Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
87s -
max time network
103s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
13/09/2024, 02:42
Static task
static1
Behavioral task
behavioral1
Sample
ce1b63640a790ae744465f4da7af75d0N.exe
Resource
win7-20240903-en
General
-
Target
ce1b63640a790ae744465f4da7af75d0N.exe
-
Size
5.3MB
-
MD5
ce1b63640a790ae744465f4da7af75d0
-
SHA1
dde7e919e329826d2bc0d2ff4ba01005ba48c52d
-
SHA256
d4c216bab338d7fa68e1b13e9eb4d63dc2360fd7403527834e6a4aed4fbfaf40
-
SHA512
aee4591fd5c0c477f577416a35ba2080cbb2d482efc5d5fc509761054495316cd41f6f97a30c999de36f6f5cda7a5d093add244d2e0a9b6210d152bd8793e741
-
SSDEEP
98304:34Gr/W2hRkTwVNt6MkTi+XAVd18EjU6+cVX6IwUu:3jr/TMwVNtaP4KEjl6S
Malware Config
Signatures
-
XMRig Miner payload 8 IoCs
resource yara_rule behavioral1/memory/1008-38-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/1008-37-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/1008-36-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/1008-35-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/1008-31-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/1008-34-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/1008-32-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/1008-39-0x0000000140000000-0x0000000140848000-memory.dmp xmrig -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2364 powershell.exe 1276 powershell.exe -
Creates new service(s) 2 TTPs
-
Deletes itself 1 IoCs
pid Process 600 cmd.exe -
Executes dropped EXE 2 IoCs
pid Process 476 Process not Found 2932 dddbhxbblxrl.exe -
Loads dropped DLL 1 IoCs
pid Process 476 Process not Found -
resource yara_rule behavioral1/memory/1008-30-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/1008-38-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/1008-37-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/1008-36-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/1008-35-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/1008-31-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/1008-26-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/1008-24-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/1008-34-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/1008-29-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/1008-25-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/1008-32-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/1008-39-0x0000000140000000-0x0000000140848000-memory.dmp upx -
Power Settings 1 TTPs 8 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
pid Process 2672 powercfg.exe 2564 powercfg.exe 2616 powercfg.exe 2176 powercfg.exe 1028 powercfg.exe 872 powercfg.exe 2452 powercfg.exe 1556 powercfg.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\system32\MRT.exe ce1b63640a790ae744465f4da7af75d0N.exe File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\system32\MRT.exe dddbhxbblxrl.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2932 set thread context of 2056 2932 dddbhxbblxrl.exe 87 PID 2932 set thread context of 1008 2932 dddbhxbblxrl.exe 90 -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\wusa.lock wusa.exe File created C:\Windows\wusa.lock wusa.exe -
Launches sc.exe 14 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 1808 sc.exe 2580 sc.exe 2904 sc.exe 1988 sc.exe 844 sc.exe 2688 sc.exe 2916 sc.exe 2768 sc.exe 2568 sc.exe 2140 sc.exe 1488 sc.exe 2824 sc.exe 2008 sc.exe 2868 sc.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage powershell.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = 507676918605db01 powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2076 ce1b63640a790ae744465f4da7af75d0N.exe 2364 powershell.exe 2076 ce1b63640a790ae744465f4da7af75d0N.exe 2076 ce1b63640a790ae744465f4da7af75d0N.exe 2076 ce1b63640a790ae744465f4da7af75d0N.exe 2076 ce1b63640a790ae744465f4da7af75d0N.exe 2076 ce1b63640a790ae744465f4da7af75d0N.exe 2076 ce1b63640a790ae744465f4da7af75d0N.exe 2076 ce1b63640a790ae744465f4da7af75d0N.exe 2076 ce1b63640a790ae744465f4da7af75d0N.exe 2076 ce1b63640a790ae744465f4da7af75d0N.exe 2076 ce1b63640a790ae744465f4da7af75d0N.exe 2076 ce1b63640a790ae744465f4da7af75d0N.exe 2076 ce1b63640a790ae744465f4da7af75d0N.exe 2076 ce1b63640a790ae744465f4da7af75d0N.exe 2076 ce1b63640a790ae744465f4da7af75d0N.exe 2076 ce1b63640a790ae744465f4da7af75d0N.exe 2932 dddbhxbblxrl.exe 1276 powershell.exe 2932 dddbhxbblxrl.exe 2932 dddbhxbblxrl.exe 2932 dddbhxbblxrl.exe 2932 dddbhxbblxrl.exe 2932 dddbhxbblxrl.exe 2932 dddbhxbblxrl.exe 2932 dddbhxbblxrl.exe 2932 dddbhxbblxrl.exe 2932 dddbhxbblxrl.exe 2932 dddbhxbblxrl.exe 2932 dddbhxbblxrl.exe 2932 dddbhxbblxrl.exe 1008 nslookup.exe 1008 nslookup.exe 1008 nslookup.exe 1008 nslookup.exe 1008 nslookup.exe 1008 nslookup.exe 1008 nslookup.exe 1008 nslookup.exe 1008 nslookup.exe 1008 nslookup.exe 1008 nslookup.exe 1008 nslookup.exe 1008 nslookup.exe 1008 nslookup.exe 1008 nslookup.exe 1008 nslookup.exe 1008 nslookup.exe 1008 nslookup.exe 1008 nslookup.exe 1008 nslookup.exe 1008 nslookup.exe 1008 nslookup.exe 1008 nslookup.exe 1008 nslookup.exe 1008 nslookup.exe 1008 nslookup.exe 1008 nslookup.exe 1008 nslookup.exe 1008 nslookup.exe 1008 nslookup.exe 1008 nslookup.exe 1008 nslookup.exe 1008 nslookup.exe -
