Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
12/10/2024, 04:49
Static task
static1
Behavioral task
behavioral1
Sample
988b8d0296ddf855a9e62bf7c4f871041aba73f539d6cd42c15ae8ab2c2b74e5N.exe
Resource
win7-20241010-en
General
-
Target
988b8d0296ddf855a9e62bf7c4f871041aba73f539d6cd42c15ae8ab2c2b74e5N.exe
-
Size
1.9MB
-
MD5
697b87cd42a8364e8abec81646a45b70
-
SHA1
ab09630560711ab6ea3eab29d855a8f6d7a88107
-
SHA256
988b8d0296ddf855a9e62bf7c4f871041aba73f539d6cd42c15ae8ab2c2b74e5
-
SHA512
cece9eb76e4dd1ccc77926f31cab5ab0a64e6841bbbc526c7707e4a801ddcd2319f50b61fe3a4839bbe1b641a918ec493d5bd9de6933f76d25af149592cba43f
-
SSDEEP
49152:LyGa7aZkQu/TR+oaPttRFUWc0CHrQC5x5IvwP1wRFJ1aS:WTmZgV+lP9uWc0CQC5x5IuC1v
Malware Config
Extracted
phorphiex
http://185.215.113.66/
http://91.202.233.141/
0xCa90599132C4D88907Bd8E046540284aa468a035
TRuGGXNDM1cavQ1AqMQHG8yfxP4QWVSMN6
qph44jx8r9k5xeq5cuf958krv3ewrnp5vc6hhdjd3r
XryzFMFVpDUvU7famUGf214EXD3xNUSmQf
rsXCXBf9SagxV8JfC12d8Bybk84oPdMNN9
AULzfBuUAPfCGAXoG5Vq14aP9s6fx3AH4Z
LTK4xdKPAgFHPLan8kriAD7eY4heyy73mB
MP8GEm8QpYgQYaMo8oM5NQhRBgDGiLZW5Q
4BB7ckkaPTyADc8trtuwDoZxywaR4eNL5cDJ3KBjq9GraN4mUFztf7mLS7WgT7Bh7uPqpjvA4ypVwXKCJ1vvLWWAFvSmDoD
15TssKwtjMtwy4vDLcLsQUZUD2B9f7eDjw85sBNVC5LRPPnC
1BzmrjmKPKSR2hH5BeJySfiVA676E8DYaK
ltc1qt0n3f0t7vz9k0mvcswk477shrxwjhf9sj5ykrp
3PMiLynrGVZ8oEqvoqC4hXD67B1WoALR4pc
3ESHude8zUHksQg1h6hHmzY79BS36L91Yn
DLUzwvyxN1RrwjByUPPzVMdfxNRPGVRMMA
t1J6GCPCiHW1eRdjJgDDu6b1vSVmL5U7Twh
stars125f3mw4xd9htpsq4zj5w5ezm5gags37yxxh6mj
bnb1msyt0djx4ecspfxg5en0ye465kg3kmv9utzml2
bc1ppypcmu3684n648gyj62gjp2rw0xy7w3vwfamatlg29ajp4z52desafa0sr
bc1qc9edl4hzl9jyt8twdad3zjeh2df2znq96tdezd
bitcoincash:qph44jx8r9k5xeq5cuf958krv3ewrnp5vc6hhdjd3r
GBQJMXYXPRIWFMXIFJR35ZB7LRKMB4PHCIUAUFR3TKUL6RDBZVLZEUJ3
-
mutex
mmn7nnm8na
-
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36
Signatures
-
Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4" sysppvrdnvs.exe -
Phorphiex payload 1 IoCs
resource yara_rule behavioral1/files/0x000500000001a486-20.dat family_phorphiex -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" sysppvrdnvs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" sysppvrdnvs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1" sysppvrdnvs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" sysppvrdnvs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" sysppvrdnvs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" sysppvrdnvs.exe -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 384 powershell.exe -
Downloads MZ/PE file
-
Executes dropped EXE 4 IoCs
pid Process 2820 6049.exe 2884 988b8d0296ddf855a9e62bf7c4f871041aba73f539d6cd42c15ae8ab2c2b74e5N.tmp 1208 1427919999.exe 2836 sysppvrdnvs.exe -
Loads dropped DLL 4 IoCs
pid Process 2476 988b8d0296ddf855a9e62bf7c4f871041aba73f539d6cd42c15ae8ab2c2b74e5N.exe 2476 988b8d0296ddf855a9e62bf7c4f871041aba73f539d6cd42c15ae8ab2c2b74e5N.exe 2820 6049.exe 2820 6049.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" sysppvrdnvs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiSpywareOverride = "1" sysppvrdnvs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" sysppvrdnvs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" sysppvrdnvs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1" sysppvrdnvs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" sysppvrdnvs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" sysppvrdnvs.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\sysppvrdnvs.exe" 1427919999.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\sysppvrdnvs.exe 1427919999.exe File opened for modification C:\Windows\sysppvrdnvs.exe 1427919999.exe -
