Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
06/09/2024, 22:42
Behavioral task
behavioral1
Sample
1783713f0093c0b6ba6112cc6bdae8cd2a91daa19c651efe7e4e4ac2b3fbad25.exe
Resource
win7-20240903-en
General
-
Target
1783713f0093c0b6ba6112cc6bdae8cd2a91daa19c651efe7e4e4ac2b3fbad25.exe
-
Size
12.2MB
-
MD5
c619c99d873652c66f6fed3dde3c651f
-
SHA1
7974b95a82b1bc8e9a856db312f0d40733cd1b41
-
SHA256
1783713f0093c0b6ba6112cc6bdae8cd2a91daa19c651efe7e4e4ac2b3fbad25
-
SHA512
cc487ec97acb036bca68861b33b17ab0cd9fe31b1b954e1d7bfcc0dc781cbb0c42dbef48b906617516d69168a34409d4cbf8b7f3461ffcd9fb6bcf4c2577b8be
-
SSDEEP
196608:RU7Zu+p22zd1QrM36NC0wTVcC1uYove/bkhUlMQoAyfMY:RU78mrQQ36NC0wTVhOqICNoAq
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 1783713f0093c0b6ba6112cc6bdae8cd2a91daa19c651efe7e4e4ac2b3fbad25.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ valrjyxscerz.exe -
XMRig Miner payload 9 IoCs
resource yara_rule behavioral1/memory/2916-44-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral1/memory/2916-46-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral1/memory/2916-47-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral1/memory/2916-45-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral1/memory/2916-43-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral1/memory/2916-40-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral1/memory/2916-39-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral1/memory/2916-48-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral1/memory/2916-49-0x0000000140000000-0x0000000140835000-memory.dmp xmrig -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2836 powershell.exe 2072 powershell.exe -
Creates new service(s) 2 TTPs
-
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 1783713f0093c0b6ba6112cc6bdae8cd2a91daa19c651efe7e4e4ac2b3fbad25.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 1783713f0093c0b6ba6112cc6bdae8cd2a91daa19c651efe7e4e4ac2b3fbad25.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion valrjyxscerz.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion valrjyxscerz.exe -
Deletes itself 1 IoCs
pid Process 1992 cmd.exe -
Executes dropped EXE 2 IoCs
pid Process 476 Process not Found 1664 valrjyxscerz.exe -
Loads dropped DLL 1 IoCs
pid Process 476 Process not Found -
resource yara_rule behavioral1/memory/2112-0-0x0000000140000000-0x0000000140AC9000-memory.dmp themida behavioral1/memory/2112-2-0x0000000140000000-0x0000000140AC9000-memory.dmp themida behavioral1/memory/2112-17-0x0000000140000000-0x0000000140AC9000-memory.dmp themida behavioral1/files/0x0033000000016dd0-20.dat themida behavioral1/memory/1664-21-0x0000000140000000-0x0000000140AC9000-memory.dmp themida behavioral1/memory/1664-42-0x0000000140000000-0x0000000140AC9000-memory.dmp themida -
resource yara_rule behavioral1/memory/2916-35-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral1/memory/2916-34-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral1/memory/2916-44-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral1/memory/2916-46-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral1/memory/2916-47-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral1/memory/2916-45-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral1/memory/2916-43-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral1/memory/2916-40-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral1/memory/2916-39-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral1/memory/2916-36-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral1/memory/2916-33-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral1/memory/2916-38-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral1/memory/2916-48-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral1/memory/2916-49-0x0000000140000000-0x0000000140835000-memory.dmp upx -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 1783713f0093c0b6ba6112cc6bdae8cd2a91daa19c651efe7e4e4ac2b3fbad25.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA valrjyxscerz.exe -
