Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
102s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
18/08/2024, 00:42
Behavioral task
behavioral1
Sample
b35035bbd115f5f28813d27c854f5bf0N.exe
Resource
win7-20240704-en
windows7-x64
15 signatures
120 seconds
Behavioral task
behavioral2
Sample
b35035bbd115f5f28813d27c854f5bf0N.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
14 signatures
120 seconds
General
-
Target
b35035bbd115f5f28813d27c854f5bf0N.exe
-
Size
33KB
-
MD5
b35035bbd115f5f28813d27c854f5bf0
-
SHA1
14a3982401ea7bb7070763854fa3f26165b0364d
-
SHA256
693219a75775769bc379b9179c3e7e87fe9058d9e10acf15372657a37df7f3f1
-
SHA512
aaf62b99ad99ee085f62b172588354ba33abddc3bbf32c2d3e4c3211aa848fbe1de1631425074bb4178d2a77e9d77d0c0878f0f27ecf14f75a2655a144287b3b
-
SSDEEP
768:tQbuQRy2UjmUndnlTttxDn+3jiSkjRY6AB7kKfYoJ+ifBEewzKO5/V:QuQRylaUDTDxDXjy6AB7koYy2T/
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "24064" obxetok-osor.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "24064" obxetok-osor.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "24064" obxetok-osor.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "24064" obxetok-osor.exe -
Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4F415244-4847-444e-4F41-52444847444e}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a" obxetok-osor.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4F415244-4847-444e-4F41-52444847444e}\IsInstalled = "1" obxetok-osor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4F415244-4847-444e-4F41-52444847444e}\StubPath = "C:\\Windows\\system32\\arxoopid-adoab.exe" obxetok-osor.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4F415244-4847-444e-4F41-52444847444e} obxetok-osor.exe -
Event Triggered Execution: Image File Execution Options Injection 1 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe obxetok-osor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a" obxetok-osor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\bvufuc-ucom.exe" obxetok-osor.exe -
Executes dropped EXE 2 IoCs
pid Process 2544 obxetok-osor.exe 2944 obxetok-osor.exe -
resource yara_rule behavioral2/memory/3428-0-0x0000000000400000-0x0000000000417000-memory.dmp upx behavioral2/files/0x00090000000233db-8.dat upx behavioral2/memory/3428-7-0x0000000000400000-0x0000000000417000-memory.dmp upx behavioral2/memory/2544-42-0x0000000000400000-0x0000000000417000-memory.dmp upx behavioral2/memory/2944-47-0x0000000000400000-0x0000000000417000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "24064" obxetok-osor.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "24064" obxetok-osor.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "24064" obxetok-osor.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "24064" obxetok-osor.exe -
description ioc Process Delete value \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger obxetok-osor.exe -
Modifies WinLogon 2 TTPs 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B} obxetok-osor.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify obxetok-osor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a" obxetok-osor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\ohpifec-ubac.dll" obxetok-osor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup" obxetok-osor.exe -
