: SeBackupPrivilege 4936 svchost.exe Token: SeRestorePrivilege 4936 svchost.exe Token: SeSecurityPrivilege 4936 svchost.exe Token: SeTakeOwnershipPrivilege 4936 svchost.exe Token: 35 4936 svchost.exe -
Suspicious use of FindShellTrayWindow 48 IoCs
pid Process 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe -
Suspicious use of SendNotifyMessage 48 IoCs
pid Process 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe 4016 taskmgr.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2244 wrote to memory of 1840 2244 753d66621ae168b5968406b8c2ad1845f1c9bf42f47556e7646d14e8484adeb8.exe 91 PID 2244 wrote to memory of 1840 2244 753d66621ae168b5968406b8c2ad1845f1c9bf42f47556e7646d14e8484adeb8.exe 91 PID 1840 wrote to memory of 3148 1840 CMD.exe 93 PID 1840 wrote to memory of 3148 1840 CMD.exe 93 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\753d66621ae168b5968406b8c2ad1845f1c9bf42f47556e7646d14e8484adeb8.exe"C:\Users\Admin\AppData\Local\Temp\753d66621ae168b5968406b8c2ad1845f1c9bf42f47556e7646d14e8484adeb8.exe"1⤵
- Modifies WinLogon for persistence
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Windows\SYSTEM32\CMD.exe"CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "TrustedInstall" /tr "C:\Windows\TrustedInstaller.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\Windows\system32\schtasks.exeSchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "TrustedInstall" /tr "C:\Windows\TrustedInstaller.exe"3⤵
- Scheduled Task/Job: Scheduled Task
PID:3148
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4016
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:2924
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SDRSVC1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:4936
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Event Triggered Execution
1AppInit DLLs
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Event Triggered Execution
1AppInit DLLs
1Scheduled Task/Job
1Scheduled Task
1Credential Access
Credentials from Password Stores
1Windows Credential Manager
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
136KB
MD516e5a492c9c6ae34c59683be9c51fa31
SHA197031b41f5c56f371c28ae0d62a2df7d585adaba
SHA25635c8d022e1d917f1aabdceae98097ccc072161b302f84c768ca63e4b32ac2b66
SHA51220fd369172ef5e3e2fde388666b42e8fe5f0c2bfa338c0345f45e98af6561a249ba3ecc48c3f16efcc73f02ecb67b3ddb1e2e8f0e77d18fa00ac34e6379e50b6