Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
16/08/2024, 23:57
Static task
static1
Behavioral task
behavioral1
Sample
b64168671d7aa362fe08a7485610b3a0N.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
b64168671d7aa362fe08a7485610b3a0N.exe
Resource
win10v2004-20240802-en
General
-
Target
b64168671d7aa362fe08a7485610b3a0N.exe
-
Size
1.8MB
-
MD5
b64168671d7aa362fe08a7485610b3a0
-
SHA1
0d984fe9e7910452b24819480b62c6846f2c3f2d
-
SHA256
348bf2be7fc0f19a0bdb1bd029e2ede41bc39fe8ec78a6fecb59c8738663fb94
-
SHA512
547a36612245ed0fa2c19a4b276e571aa6998ee85ec3ec39e6eba6948d8c29866da48ffd5599d5fa877724a363947ac346e9dd7935c0d4bdcb79b803a8f1969a
-
SSDEEP
49152:RNMqQ0kwonLVkZep9nWrPWwONrRoODiGgDWAg2CPaSAnYvJW3BTSXff6YNQVWIPX:RiqQ0kwonLVkZep9nWrPWwONrRoODiGg
Malware Config
Signatures
-
Modifies firewall policy service 3 TTPs 8 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\darkeye-nosttingspersistent.exe = "C:\\Users\\Admin\\AppData\\Roaming\\darkeye-nosttingspersistent.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\Firefox.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Firefox.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe -
Executes dropped EXE 3 IoCs
pid Process 2708 Firefox.exe 2628 Firefox.exe 2748 Firefox.exe -
Loads dropped DLL 7 IoCs
pid Process 1808 b64168671d7aa362fe08a7485610b3a0N.exe 1808 b64168671d7aa362fe08a7485610b3a0N.exe 1808 b64168671d7aa362fe08a7485610b3a0N.exe 1808 b64168671d7aa362fe08a7485610b3a0N.exe 1808 b64168671d7aa362fe08a7485610b3a0N.exe 2708 Firefox.exe 2708 Firefox.exe -
resource yara_rule behavioral1/memory/2628-54-0x0000000000400000-0x000000000045D000-memory.dmp upx behavioral1/memory/2748-60-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral1/memory/2748-59-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral1/memory/2628-55-0x0000000000400000-0x000000000045D000-memory.dmp upx behavioral1/memory/2628-53-0x0000000000400000-0x000000000045D000-memory.dmp upx behavioral1/memory/2748-51-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral1/memory/2628-66-0x0000000000400000-0x000000000045D000-memory.dmp upx behavioral1/memory/2748-67-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral1/memory/2628-68-0x0000000000400000-0x000000000045D000-memory.dmp upx behavioral1/memory/2628-70-0x0000000000400000-0x000000000045D000-memory.dmp upx behavioral1/memory/2628-72-0x0000000000400000-0x000000000045D000-memory.dmp upx behavioral1/memory/2628-75-0x0000000000400000-0x000000000045D000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Windows\CurrentVersion\Run\Java Updater 3 = "C:\\Users\\Admin\\AppData\\Roaming\\Firefox.exe" reg.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2708 set thread context of 2628 2708 Firefox.exe 34 PID 2708 set thread context of 2748 2708 Firefox.exe 35 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 14 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b64168671d7aa362fe08a7485610b3a0N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Firefox.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Firefox.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Firefox.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Modifies registry key 1 TTPs 4 IoCs
pid Process 2496 reg.exe 2500 reg.exe 2612 reg.exe 2328 reg.exe -
Suspicious use of AdjustPrivilegeToken 36 IoCs