Drops file in System32 directory 17 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\aset32.exe obxetok-osor.exe File opened for modification C:\Windows\SysWOW64\ntdbg.exe obxetok-osor.exe File opened for modification C:\Windows\SysWOW64\bvufuc-ucom.exe obxetok-osor.exe File created C:\Windows\SysWOW64\bvufuc-ucom.exe obxetok-osor.exe File opened for modification C:\Windows\SysWOW64\ohpifec-ubac.dll obxetok-osor.exe File created C:\Windows\SysWOW64\ohpifec-ubac.dll obxetok-osor.exe File opened for modification C:\Windows\SysWOW64\winrnt.exe obxetok-osor.exe File opened for modification C:\Windows\SysWOW64\rmass.exe obxetok-osor.exe File opened for modification C:\Windows\SysWOW64\gymspzd.dll obxetok-osor.exe File opened for modification C:\Windows\SysWOW64\idbg32.exe obxetok-osor.exe File opened for modification C:\Windows\SysWOW64\obxetok-osor.exe obxetok-osor.exe File created C:\Windows\SysWOW64\obxetok-osor.exe b35035bbd115f5f28813d27c854f5bf0N.exe File opened for modification C:\Windows\SysWOW64\arxoopid-adoab.exe obxetok-osor.exe File created C:\Windows\SysWOW64\arxoopid-adoab.exe obxetok-osor.exe File opened for modification C:\Windows\SysWOW64\ahuy.exe obxetok-osor.exe File opened for modification C:\Windows\SysWOW64\obxetok-osor.exe b35035bbd115f5f28813d27c854f5bf0N.exe File opened for modification C:\Windows\SysWOW64\RECOVER32.DLL obxetok-osor.exe -
Drops file in Program Files directory 8 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Common Files\System\idbg32.exe obxetok-osor.exe File opened for modification C:\Program Files (x86)\Common Files\System\ntdbg.exe obxetok-osor.exe File opened for modification C:\Program Files (x86)\Common Files\System\RECOVER32.DLL obxetok-osor.exe File opened for modification C:\Program Files (x86)\Common Files\System\gymspzd.dll obxetok-osor.exe File opened for modification C:\Program Files (x86)\Common Files\System\winrnt.exe obxetok-osor.exe File opened for modification C:\Program Files (x86)\Common Files\System\rmass.exe obxetok-osor.exe File opened for modification C:\Program Files (x86)\Common Files\System\aset32.exe obxetok-osor.exe File opened for modification C:\Program Files (x86)\Common Files\System\ahuy.exe obxetok-osor.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b35035bbd115f5f28813d27c854f5bf0N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language obxetok-osor.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language obxetok-osor.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2544 obxetok-osor.exe 2544 obxetok-osor.exe 2544 obxetok-osor.exe 2544 obxetok-osor.exe 2544 obxetok-osor.exe 2544 obxetok-osor.exe 2544 obxetok-osor.exe 2544 obxetok-osor.exe 2944 obxetok-osor.exe 2944 obxetok-osor.exe 2544 obxetok-osor.exe 2544 obxetok-osor.exe 2544 obxetok-osor.exe 2544 obxetok-osor.exe 2544 obxetok-osor.exe 2544 obxetok-osor.exe 2544 obxetok-osor.exe 2544 obxetok-osor.exe 2544 obxetok-osor.exe 2544 obxetok-osor.exe 2544 obxetok-osor.exe 2544 obxetok-osor.exe 2544 obxetok-osor.exe 2544 obxetok-osor.exe 2544 obxetok-osor.exe 2544 obxetok-osor.exe 2544 obxetok-osor.exe 2544 obxetok-osor.exe 2544 obxetok-osor.exe 2544 obxetok-osor.exe 2544 obxetok-osor.exe 2544 obxetok-osor.exe 2544 obxetok-osor.exe 2544 obxetok-osor.exe 2544 obxetok-osor.exe 2544 obxetok-osor.exe 2544 obxetok-osor.exe 2544 obxetok-osor.exe 2544 obxetok-osor.exe 2544 obxetok-osor.exe 2544 obxetok-osor.exe 2544 obxetok-osor.exe 2544 obxetok-osor.exe 2544 obxetok-osor.exe 2544 obxetok-osor.exe 2544 obxetok-osor.exe 2544 obxetok-osor.exe 2544 obxetok-osor.exe 2544 obxetok-osor.exe 2544 obxetok-osor.exe 2544 obxetok-osor.exe 2544 obxetok-osor.exe 2544 obxetok-osor.exe 2544 obxetok-osor.exe 2544 obxetok-osor.exe 2544 obxetok-osor.exe 2544 obxetok-osor.exe 2544 obxetok-osor.exe 2544 obxetok-osor.exe 2544 obxetok-osor.exe 2544 obxetok-osor.exe 2544 obxetok-osor.exe 2544 obxetok-osor.exe 2544 obxetok-osor.