Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
10/10/2024, 16:44
241010-t82a7s1dmq 710/10/2024, 16:43
241010-t8bqjs1djp 510/10/2024, 16:30
241010-tz1nbazhmp 5Analysis
-
max time kernel
300s -
max time network
291s -
platform
windows7_x64 -
resource
win7-20240903-ja -
resource tags
arch:x64arch:x86image:win7-20240903-jalocale:ja-jpos:windows7-x64systemwindows -
submitted
10/10/2024, 16:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
mpclient.exe
Resource
win7-20240903-ja
windows7-x64
8 signatures
300 seconds
Behavioral task
behavioral2
Sample
mpclient.exe
Resource
win10v2004-20241007-ja
windows10-2004-x64
8 signatures
300 seconds
General
-
Target
mpclient.exe
-
Size
186KB
-
MD5
6bd4d7f68924301051c22e8a951aecba
-
SHA1
2ae2a6b863616b61ccb550fc1a145ae025896de1
-
SHA256
9afd12eede0db98a35aba52f53041efa4a2f2a03673672c7ac530830b7152392
-
SHA512
ebf97dcc36413e9c05da1df9d296bd5226f2c5acc86f8592755f10454328ffa90dc9805825ede64f350fade5de9cef73d050aad569b733f914da6aa92740f708
-
SSDEEP
3072:crWzrkggF1yGunZZwFrUhxDR1cAoPF+sq:uCzgF1enfwFrUk
Score
5/10
Malware Config
Signatures
-
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2420 set thread context of 2148 2420 mpclient.exe 32 PID 836 set thread context of 2932 836 svchost.exe 36 PID 2932 set thread context of 796 2932 svchost.exe 37 -
resource yara_rule behavioral1/memory/2420-0-0x0000000180000000-0x0000000180066000-memory.dmp upx behavioral1/memory/2420-4-0x0000000180000000-0x0000000180066000-memory.dmp upx behavioral1/memory/2420-3-0x0000000180000000-0x0000000180066000-memory.dmp upx behavioral1/memory/2420-7-0x0000000180000000-0x0000000180066000-memory.dmp upx behavioral1/memory/2420-26-0x0000000180000000-0x0000000180066000-memory.dmp upx behavioral1/memory/836-50-0x0000000180000000-0x0000000180066000-memory.dmp upx behavioral1/memory/2932-66-0x0000000180000000-0x0000000180066000-memory.dmp upx -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\appcompat\programs\RecentFileCache.bcf svchost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2420 mpclient.exe 2148 svchost.exe 2148 svchost.exe 3032 mpclient.exe 836 svchost.exe 2932 svchost.exe 2932 svchost.exe 2932 svchost.exe 796 dllhost.exe 796 dllhost.exe 2932 svchost.exe 2932 svchost.exe 2932 svchost.exe 2932 svchost.exe 2932 svchost.exe 2932 svchost.exe 2932 svchost.exe 2932 svchost.exe 2932 svchost.exe 2932 svchost.exe 2932 svchost.exe 2932 svchost.exe 2932 svchost.exe 2932 svchost.exe 2932 svchost.exe 2932 svchost.exe 2932 svchost.exe 2932 svchost.exe 2932 svchost.exe 2932 svchost.exe 2932 svchost.exe 2932 svchost.exe 2932 svchost.exe 2932 svchost.exe 2932 svchost.exe 2932 svchost.exe 2932 svchost.exe 2932 svchost.exe 2932 svchost.exe 2932 svchost.exe 2932 svchost.exe 2932 svchost.exe 2932 svchost.exe 2932 svchost.exe 2932 svchost.exe 2932 svchost.exe 2932 svchost.exe 2932 svchost.exe 2932 svchost.exe 2932 svchost.exe 2932 svchost.exe 2932 svchost.exe 2932 svchost.exe 2932 svchost.exe 2932 svchost.exe 2932 svchost.exe 2932 svchost.exe 2932 svchost.exe 2932 svchost.exe 2932 svchost.exe 2932 svchost.exe 2932 svchost.exe 2932 svchost.exe 2932 svchost.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2148 svchost.exe -
Suspicious use of AdjustPrivilegeToken 51 IoCs
