Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19/12/2024, 02:28
Static task
static1
Behavioral task
behavioral1
Sample
0ec18d05affbc058553c645632ad2da7262affb8d9b4bc306333b06f3c2b0ed1.exe
Resource
win7-20240903-en
General
-
Target
0ec18d05affbc058553c645632ad2da7262affb8d9b4bc306333b06f3c2b0ed1.exe
-
Size
5.6MB
-
MD5
f8b1a168ffad863d4c4199d10d033591
-
SHA1
48a08f3d6b3ac212ba0f1642c3f46561fbfb4ac2
-
SHA256
0ec18d05affbc058553c645632ad2da7262affb8d9b4bc306333b06f3c2b0ed1
-
SHA512
fb0fff80db4d4ab3f716190a524bce085d9bd135ddeaffc26bc63eb14f3917c4a8c27a0948b7b7c83de9ed82d6e9ff6e9006e3245d80a85782ceecfe4cd11770
-
SSDEEP
98304:xRjPz9KDzUU8O5/B/LJ25E9SVh86sS3TRknQ3ss2MApp9meypA3cPDu7i:xFKoU8O5/b2XViSjX310SeyGc7u7i
Malware Config
Signatures
-
Xmrig family
-
XMRig Miner payload 8 IoCs
resource yara_rule behavioral1/memory/444-39-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/444-40-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/444-38-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/444-37-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/444-36-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/444-34-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/444-33-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/444-41-0x0000000140000000-0x0000000140848000-memory.dmp xmrig -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2800 powershell.exe 3028 powershell.exe -
Creates new service(s) 2 TTPs
-
Deletes itself 1 IoCs
pid Process 2000 cmd.exe -
Executes dropped EXE 2 IoCs
pid Process 480 Process not Found 2756 lutlgidagtja.exe -
Loads dropped DLL 1 IoCs
pid Process 480 Process not Found -
Power Settings 1 TTPs 8 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
pid Process 2188 powercfg.exe 2388 powercfg.exe 2912 powercfg.exe 2968 powercfg.exe 1108 powercfg.exe 2016 powercfg.exe 2360 powercfg.exe 332 powercfg.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\system32\MRT.exe 0ec18d05affbc058553c645632ad2da7262affb8d9b4bc306333b06f3c2b0ed1.exe File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\system32\MRT.exe lutlgidagtja.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2756 set thread context of 668 2756 lutlgidagtja.exe 85 PID 2756 set thread context of 444 2756 lutlgidagtja.exe 90 -
resource yara_rule behavioral1/memory/444-39-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/444-40-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/444-38-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/444-37-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/444-36-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/444-34-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/444-33-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/444-32-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/444-31-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/444-30-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/444-29-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/444-28-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/444-41-0x0000000140000000-0x0000000140848000-memory.dmp upx -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\wusa.lock wusa.exe File created C:\Windows\wusa.lock wusa.exe -
Launches sc.exe 14 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 1192 sc.exe 476 sc.exe 2608 sc.exe 2788 sc.exe 2996 sc.exe 2600 sc.exe 1696 sc.exe 1788 sc.exe 1968 sc.exe 3040 sc.exe 2860 sc.exe 2620 sc.exe 2348 sc.exe 1688 sc.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage powershell.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = e0a2d7b3bd51db01 powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1152 0ec18d05affbc058553c645632ad2da7262affb8d9b4bc306333b06f3c2b0ed1.exe 2800 powershell.exe 1152 0ec18d05affbc058553c645632ad2da7262affb8d9b4bc306333b06f3c2b0ed1.exe 1152 0ec18d05affbc058553c645632ad2da7262affb8d9b4bc306333b06f3c2b0ed1.exe 1152 0ec18d05affbc058553c645632ad2da7262affb8d9b4bc306333b06f3c2b0ed1.exe 1152 0ec18d05affbc058553c645632ad2da7262affb8d9b4bc306333b06f3c2b0ed1.exe 1152 0ec18d05affbc058553c645632ad2da7262affb8d9b4bc306333b06f3c2b0ed1.exe 1152 0ec18d05affbc058553c645632ad2da7262affb8d9b4bc306333b06f3c2b0ed1.exe 1152 0ec18d05affbc058553c645632ad2da7262affb8d9b4bc306333b06f3c2b0ed1.exe 1152 0ec18d05affbc058553c645632ad2da7262affb8d9b4bc306333b06f3c2b0ed1.exe 1152 0ec18d05affbc058553c645632ad2da7262affb8d9b4bc306333b06f3c2b0ed1.exe 1152 0ec18d05affbc058553c645632ad2da7262affb8d9b4bc306333b06f3c2b0ed1.exe 1152 0ec18d05affbc058553c645632ad2da7262affb8d9b4bc306333b06f3c2b0ed1.exe 1152 0ec18d05affbc058553c645632ad2da7262affb8d9b4bc306333b06f3c2b0ed1.exe 1152 0ec18d05affbc058553c645632ad2da7262affb8d9b4bc306333b06f3c2b0ed1.exe 