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3428 b35035bbd115f5f28813d27c854f5bf0N.exe Token: SeDebugPrivilege 2544 obxetok-osor.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3428 wrote to memory of 2544 3428 b35035bbd115f5f28813d27c854f5bf0N.exe 84 PID 3428 wrote to memory of 2544 3428 b35035bbd115f5f28813d27c854f5bf0N.exe 84 PID 3428 wrote to memory of 2544 3428 b35035bbd115f5f28813d27c854f5bf0N.exe 84 PID 2544 wrote to memory of 2944 2544 obxetok-osor.exe 85 PID 2544 wrote to memory of 2944 2544 obxetok-osor.exe 85 PID 2544 wrote to memory of 2944 2544 obxetok-osor.exe 85 PID 2544 wrote to memory of 616 2544 obxetok-osor.exe 5 PID 2544 wrote to memory of 3444 2544 obxetok-osor.exe 56 PID 2544 wrote to memory of 3444 2544 obxetok-osor.exe 56 PID 2544 wrote to memory of 3444 2544 obxetok-osor.exe 56 PID 2544 wrote to memory of 3444 2544 obxetok-osor.exe 56 PID 2544 wrote to memory of 3444 2544 obxetok-osor.exe 56 PID 2544 wrote to memory of 3444 2544 obxetok-osor.exe 56 PID 2544 wrote to memory of 3444 2544 obxetok-osor.exe 56 PID 2544 wrote to memory of 3444 2544 obxetok-osor.exe 56 PID 2544 wrote to memory of 3444 2544 obxetok-osor.exe 56 PID 2544 wrote to memory of 3444 2544 obxetok-osor.exe 56 PID 2544 wrote to memory of 3444 2544 obxetok-osor.exe 56 PID 2544 wrote to memory of 3444 2544 obxetok-osor.exe 56 PID 2544 wrote to memory of 3444 2544 obxetok-osor.exe 56 PID 2544 wrote to memory of 3444 2544 obxetok-osor.exe 56 PID 2544 wrote to memory of 3444 2544 obxetok-osor.exe 56 PID 2544 wrote to memory of 3444 2544 obxetok-osor.exe 56 PID 2544 wrote to memory of 3444 2544 obxetok-osor.exe 56 PID 2544 wrote to memory of 3444 2544 obxetok-osor.exe 56 PID 2544 wrote to memory of 3444 2544 obxetok-osor.exe 56 PID 2544 wrote to memory of 3444 2544 obxetok-osor.exe 56 PID 2544 wrote to memory of 3444 2544 obxetok-osor.exe 56 PID 2544 wrote to memory of 3444 2544 obxetok-osor.exe 56 PID 2544 wrote to memory of 3444 2544 obxetok-osor.exe 56 PID 2544 wrote to memory of 3444 2544 obxetok-osor.exe 56 PID 2544 wrote to memory of 3444 2544 obxetok-osor.exe 56 PID 2544 wrote to memory of 3444 2544 obxetok-osor.exe 56 PID 2544 wrote to memory of 3444 2544 obxetok-osor.exe 56 PID 2544 wrote to memory of 3444 2544 obxetok-osor.exe 56 PID 2544 wrote to memory of 3444 2544 obxetok-osor.exe 56 PID 2544 wrote to memory of 3444 2544 obxetok-osor.exe 56 PID 2544 wrote to memory of 3444 2544 obxetok-osor.exe 56 PID 2544 wrote to memory of 3444 2544 obxetok-osor.exe 56 PID 2544 wrote to memory of 3444 2544 obxetok-osor.exe 56 PID 2544 wrote to memory of 3444 2544 obxetok-osor.exe 56 PID 2544 wrote to memory of 3444 2544 obxetok-osor.exe 56 PID 2544 wrote to memory of 3444 2544 obxetok-osor.exe 56 PID 2544 wrote to memory of 3444 2544 obxetok-osor.exe 56 PID 2544 wrote to memory of 3444 2544 obxetok-osor.exe 56 PID 2544 wrote to memory of 3444 