description pid Process Token: SeDebugPrivilege 2748 Firefox.exe Token: 1 2628 Firefox.exe Token: SeCreateTokenPrivilege 2628 Firefox.exe Token: SeAssignPrimaryTokenPrivilege 2628 Firefox.exe Token: SeLockMemoryPrivilege 2628 Firefox.exe Token: SeIncreaseQuotaPrivilege 2628 Firefox.exe Token: SeMachineAccountPrivilege 2628 Firefox.exe Token: SeTcbPrivilege 2628 Firefox.exe Token: SeSecurityPrivilege 2628 Firefox.exe Token: SeTakeOwnershipPrivilege 2628 Firefox.exe Token: SeLoadDriverPrivilege 2628 Firefox.exe Token: SeSystemProfilePrivilege 2628 Firefox.exe Token: SeSystemtimePrivilege 2628 Firefox.exe Token: SeProfSingleProcessPrivilege 2628 Firefox.exe Token: SeIncBasePriorityPrivilege 2628 Firefox.exe Token: SeCreatePagefilePrivilege 2628 Firefox.exe Token: SeCreatePermanentPrivilege 2628 Firefox.exe Token: SeBackupPrivilege 2628 Firefox.exe Token: SeRestorePrivilege 2628 Firefox.exe Token: SeShutdownPrivilege 2628 Firefox.exe Token: SeDebugPrivilege 2628 Firefox.exe Token: SeAuditPrivilege 2628 Firefox.exe Token: SeSystemEnvironmentPrivilege 2628 Firefox.exe Token: SeChangeNotifyPrivilege 2628 Firefox.exe Token: SeRemoteShutdownPrivilege 2628 Firefox.exe Token: SeUndockPrivilege 2628 Firefox.exe Token: SeSyncAgentPrivilege 2628 Firefox.exe Token: SeEnableDelegationPrivilege 2628 Firefox.exe Token: SeManageVolumePrivilege 2628 Firefox.exe Token: SeImpersonatePrivilege 2628 Firefox.exe Token: SeCreateGlobalPrivilege 2628 Firefox.exe Token: 31 2628 Firefox.exe Token: 32 2628 Firefox.exe Token: 33 2628 Firefox.exe Token: 34 2628 Firefox.exe Token: 35 2628 Firefox.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1808 b64168671d7aa362fe08a7485610b3a0N.exe 2708 Firefox.exe 2628 Firefox.exe 2748 Firefox.exe 2628 Firefox.exe 2628 Firefox.exe -
Suspicious use of WriteProcessMemory 62 IoCs
description pid Process procid_target PID 1808 wrote to memory of 1904 1808 b64168671d7aa362fe08a7485610b3a0N.exe 30 PID 1808 wrote to memory of 1904 1808 b64168671d7aa362fe08a7485610b3a0N.exe 30 PID 1808 wrote to memory of 1904 1808 b64168671d7aa362fe08a7485610b3a0N.exe 30 PID 1808 wrote to memory of 1904 1808 b64168671d7aa362fe08a7485610b3a0N.exe 30 PID 1904 wrote to memory of 1872 1904 cmd.exe 32 PID 1904 wrote to memory of 1872 1904 cmd.exe 32 PID 1904 wrote to memory of 1872 1904 cmd.exe 32 PID 1904 wrote to memory of 1872 1904 cmd.exe 32 PID 1808 wrote to memory of 2708 1808 b64168671d7aa362fe08a7485610b3a0N.exe 33 PID 1808 wrote to memory of 2708 1808 b64168671d7aa362fe08a7485610b3a0N.exe 33 PID 1808 wrote to memory of 2708 1808 b64168671d7aa362fe08a7485610b3a0N.exe 33 PID 1808 wrote to memory of 2708 1808 b64168671d7aa362fe08a7485610b3a0N.exe 33 PID 2708 wrote to memory of 2628 2708 Firefox.exe 34 PID 2708 wrote to memory of 2628 2708 Firefox.exe 34 PID 2708 wrote to memory of 2628 2708 Firefox.exe 34 PID 2708 wrote to memory of 2628 2708 Firefox.exe 34 PID 2708 wrote to memory of 2628 2708 Firefox.exe 34 PID 2708 wrote to memory of 2628 2708 Firefox.exe 34 PID 2708 wrote to memory of 2628 2708 Firefox.exe 34 PID 2708 wrote to memory of 2628 2708 Firefox.exe 34 PID 2708 wrote to memory of 2628 2708 Firefox.exe 34 PID 2708 wrote to memory of 2748 2708 Firefox.exe 35 PID 2708 wrote to memory of 2748 2708 Firefox.exe 35 PID 2708 wrote to memory of 2748 2708 Firefox.exe 35 PID 2708 wrote to memory of 2748 2708 Firefox.exe 35 PID 2708 wrote to memory of 2748 2708 Firefox.exe 35 PID 2708 wrote to memory of 2748 2708 Firefox.exe 35 PID 2708 wrote to memory of 2748 2708 Firefox.exe 35 PID 2708 wrote to memory of 2748 2708 Firefox.exe 35 PID 2708 wrote to memory of 2748 2708 Firefox.exe 35 PID 2628 wrote to memory of 2632 2628 Firefox.exe 36 PID 2628 wrote to memory of 2632 2628 Firefox.exe 36 PID 2628 wrote to memory of 2632 2628 Firefox.exe 36 PID 2628 wrote to memory of 2632 2628 Firefox.exe 36 PID 2628 wrote to memory of 2692 2628 Firefox.exe 37 PID 2628 wrote to memory of 2692 2628 Firefox.exe 37 PID 2628 wrote to memory of 2692 2628 Firefox.exe 37 PID 2628 wrote to memory of 2692 2628 Firefox.exe 