Power Settings 1 TTPs 8 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
pid Process 1728 powercfg.exe 1980 powercfg.exe 2960 powercfg.exe 1296 powercfg.exe 2180 powercfg.exe 2176 powercfg.exe 768 powercfg.exe 680 powercfg.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\system32\MRT.exe 1783713f0093c0b6ba6112cc6bdae8cd2a91daa19c651efe7e4e4ac2b3fbad25.exe File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\system32\MRT.exe valrjyxscerz.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 2112 1783713f0093c0b6ba6112cc6bdae8cd2a91daa19c651efe7e4e4ac2b3fbad25.exe 1664 valrjyxscerz.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1664 set thread context of 2956 1664 valrjyxscerz.exe 86 PID 1664 set thread context of 2916 1664 valrjyxscerz.exe 89 -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\wusa.lock wusa.exe File created C:\Windows\wusa.lock wusa.exe -
Launches sc.exe 14 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2624 sc.exe 1556 sc.exe 1976 sc.exe 2568 sc.exe 2640 sc.exe 2128 sc.exe 1084 sc.exe 884 sc.exe 592 sc.exe 1928 sc.exe 668 sc.exe 2688 sc.exe 2372 sc.exe 2596 sc.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage powershell.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = 5032841dae00db01 powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2112 1783713f0093c0b6ba6112cc6bdae8cd2a91daa19c651efe7e4e4ac2b3fbad25.exe 2836 powershell.exe 2112 1783713f0093c0b6ba6112cc6bdae8cd2a91daa19c651efe7e4e4ac2b3fbad25.exe 2112 1783713f0093c0b6ba6112cc6bdae8cd2a91daa19c651efe7e4e4ac2b3fbad25.exe 2112 1783713f0093c0b6ba6112cc6bdae8cd2a91daa19c651efe7e4e4ac2b3fbad25.exe 2112 1783713f0093c0b6ba6112cc6bdae8cd2a91daa19c651efe7e4e4ac2b3fbad25.exe 2112 1783713f0093c0b6ba6112cc6bdae8cd2a91daa19c651efe7e4e4ac2b3fbad25.exe 2112 1783713f0093c0b6ba6112cc6bdae8cd2a91daa19c651efe7e4e4ac2b3fbad25.exe 2112 1783713f0093c0b6ba6112cc6bdae8cd2a91daa19c651efe7e4e4ac2b3fbad25.exe 2112 1783713f0093c0b6ba6112cc6bdae8cd2a91daa19c651efe7e4e4ac2b3fbad25.exe 2112 1783713f0093c0b6ba6112cc6bdae8cd2a91daa19c651efe7e4e4ac2b3fbad25.exe 2112 1783713f0093c0b6ba6112cc6bdae8cd2a91daa19c651efe7e4e4ac2b3fbad25.exe 2112 1783713f0093c0b6ba6112cc6bdae8cd2a91daa19c651efe7e4e4ac2b3fbad25.exe 2112 1783713f0093c0b6ba6112cc6bdae8cd2a91daa19c651efe7e4e4ac2b3fbad25.exe 2112 1783713f0093c0b6ba6112cc6bdae8cd2a91daa19c651efe7e4e4ac2b3fbad25.exe 2112 1783713f0093c0b6ba6112cc6bdae8cd2a91daa19c651efe7e4e4ac2b3fbad25.exe 2112 1783713f0093c0b6ba6112cc6bdae8cd2a91daa19c651efe7e4e4ac2b3fbad25.exe 1664 valrjyxscerz.exe 2072 powershell.exe 1664 valrjyxscerz.exe 1664 valrjyxscerz.exe 1664 valrjyxscerz.exe 1664 valrjyxscerz.exe 1664 valrjyxscerz.exe 1664 valrjyxscerz.exe 1664 valrjyxscerz.exe 1664 valrjyxscerz.exe 1664 valrjyxscerz.exe 1664 valrjyxscerz.exe 1664 valrjyxscerz.exe 1664 valrjyxscerz.exe 2916 explorer.exe 2916 explorer.exe 2916 explorer.exe 2916 explorer.exe 2916 explorer.exe 2916 explorer.exe 2916 explorer.exe 2916 explorer.exe 2916 explorer.exe 2916 explorer.exe 2916 explorer.exe 2916 explorer.exe 2916 explorer.exe 2916 explorer.exe 2916 explorer.exe 2916 explorer.exe 2916 explorer.exe 2916 explorer.exe 2916 explorer.exe 2916 explorer.exe 2916 explorer.exe 2916 explorer.exe 2916 explorer.exe 2916 explorer.exe 2916 explorer.exe 2916 explorer.exe 2916 explorer.exe 2916 explorer.exe 2916 explorer.exe 2916 explorer.exe 2916 explorer.exe 2916 explorer.exe 2916 explorer.exe -
Suspicious use of AdjustPrivilegeToken 11 IoCs
description pid Process Token: SeDebugPrivilege 2836 powershell.exe Token: SeShutdownPrivilege 1980 powercfg.exe Token: SeShutdownPrivilege 680 powercfg.exe Token: SeShutdownPrivilege 768 powercfg.exe Token: SeShutdownPrivilege 1728 powercfg.exe Token: SeDebugPrivilege 2072 powershell.exe Token: SeShutdownPrivilege 2176 powercfg.exe Token: SeShutdownPrivilege 1296 powercfg.exe Token: SeShutdownPrivilege 2180 powercfg.exe Token: SeShutdownPrivilege 2960 powercfg.exe Token: SeLockMemoryPrivilege 2916 explorer.exe -
Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 2860 wrote to memory of 2768 2860 cmd.exe 38 PID 2860 wrote to memory of 2768 2860 cmd.exe 38 PID 2860 wrote to memory of 2768 2860 cmd.exe 38 PID 1992 wrote to memory of 1656 1992 cmd.exe 63 PID 1992 wrote to memory of 1656 1992 cmd.exe 63 PID 1992 wrote to memory of 1656 1992 cmd.exe 63 PID 2312 wrote to memory of 2444 2312 cmd.exe 71 PID 2312 wrote to memory of 2444 2312 cmd.exe 71 PID 2312 wrote to memory of 2444 2312 cmd.exe 71 PID 1664 wrote to memory of 2956 1664 valrjyxscerz.exe 86 PID 1664 wrote to memory of 2956 1664 valrjyxscerz.exe 86 PID 1664 wrote to memory of 2956 1664 valrjyxscerz.exe 86 PID 1664 wrote to memory of 2956 1664 valrjyxscerz.exe 86 PID 1664 wrote to memory of 2956 1664 valrjyxscerz.exe 86 PID 1664 wrote to memory of 2956 1664 valrjyxscerz.exe 86 PID 1664 wrote to memory of 2956 1664 valrjyxscerz.exe 86 PID 1664 wrote to memory of 2956 1664 valrjyxscerz.exe 86 PID 1664 wrote to memory of 2956 1664 valrjyxscerz.exe 86 PID 1664 wrote to memory of 2916 1664 valrjyxscerz.exe 89 PID 1664 wrote to memory of 2916 1664 valrjyxscerz.exe 89 PID 1664 wrote to memory of 2916 1664 valrjyxscerz.exe 89 PID 1664 wrote to memory of 2916 1664 valrjyxscerz.exe 89 PID 1664 wrote to memory of 2916 1664 valrjyxscerz.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\1783713f0093c0b6ba6112cc6bdae8cd2a91daa19c651efe7e4e4ac2b3fbad25.exe"C:\Users\Admin\AppData\Local\Temp\1783713f0093c0b6ba6112cc6bdae8cd2a91daa19c651efe7e4e4ac2b3fbad25.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2112 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2836
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵
- Drops file in Windows directory
PID:2768
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
PID:2596
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
PID:2688
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
PID:2568
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
PID:2640
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
PID:2624
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:1980
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:1728
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:680
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:768
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "SZPNAYYI"2⤵
- Launches sc.exe
PID:884
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "SZPNAYYI" binpath= "C:\ProgramData\bcxdqylpudnd\valrjyxscerz.exe" start= "auto"2⤵
- Launches sc.exe
PID:592
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog2⤵
- Launches sc.exe
PID:2372
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "SZPNAYYI"2⤵
- Launches sc.exe
PID:1556
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\1783713f0093c0b6ba6112cc6bdae8cd2a91daa19c651efe7e4e4ac2b3fbad25.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:1656
-
-
-
C:\ProgramData\bcxdqylpudnd\valrjyxscerz.exeC:\ProgramData\bcxdqylpudnd\valrjyxscerz.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2072
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵
- Drops file in Windows directory
PID:2444
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
PID:1976
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
PID:668
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
PID:1084
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
PID:2128
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
PID:1928
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2176
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2180
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:1296
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2960
-
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵PID:2956
-
-
C:\Windows\explorer.exeexplorer.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2916
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12.2MB
MD5c619c99d873652c66f6fed3dde3c651f
SHA17974b95a82b1bc8e9a856db312f0d40733cd1b41
SHA2561783713f0093c0b6ba6112cc6bdae8cd2a91daa19c651efe7e4e4ac2b3fbad25
SHA512cc487ec97acb036bca68861b33b17ab0cd9fe31b1b954e1d7bfcc0dc781cbb0c42dbef48b906617516d69168a34409d4cbf8b7f3461ffcd9fb6bcf4c2577b8be