Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
27/10/2024, 00:09
Behavioral task
behavioral1
Sample
0x0006000000016d4e-54.exe
Resource
win7-20240903-en
windows7-x64
18 signatures
150 seconds
General
-
Target
0x0006000000016d4e-54.exe
-
Size
10KB
-
MD5
96509ab828867d81c1693b614b22f41d
-
SHA1
c5f82005dbda43cedd86708cc5fc3635a781a67e
-
SHA256
a9de2927b0ec45cf900508fec18531c04ee9fa8a5dfe2fc82c67d9458cf4b744
-
SHA512
ff603117a06da8fb2386c1d2049a5896774e41f34d05951ecd4e7b5fc9da51a373e3fcf61af3577ff78490cf898471ce8e71eae848a12812fe98cd7e76e1a9ca
-
SSDEEP
96:vdHiIV5H6c10lqo9ZYAoQdVDCcJ+587tG6AuJxGE9btz2qhRC7tCEOhd1Q:vdHiQ5HV1wr9KA/J+izJxTZtzthyOhd
Malware Config
Signatures
-
Suspicious use of NtCreateUserProcessOtherParentProcess 5 IoCs
description pid Process procid_target PID 4504 created 3444 4504 2447833663.exe 56 PID 4504 created 3444 4504 2447833663.exe 56 PID 5060 created 3444 5060 winupsecvmgr.exe 56 PID 5060 created 3444 5060 winupsecvmgr.exe 56 PID 5060 created 3444 5060 winupsecvmgr.exe 56 -
Xmrig family
-
XMRig Miner payload 13 IoCs
resource yara_rule behavioral2/memory/5060-42-0x00007FF7E02D0000-0x00007FF7E0867000-memory.dmp xmrig behavioral2/memory/3900-45-0x00007FF7F1A60000-0x00007FF7F224F000-memory.dmp xmrig behavioral2/memory/3900-47-0x00007FF7F1A60000-0x00007FF7F224F000-memory.dmp xmrig behavioral2/memory/3900-49-0x00007FF7F1A60000-0x00007FF7F224F000-memory.dmp xmrig behavioral2/memory/3900-51-0x00007FF7F1A60000-0x00007FF7F224F000-memory.dmp xmrig behavioral2/memory/3900-53-0x00007FF7F1A60000-0x00007FF7F224F000-memory.dmp xmrig behavioral2/memory/3900-55-0x00007FF7F1A60000-0x00007FF7F224F000-memory.dmp xmrig behavioral2/memory/3900-57-0x00007FF7F1A60000-0x00007FF7F224F000-memory.dmp xmrig behavioral2/memory/3900-59-0x00007FF7F1A60000-0x00007FF7F224F000-memory.dmp xmrig behavioral2/memory/3900-61-0x00007FF7F1A60000-0x00007FF7F224F000-memory.dmp xmrig behavioral2/memory/3900-63-0x00007FF7F1A60000-0x00007FF7F224F000-memory.dmp xmrig behavioral2/memory/3900-65-0x00007FF7F1A60000-0x00007FF7F224F000-memory.dmp xmrig behavioral2/memory/3900-67-0x00007FF7F1A60000-0x00007FF7F224F000-memory.dmp xmrig -
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
pid Process 4504 2447833663.exe 5060 winupsecvmgr.exe -
pid Process 1840 powershell.exe 2284 powershell.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 5060 set thread context of 708 5060 winupsecvmgr.exe 110 PID 5060 set thread context of 3900 5060 winupsecvmgr.exe 111 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0x0006000000016d4e-54.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 4504 2447833663.exe 4504 2447833663.exe 1840 powershell.exe 1840 powershell.exe 4504 2447833663.exe 4504 2447833663.exe 5060 winupsecvmgr.exe 5060 winupsecvmgr.exe 2284 powershell.exe 2284 powershell.exe 5060 winupsecvmgr.exe 5060 winupsecvmgr.exe 5060 winupsecvmgr.exe 5060 winupsecvmgr.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1840 powershell.exe Token: SeIncreaseQuotaPrivilege 1840 powershell.exe Token: SeSecurityPrivilege 1840 powershell.exe Token: SeTakeOwnershipPrivilege 1840 powershell.exe Token: SeLoadDriverPrivilege 1840 powershell.exe Token: SeSystemProfilePrivilege 1840 powershell.exe Token: SeSystemtimePrivilege 1840 powershell.exe Token: SeProfSingleProcessPrivilege 1840 powershell.exe Token: SeIncBasePriorityPrivilege 1840 powershell.exe Token: SeCreatePagefilePrivilege 1840 powershell.exe Token: SeBackupPrivilege 1840 powershell.exe Token: SeRestorePrivilege 1840 powershell.exe Token: SeShutdownPrivilege 1840 powershell.exe Token: SeDebugPrivilege 1840 powershell.exe Token: SeSystemEnvironmentPrivilege 1840 powershell.exe Token: SeRemoteShutdownPrivilege 1840 powershell.exe Token: SeUndockPrivilege 1840 powershell.exe Token: SeManageVolumePrivilege 1840 powershell.exe Token: 33 1840 powershell.exe Token: 34 1840 powershell.exe Token: 35 1840 powershell.exe Token: 36 1840 powershell.exe Token: SeIncreaseQuotaPrivilege 1840 powershell.exe Token: SeSecurityPrivilege 1840 powershell.exe Token: SeTakeOwnershipPrivilege 1840 powershell.exe Token: SeLoadDriverPrivilege 1840 powershell.exe Token: SeSystemProfilePrivilege 1840 powershell.exe Token: SeSystemtimePrivilege 1840 powershell.exe Token: SeProfSingleProcessPrivilege 1840 powershell.exe Token: SeIncBasePriorityPrivilege 1840 