description pid Process Token: SeDebugPrivilege 2148 svchost.exe Token: SeTcbPrivilege 2148 svchost.exe Token: SeAuditPrivilege 836 svchost.exe Token: SeAssignPrimaryTokenPrivilege 836 svchost.exe Token: SeIncreaseQuotaPrivilege 836 svchost.exe Token: SeSecurityPrivilege 836 svchost.exe Token: SeTakeOwnershipPrivilege 836 svchost.exe Token: SeLoadDriverPrivilege 836 svchost.exe Token: SeSystemtimePrivilege 836 svchost.exe Token: SeBackupPrivilege 836 svchost.exe Token: SeRestorePrivilege 836 svchost.exe Token: SeShutdownPrivilege 836 svchost.exe Token: SeSystemEnvironmentPrivilege 836 svchost.exe Token: SeUndockPrivilege 836 svchost.exe Token: SeManageVolumePrivilege 836 svchost.exe Token: SeAssignPrimaryTokenPrivilege 836 svchost.exe Token: SeIncreaseQuotaPrivilege 836 svchost.exe Token: SeSecurityPrivilege 836 svchost.exe Token: SeTakeOwnershipPrivilege 836 svchost.exe Token: SeLoadDriverPrivilege 836 svchost.exe Token: SeSystemtimePrivilege 836 svchost.exe Token: SeBackupPrivilege 836 svchost.exe Token: SeRestorePrivilege 836 svchost.exe Token: SeShutdownPrivilege 836 svchost.exe Token: SeSystemEnvironmentPrivilege 836 svchost.exe Token: SeUndockPrivilege 836 svchost.exe Token: SeManageVolumePrivilege 836 svchost.exe Token: SeAssignPrimaryTokenPrivilege 836 svchost.exe Token: SeIncreaseQuotaPrivilege 836 svchost.exe Token: SeSecurityPrivilege 836 svchost.exe Token: SeTakeOwnershipPrivilege 836 svchost.exe Token: SeLoadDriverPrivilege 836 svchost.exe Token: SeSystemtimePrivilege 836 svchost.exe Token: SeBackupPrivilege 836 svchost.exe Token: SeRestorePrivilege 836 svchost.exe Token: SeShutdownPrivilege 836 svchost.exe Token: SeSystemEnvironmentPrivilege 836 svchost.exe Token: SeUndockPrivilege 836 svchost.exe Token: SeManageVolumePrivilege 836 svchost.exe Token: SeAssignPrimaryTokenPrivilege 836 svchost.exe Token: SeIncreaseQuotaPrivilege 836 svchost.exe Token: SeSecurityPrivilege 836 svchost.exe Token: SeTakeOwnershipPrivilege 836 svchost.exe Token: SeLoadDriverPrivilege 836 svchost.exe Token: SeSystemtimePrivilege 836 svchost.exe Token: SeBackupPrivilege 836 svchost.exe Token: SeRestorePrivilege 836 svchost.exe Token: SeShutdownPrivilege 836 svchost.exe Token: SeSystemEnvironmentPrivilege 836 svchost.exe Token: SeUndockPrivilege 836 svchost.exe Token: SeManageVolumePrivilege 836 svchost.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 2420 wrote to memory of 2148 2420 mpclient.exe 32 PID 2420 wrote to memory of 2148 2420 mpclient.exe 32 PID 2420 wrote to memory of 2148 2420 mpclient.exe 32 PID 2420 wrote to memory of 2148 2420 mpclient.exe 32 PID 2420 wrote to memory of 2148 2420 mpclient.exe 32 PID 2420 wrote to memory of 2148 2420 mpclient.exe 32 PID 2872 wrote to memory of 3032 2872 taskeng.exe 34 PID 2872 wrote to memory of 3032 2872 taskeng.exe 34 PID 2872 wrote to memory of 3032 2872 taskeng.exe 34 PID 3032 wrote to memory of 836 3032 mpclient.exe 13 PID 3032 wrote to memory of 836 3032 mpclient.exe 13 PID 3032 wrote to memory of 836 3032 mpclient.exe 13 PID 836 wrote to memory of 2932 836 svchost.exe 36 PID 836 wrote to memory of 2932 836 svchost.exe 36 PID 836 wrote to memory of 2932 836 svchost.exe 36 PID 836 wrote to memory of 2932 836 svchost.exe 36 PID 836 wrote to memory of 2932 836 svchost.exe 36 PID 836 wrote to memory of 2932 836 svchost.exe 36 PID 2932 wrote to memory of 796 2932 svchost.exe 37 PID 2932 wrote to memory of 796 2932 svchost.exe 37 PID 2932 wrote to memory of 796 2932 svchost.exe 37 PID 2932 wrote to memory of 796 2932 svchost.exe 37 PID 2932 wrote to memory of 796 2932 svchost.exe 37 PID 2932 wrote to memory of 796 2932 svchost.exe 37 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:836 -
C:\Windows\system32\taskeng.exetaskeng.exe {BE1AC2D3-72E3-49C8-A62D-1F83AB3041D0} S-1-5-18:NT AUTHORITY\System:Service:2⤵
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Windows\system32\mpclient.exeC:\Windows\system32\mpclient.exe -svc3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3032
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe /Processid:{F8284233-48F4-4680-ADDD-F8284233}3⤵
- Suspicious behavior: EnumeratesProcesses
PID:796
-
-
-
C:\Users\Admin\AppData\Local\Temp\mpclient.exe"C:\Users\Admin\AppData\Local\Temp\mpclient.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -Install2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
PID:2148
-