37 PID 2628 wrote to memory of 3048 2628 Firefox.exe 39 PID 2628 wrote to memory of 3048 2628 Firefox.exe 39 PID 2628 wrote to memory of 3048 2628 Firefox.exe 39 PID 2628 wrote to memory of 3048 2628 Firefox.exe 39 PID 2628 wrote to memory of 2780 2628 Firefox.exe 41 PID 2628 wrote to memory of 2780 2628 Firefox.exe 41 PID 2628 wrote to memory of 2780 2628 Firefox.exe 41 PID 2628 wrote to memory of 2780 2628 Firefox.exe 41 PID 2780 wrote to memory of 2328 2780 cmd.exe 44 PID 2780 wrote to memory of 2328 2780 cmd.exe 44 PID 2780 wrote to memory of 2328 2780 cmd.exe 44 PID 2780 wrote to memory of 2328 2780 cmd.exe 44 PID 2692 wrote to memory of 2612 2692 cmd.exe 45 PID 2692 wrote to memory of 2612 2692 cmd.exe 45 PID 2692 wrote to memory of 2612 2692 cmd.exe 45 PID 2692 wrote to memory of 2612 2692 cmd.exe 45 PID 3048 wrote to memory of 2500 3048 cmd.exe 46 PID 3048 wrote to memory of 2500 3048 cmd.exe 46 PID 3048 wrote to memory of 2500 3048 cmd.exe 46 PID 3048 wrote to memory of 2500 3048 cmd.exe 46 PID 2632 wrote to memory of 2496 2632 cmd.exe 47 PID 2632 wrote to memory of 2496 2632 cmd.exe 47 PID 2632 wrote to memory of 2496 2632 cmd.exe 47 PID 2632 wrote to memory of 2496 2632 cmd.exe 47
Processes
-
C:\Users\Admin\AppData\Local\Temp\b64168671d7aa362fe08a7485610b3a0N.exe"C:\Users\Admin\AppData\Local\Temp\b64168671d7aa362fe08a7485610b3a0N.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\pPxNr.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Java Updater 3" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Firefox.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:1872
-
-
-
C:\Users\Admin\AppData\Roaming\Firefox.exe"C:\Users\Admin\AppData\Roaming\Firefox.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Users\Admin\AppData\Roaming\Firefox.exeC:\Users\Admin\AppData\Roaming\Firefox.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f5⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2496
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Firefox.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Firefox.exe:*:Enabled:Windows Messanger" /f4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Firefox.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Firefox.exe:*:Enabled:Windows Messanger" /f5⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2612
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f5⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2500
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\darkeye-nosttingspersistent.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\darkeye-nosttingspersistent.exe:*:Enabled:Windows Messanger" /f4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\darkeye-nosttingspersistent.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\darkeye-nosttingspersistent.exe:*:Enabled:Windows Messanger" /f5⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2328
-
-
-
-
C:\Users\Admin\AppData\Roaming\Firefox.exeC:\Users\Admin\AppData\Roaming\Firefox.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2748
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
143B
MD5962bc493b87f298696ad6e3eed7c7937
SHA1985cc0c7e37e2465c4349abd528e120663ebd205
SHA256c167e2faa5307ac291ff833b8a1f5f802eaa028d1aba8d1ad342ca84c07bdb01
SHA5129dd2b755a404b74206b713ab17d2ddedacc48910e942dab71cf7e98d8d25322c24e32648f0881136e5425134aaccfbfd9bdc52ceb4519bd07e97c5564116f173
-
Filesize
1.8MB
MD5e9c1f91b5b80e27857307e9959eb1a05
SHA1294d70d10c9d07d5ca158ffccb09bc6e62db2c39
SHA25667e268424619668571022dfcc368670c9a6c46261ae4f27ccc2f10446b6742a2
SHA5128cb50732056992d835e5909933f08cd835021c7976937c00eedaffd52222509b6c02b0194ef810a98eead36059d532af3d12f78c311076b7772b13f48d7780a2