powershell.exe Token: SeCreatePagefilePrivilege 1840 powershell.exe Token: SeBackupPrivilege 1840 powershell.exe Token: SeRestorePrivilege 1840 powershell.exe Token: SeShutdownPrivilege 1840 powershell.exe Token: SeDebugPrivilege 1840 powershell.exe Token: SeSystemEnvironmentPrivilege 1840 powershell.exe Token: SeRemoteShutdownPrivilege 1840 powershell.exe Token: SeUndockPrivilege 1840 powershell.exe Token: SeManageVolumePrivilege 1840 powershell.exe Token: 33 1840 powershell.exe Token: 34 1840 powershell.exe Token: 35 1840 powershell.exe Token: 36 1840 powershell.exe Token: SeIncreaseQuotaPrivilege 1840 powershell.exe Token: SeSecurityPrivilege 1840 powershell.exe Token: SeTakeOwnershipPrivilege 1840 powershell.exe Token: SeLoadDriverPrivilege 1840 powershell.exe Token: SeSystemProfilePrivilege 1840 powershell.exe Token: SeSystemtimePrivilege 1840 powershell.exe Token: SeProfSingleProcessPrivilege 1840 powershell.exe Token: SeIncBasePriorityPrivilege 1840 powershell.exe Token: SeCreatePagefilePrivilege 1840 powershell.exe Token: SeBackupPrivilege 1840 powershell.exe Token: SeRestorePrivilege 1840 powershell.exe Token: SeShutdownPrivilege 1840 powershell.exe Token: SeDebugPrivilege 1840 powershell.exe Token: SeSystemEnvironmentPrivilege 1840 powershell.exe Token: SeRemoteShutdownPrivilege 1840 powershell.exe Token: SeUndockPrivilege 1840 powershell.exe Token: SeManageVolumePrivilege 1840 powershell.exe Token: 33 1840 powershell.exe Token: 34 1840 powershell.exe Token: 35 1840 powershell.exe Token: 36 1840 powershell.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3544 wrote to memory of 4504 3544 0x0006000000016d4e-54.exe 97 PID 3544 wrote to memory of 4504 3544 0x0006000000016d4e-54.exe 97 PID 5060 wrote to memory of 708 5060 winupsecvmgr.exe 110 PID 5060 wrote to memory of 3900 5060 winupsecvmgr.exe 111 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3444
-
C:\Users\Admin\AppData\Local\Temp\0x0006000000016d4e-54.exe"C:\Users\Admin\AppData\Local\Temp\0x0006000000016d4e-54.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3544 -
C:\Users\Admin\AppData\Local\Temp\2447833663.exeC:\Users\Admin\AppData\Local\Temp\2447833663.exe3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4504
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#evrkcgqew#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Microsoft Windows Security' /tr '''C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Microsoft Windows Security' -RunLevel 'Highest' -Force; }2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1840
-
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /run /tn "Microsoft Windows Security"2⤵PID:836
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#evrkcgqew#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Microsoft Windows Security' /tr '''C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Microsoft Windows Security' -RunLevel 'Highest' -Force; }2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:2284
-
-
C:\Windows\System32\conhost.exeC:\Windows\System32\conhost.exe2⤵PID:708
-
-
C:\Windows\System32\dwm.exeC:\Windows\System32\dwm.exe2⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3900
-
-
C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe"C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe"1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5060
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5fee026663fcb662152188784794028ee
SHA13c02a26a9cb16648fad85c6477b68ced3cb0cb45
SHA256dbd4136bc342e3e92902ec3a30d165452c82997a7ae24ac90775e42d88959e6b
SHA5127b12bd5c8fc4356b9123d6586b4980cf76012663b41c0dab6f6f21567e2f4005c5bcea2cc2158d157e4f801a281f3e04bad3774cddb3122db309ccf662184bd6
-
Filesize
1KB
MD52ac3c9ba89b8c2ef19c601ecebb82157
SHA1a239a4b11438c00e5ff89ebd4a804ede6a01935b
SHA2563c2714ce07f8c04b3f8222dfe50d8ae08f548b0e6e79fe33d08bf6f4c2e5143e
SHA512b1221d29e747b37071761b2509e9109b522cce6411f73f27c9428ac332d26b9f413ae6b8c0aeac1afb7fab2d0b3b1c4af189da12fe506287596df2ef8f083432
-
Filesize
5.6MB
MD513b26b2c7048a92d6a843c1302618fad
SHA189c2dfc01ac12ef2704c7669844ec69f1700c1ca
SHA2561753ad35ece25ab9a19048c70062e9170f495e313d7355ebbba59c38f5d90256
SHA512d6aff89b61c9945002a6798617ad304612460a607ef1cfbdcb32f8932ca648bcee1d5f2e0321bb4c58c1f4642b1e0ececc1eb82450fdec7dff69b5389f195455
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82