Launches sc.exe 5 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2168 sc.exe 2844 sc.exe 852 sc.exe 2544 sc.exe 2364 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 13 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 988b8d0296ddf855a9e62bf7c4f871041aba73f539d6cd42c15ae8ab2c2b74e5N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6049.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1427919999.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sysppvrdnvs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 988b8d0296ddf855a9e62bf7c4f871041aba73f539d6cd42c15ae8ab2c2b74e5N.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 384 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 384 powershell.exe -
Suspicious use of WriteProcessMemory 51 IoCs
description pid Process procid_target PID 2476 wrote to memory of 2820 2476 988b8d0296ddf855a9e62bf7c4f871041aba73f539d6cd42c15ae8ab2c2b74e5N.exe 30 PID 2476 wrote to memory of 2820 2476 988b8d0296ddf855a9e62bf7c4f871041aba73f539d6cd42c15ae8ab2c2b74e5N.exe 30 PID 2476 wrote to memory of 2820 2476 988b8d0296ddf855a9e62bf7c4f871041aba73f539d6cd42c15ae8ab2c2b74e5N.exe 30 PID 2476 wrote to memory of 2820 2476 988b8d0296ddf855a9e62bf7c4f871041aba73f539d6cd42c15ae8ab2c2b74e5N.exe 30 PID 2476 wrote to memory of 2884 2476 988b8d0296ddf855a9e62bf7c4f871041aba73f539d6cd42c15ae8ab2c2b74e5N.exe 31 PID 2476 wrote to memory of 2884 2476 988b8d0296ddf855a9e62bf7c4f871041aba73f539d6cd42c15ae8ab2c2b74e5N.exe 31 PID 2476 wrote to memory of 2884 2476 988b8d0296ddf855a9e62bf7c4f871041aba73f539d6cd42c15ae8ab2c2b74e5N.exe 31 PID 2476 wrote to memory of 2884 2476 988b8d0296ddf855a9e62bf7c4f871041aba73f539d6cd42c15ae8ab2c2b74e5N.exe 31 PID 2476 wrote to memory of 2884 2476 988b8d0296ddf855a9e62bf7c4f871041aba73f539d6cd42c15ae8ab2c2b74e5N.exe 31 PID 2476 wrote to memory of 2884 2476 988b8d0296ddf855a9e62bf7c4f871041aba73f539d6cd42c15ae8ab2c2b74e5N.exe 31 PID 2476 wrote to memory of 2884 2476 988b8d0296ddf855a9e62bf7c4f871041aba73f539d6cd42c15ae8ab2c2b74e5N.exe 31 PID 2820 wrote to memory of 1208 2820 6049.exe 33 PID 2820 wrote to memory of 1208 2820 6049.exe 33 PID 2820 wrote to memory of 1208 2820 6049.exe 33 PID 2820 wrote to memory of 1208 2820 6049.exe 33 PID 1208 wrote to memory of 2836 1208 1427919999.exe 34 PID 1208 wrote to memory of 2836 1208 1427919999.exe 34 PID 1208 wrote to memory of 2836 1208 1427919999.exe 34 PID 1208 wrote to memory of 2836 1208 1427919999.exe 34 PID 2836 wrote to memory of 3012 2836 sysppvrdnvs.exe 35 PID 2836 wrote to memory of 3012 2836 sysppvrdnvs.exe 35 PID 2836 wrote to memory of 3012 2836 sysppvrdnvs.exe 35 PID 2836 wrote to memory of 3012 2836 sysppvrdnvs.exe 35 PID 2836 wrote to memory of 1980 2836 sysppvrdnvs.exe 37 PID 2836 wrote to memory of 1980 2836 sysppvrdnvs.exe 37 PID 2836 wrote to memory of 1980 2836 sysppvrdnvs.exe 37 PID 2836 wrote to memory of 1980 2836 sysppvrdnvs.exe 37 PID 3012 wrote to memory of 384 3012 cmd.exe 39 PID 3012 wrote to memory of 384 3012 cmd.exe 39 PID 3012 wrote to memory of 384 3012 cmd.exe 39 PID 3012 wrote to memory of 384 3012 cmd.exe 39 PID 1980 wrote to memory of 2168 1980 cmd.exe 40 PID 1980 wrote to memory of 2168 1980 cmd.exe 40 PID 1980 wrote to memory of 2168 1980 cmd.exe 40 PID 1980 wrote to memory of 2168 1980 cmd.exe 40 PID 1980 wrote to memory of 2844 1980 cmd.exe 41 PID 1980 wrote to memory of 2844 1980 cmd.exe 41 PID 1980 wrote to memory of 2844 1980 cmd.exe 41 