Suspicious use of AdjustPrivilegeToken 11 IoCs
description pid Process Token: SeDebugPrivilege 2364 powershell.exe Token: SeShutdownPrivilege 1556 powercfg.exe Token: SeShutdownPrivilege 2672 powercfg.exe Token: SeShutdownPrivilege 2564 powercfg.exe Token: SeShutdownPrivilege 2616 powercfg.exe Token: SeDebugPrivilege 1276 powershell.exe Token: SeShutdownPrivilege 2452 powercfg.exe Token: SeShutdownPrivilege 1028 powercfg.exe Token: SeLockMemoryPrivilege 1008 nslookup.exe Token: SeShutdownPrivilege 2176 powercfg.exe Token: SeShutdownPrivilege 872 powercfg.exe -
Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 2700 wrote to memory of 2860 2700 cmd.exe 37 PID 2700 wrote to memory of 2860 2700 cmd.exe 37 PID 2700 wrote to memory of 2860 2700 cmd.exe 37 PID 600 wrote to memory of 2888 600 cmd.exe 64 PID 600 wrote to memory of 2888 600 cmd.exe 64 PID 600 wrote to memory of 2888 600 cmd.exe 64 PID 2756 wrote to memory of 1144 2756 cmd.exe 73 PID 2756 wrote to memory of 1144 2756 cmd.exe 73 PID 2756 wrote to memory of 1144 2756 cmd.exe 73 PID 2932 wrote to memory of 2056 2932 dddbhxbblxrl.exe 87 PID 2932 wrote to memory of 2056 2932 dddbhxbblxrl.exe 87 PID 2932 wrote to memory of 2056 2932 dddbhxbblxrl.exe 87 PID 2932 wrote to memory of 2056 2932 dddbhxbblxrl.exe 87 PID 2932 wrote to memory of 2056 2932 dddbhxbblxrl.exe 87 PID 2932 wrote to memory of 2056 2932 dddbhxbblxrl.exe 87 PID 2932 wrote to memory of 2056 2932 dddbhxbblxrl.exe 87 PID 2932 wrote to memory of 2056 2932 dddbhxbblxrl.exe 87 PID 2932 wrote to memory of 2056 2932 dddbhxbblxrl.exe 87 PID 2932 wrote to memory of 1008 2932 dddbhxbblxrl.exe 90 PID 2932 wrote to memory of 1008 2932 dddbhxbblxrl.exe 90 PID 2932 wrote to memory of 1008 2932 dddbhxbblxrl.exe 90 PID 2932 wrote to memory of 1008 2932 dddbhxbblxrl.exe 90 PID 2932 wrote to memory of 1008 2932 dddbhxbblxrl.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\ce1b63640a790ae744465f4da7af75d0N.exe"C:\Users\Admin\AppData\Local\Temp\ce1b63640a790ae744465f4da7af75d0N.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2076 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2364
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵
- Drops file in Windows directory
PID:2860
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
PID:2688
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
PID:2868
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
PID:2568
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
PID:2904
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
PID:2916
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:1556
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2616
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2672
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2564
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "NCUDPJVW"2⤵
- Launches sc.exe
PID:2580
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "NCUDPJVW" binpath= "C:\ProgramData\eowgjsemsmrx\dddbhxbblxrl.exe" start= "auto"2⤵
- Launches sc.exe
PID:2140
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog2⤵
- Launches sc.exe
PID:1808
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "NCUDPJVW"2⤵
- Launches sc.exe
PID:1488
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\ce1b63640a790ae744465f4da7af75d0N.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:600 -
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:2888
-
-
-
C:\ProgramData\eowgjsemsmrx\dddbhxbblxrl.exeC:\ProgramData\eowgjsemsmrx\dddbhxbblxrl.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1276
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵
- Drops file in Windows directory
PID:1144
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
PID:2768
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
PID:2824
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
PID:1988
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
PID:2008
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
PID:844
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2176
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2452
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:872
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:1028
-
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵PID:2056
-
-
C:\Windows\system32\nslookup.exenslookup.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1008
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.3MB
MD5ce1b63640a790ae744465f4da7af75d0
SHA1dde7e919e329826d2bc0d2ff4ba01005ba48c52d
SHA256d4c216bab338d7fa68e1b13e9eb4d63dc2360fd7403527834e6a4aed4fbfaf40
SHA512aee4591fd5c0c477f577416a35ba2080cbb2d482efc5d5fc509761054495316cd41f6f97a30c999de36f6f5cda7a5d093add244d2e0a9b6210d152bd8793e741