2544 obxetok-osor.exe 56 PID 2544 wrote to memory of 3444 2544 obxetok-osor.exe 56 PID 2544 wrote to memory of 3444 2544 obxetok-osor.exe 56 PID 2544 wrote to memory of 3444 2544 obxetok-osor.exe 56 PID 2544 wrote to memory of 3444 2544 obxetok-osor.exe 56 PID 2544 wrote to memory of 3444 2544 obxetok-osor.exe 56 PID 2544 wrote to memory of 3444 2544 obxetok-osor.exe 56 PID 2544 wrote to memory of 3444 2544 obxetok-osor.exe 56 PID 2544 wrote to memory of 3444 2544 obxetok-osor.exe 56 PID 2544 wrote to memory of 3444 2544 obxetok-osor.exe 56 PID 2544 wrote to memory of 3444 2544 obxetok-osor.exe 56 PID 2544 wrote to memory of 3444 2544 obxetok-osor.exe 56 PID 2544 wrote to memory of 3444 2544 obxetok-osor.exe 56 PID 2544 wrote to memory of 3444 2544 obxetok-osor.exe 56 PID 2544 wrote to memory of 3444 2544 obxetok-osor.exe 56 PID 2544 wrote to memory of 3444 2544 obxetok-osor.exe 56 PID 2544 wrote to memory of 3444 2544 obxetok-osor.exe 56 PID 2544 wrote to memory of 3444 2544 obxetok-osor.exe 56 PID 2544 wrote to memory of 3444 2544 obxetok-osor.exe 56
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:616
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3444
-
C:\Users\Admin\AppData\Local\Temp\b35035bbd115f5f28813d27c854f5bf0N.exe"C:\Users\Admin\AppData\Local\Temp\b35035bbd115f5f28813d27c854f5bf0N.exe"2⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3428 -
C:\Windows\SysWOW64\obxetok-osor.exe"C:\Windows\system32\obxetok-osor.exe"3⤵
- Windows security bypass
- Boot or Logon Autostart Execution: Active Setup
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Windows security modification
- Indicator Removal: Clear Persistence
- Modifies WinLogon
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Windows\SysWOW64\obxetok-osor.exe--k33p4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2944
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Winlogon Helper DLL
1Event Triggered Execution
1Image File Execution Options Injection
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Winlogon Helper DLL
1Event Triggered Execution
1Image File Execution Options Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
36KB
MD585ed60514c3c020f238b85a50dac05c1
SHA173908c404c35e1c882434ce0b69543c22e513d24
SHA256e50a23af623f1baee724e528de5b8c19c370c5ebe702b7e6addf3fd0e714d126
SHA5124edd7f6149153932e5dd9a5e4f5b82929c36f6a2b3fab4f6c2df75a5b8983dcf964f8541b95e780a444ed3ae9fda7607c3dbe07191b8d24b9a751a8d6658f839
-
Filesize
37KB
MD5355168d8073d6e9496f4c0ee9e00c6a7
SHA1dc593fd306395693a0bdf6bf2b773e848dfe1afb
SHA256945082184ab3b1b33db14c876d911214c4761fa96917f6032e70cab69ca35fc9
SHA512b8c13f1d10f44a220bd9b27c5c6e2751132aadb75dac661bd2730141df5a73cbfa39efe42b046b18b7c7d3e43c32c00451ad446984496a3203ceaf777c1be519
-
Filesize
33KB
MD5b35035bbd115f5f28813d27c854f5bf0
SHA114a3982401ea7bb7070763854fa3f26165b0364d
SHA256693219a75775769bc379b9179c3e7e87fe9058d9e10acf15372657a37df7f3f1
SHA512aaf62b99ad99ee085f62b172588354ba33abddc3bbf32c2d3e4c3211aa848fbe1de1631425074bb4178d2a77e9d77d0c0878f0f27ecf14f75a2655a144287b3b
-
Filesize
5KB
MD5c8521a5fdd1c9387d536f599d850b195
SHA1a543080665107b7e32bcc1ed19dbfbc1d2931356
SHA256fa8f77b6daf775d66de9d27c1d896168a792057358e518c00e72b8964b966ca5
SHA512541500e2cd502852a007d29badc1a1848d187245f78ec272281bab290cc6e308f0ae6d1b96863e0c30a176b16c6cf7e63e08a8de81a84615e4710e7164a805cd