PID 1980 wrote to memory of 2844 1980 cmd.exe 41 PID 1980 wrote to memory of 852 1980 cmd.exe 42 PID 1980 wrote to memory of 852 1980 cmd.exe 42 PID 1980 wrote to memory of 852 1980 cmd.exe 42 PID 1980 wrote to memory of 852 1980 cmd.exe 42 PID 1980 wrote to memory of 2544 1980 cmd.exe 43 PID 1980 wrote to memory of 2544 1980 cmd.exe 43 PID 1980 wrote to memory of 2544 1980 cmd.exe 43 PID 1980 wrote to memory of 2544 1980 cmd.exe 43 PID 1980 wrote to memory of 2364 1980 cmd.exe 44 PID 1980 wrote to memory of 2364 1980 cmd.exe 44 PID 1980 wrote to memory of 2364 1980 cmd.exe 44 PID 1980 wrote to memory of 2364 1980 cmd.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\988b8d0296ddf855a9e62bf7c4f871041aba73f539d6cd42c15ae8ab2c2b74e5N.exe"C:\Users\Admin\AppData\Local\Temp\988b8d0296ddf855a9e62bf7c4f871041aba73f539d6cd42c15ae8ab2c2b74e5N.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\6049.exe"C:\Users\Admin\AppData\Local\Temp\6049.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\1427919999.exeC:\Users\Admin\AppData\Local\Temp\1427919999.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Windows\sysppvrdnvs.exeC:\Windows\sysppvrdnvs.exe4⤵
- Modifies security service
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"6⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:384
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS /wait5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Windows\SysWOW64\sc.exesc stop UsoSvc6⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2168
-
-
C:\Windows\SysWOW64\sc.exesc stop WaaSMedicSvc6⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2844
-
-
C:\Windows\SysWOW64\sc.exesc stop wuauserv6⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:852
-
-
C:\Windows\SysWOW64\sc.exesc stop DoSvc6⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2544
-
-
C:\Windows\SysWOW64\sc.exesc stop BITS /wait6⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2364
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\is-E6SC4.tmp\988b8d0296ddf855a9e62bf7c4f871041aba73f539d6cd42c15ae8ab2c2b74e5N.tmp"C:\Users\Admin\AppData\Local\Temp\is-E6SC4.tmp\988b8d0296ddf855a9e62bf7c4f871041aba73f539d6cd42c15ae8ab2c2b74e5N.tmp" /SL5="$90150,1718962,58368,C:\Users\Admin\AppData\Local\Temp\988b8d0296ddf855a9e62bf7c4f871041aba73f539d6cd42c15ae8ab2c2b74e5N.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2884
-
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1System Services
1Service Execution
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
83KB
MD506560b5e92d704395bc6dae58bc7e794
SHA1fbd3e4ae28620197d1f02bfc24adaf4ddacd2372
SHA2569eaaadf3857e4a3e83f4f78d96ab185213b6528c8e470807f9d16035daadf33d
SHA512b55b49fc1bd526c47d88fcf8a20fcaed900bfb291f2e3e1186ec196a87127ed24df71385ae04fedcc802c362c4ebf38edfc182013febf4496ddeb66ce5195ee3
-
Filesize
9KB
MD58d8e6c7952a9dc7c0c73911c4dbc5518
SHA19098da03b33b2c822065b49d5220359c275d5e94
SHA256feb4c3ae4566f0acbb9e0f55417b61fefd89dc50a4e684df780813fb01d61278
SHA51291a573843c28dd32a9f31a60ba977f9a3d4bb19ffd1b7254333e09bcecef348c1b3220a348ebb2cb08edb57d56cb7737f026519da52199c9dc62c10aea236645
-
\Users\Admin\AppData\Local\Temp\is-E6SC4.tmp\988b8d0296ddf855a9e62bf7c4f871041aba73f539d6cd42c15ae8ab2c2b74e5N.tmp
Filesize702KB
MD51afbd25db5c9a90fe05309f7c4fbcf09
SHA1baf330b5c249ca925b4ea19a52fe8b2c27e547fa
SHA2563bb0ee5569fe5453c6b3fa25aa517b925d4f8d1f7ba3475e58fa09c46290658c
SHA5123a448f06862c6d163fd58b68b836d866ae513e04a69774abf5a0c5b7df74f5b9ee37240083760185618c5068bf93e7fd812e76b3e530639111fb1d74f4d28419