1152 0ec18d05affbc058553c645632ad2da7262affb8d9b4bc306333b06f3c2b0ed1.exe 1152 0ec18d05affbc058553c645632ad2da7262affb8d9b4bc306333b06f3c2b0ed1.exe 2756 lutlgidagtja.exe 3028 powershell.exe 2756 lutlgidagtja.exe 2756 lutlgidagtja.exe 2756 lutlgidagtja.exe 2756 lutlgidagtja.exe 2756 lutlgidagtja.exe 2756 lutlgidagtja.exe 2756 lutlgidagtja.exe 2756 lutlgidagtja.exe 2756 lutlgidagtja.exe 2756 lutlgidagtja.exe 2756 lutlgidagtja.exe 2756 lutlgidagtja.exe 444 nslookup.exe 444 nslookup.exe 444 nslookup.exe 444 nslookup.exe 444 nslookup.exe 444 nslookup.exe 444 nslookup.exe 444 nslookup.exe 444 nslookup.exe 444 nslookup.exe 444 nslookup.exe 444 nslookup.exe 444 nslookup.exe 444 nslookup.exe 444 nslookup.exe 444 nslookup.exe 444 nslookup.exe 444 nslookup.exe 444 nslookup.exe 444 nslookup.exe 444 nslookup.exe 444 nslookup.exe 444 nslookup.exe 444 nslookup.exe 444 nslookup.exe 444 nslookup.exe 444 nslookup.exe 444 nslookup.exe 444 nslookup.exe 444 nslookup.exe 444 nslookup.exe 444 nslookup.exe 444 nslookup.exe -
Suspicious use of AdjustPrivilegeToken 11 IoCs
description pid Process Token: SeDebugPrivilege 2800 powershell.exe Token: SeShutdownPrivilege 1108 powercfg.exe Token: SeShutdownPrivilege 2968 powercfg.exe Token: SeShutdownPrivilege 2912 powercfg.exe Token: SeShutdownPrivilege 2016 powercfg.exe Token: SeDebugPrivilege 3028 powershell.exe Token: SeShutdownPrivilege 2388 powercfg.exe Token: SeShutdownPrivilege 2188 powercfg.exe Token: SeShutdownPrivilege 2360 powercfg.exe Token: SeShutdownPrivilege 332 powercfg.exe Token: SeLockMemoryPrivilege 444 nslookup.exe -
Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 2592 wrote to memory of 2564 2592 cmd.exe 39 PID 2592 wrote to memory of 2564 2592 cmd.exe 39 PID 2592 wrote to memory of 2564 2592 cmd.exe 39 PID 2000 wrote to memory of 3024 2000 cmd.exe 64 PID 2000 wrote to memory of 3024 2000 cmd.exe 64 PID 2000 wrote to memory of 3024 2000 cmd.exe 64 PID 2452 wrote to memory of 2908 2452 cmd.exe 72 PID 2452 wrote to memory of 2908 2452 cmd.exe 72 PID 2452 wrote to memory of 2908 2452 cmd.exe 72 PID 2756 wrote to memory of 668 2756 lutlgidagtja.exe 85 PID 2756 wrote to memory of 668 2756 lutlgidagtja.exe 85 PID 2756 wrote to memory of 668 2756 lutlgidagtja.exe 85 PID 2756 wrote to memory of 668 2756 lutlgidagtja.exe 85 PID 2756 wrote to memory of 668 2756 lutlgidagtja.exe 85 PID 2756 wrote to memory of 668 2756 lutlgidagtja.exe 85 PID 2756 wrote to memory of 668 2756 lutlgidagtja.exe 85 PID 2756 wrote to memory of 668 2756 lutlgidagtja.exe 85 PID 2756 wrote to memory of 668 2756 lutlgidagtja.exe 85 PID 2756 wrote to memory of 444 2756 lutlgidagtja.exe 90 PID 2756 wrote to memory of 444 2756 lutlgidagtja.exe 90 PID 2756 wrote to memory of 444 2756 lutlgidagtja.exe 90 PID 2756 wrote to memory of 444 2756 lutlgidagtja.exe 90 PID 2756 wrote to memory of 444 2756 lutlgidagtja.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\0ec18d05affbc058553c645632ad2da7262affb8d9b4bc306333b06f3c2b0ed1.exe"C:\Users\Admin\AppData\Local\Temp\0ec18d05affbc058553c645632ad2da7262affb8d9b4bc306333b06f3c2b0ed1.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:1152 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2800
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵
- Drops file in Windows directory
PID:2564
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
PID:2608
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
PID:2788
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
PID:2600
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
PID:2620
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
PID:1696
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2912
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2968
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:1108
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2016
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "JIOGRCSG"2⤵
- Launches sc.exe
PID:1788
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "JIOGRCSG" binpath= "C:\ProgramData\zvycwxhpsxqt\lutlgidagtja.exe" start= "auto"2⤵
- Launches sc.exe
PID:1968
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog2⤵
- Launches sc.exe
PID:2996
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "JIOGRCSG"2⤵
- Launches sc.exe
PID:3040
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\0ec18d05affbc058553c645632ad2da7262affb8d9b4bc306333b06f3c2b0ed1.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:3024
-
-
-
C:\ProgramData\zvycwxhpsxqt\lutlgidagtja.exeC:\ProgramData\zvycwxhpsxqt\lutlgidagtja.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3028
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵
- Drops file in Windows directory
PID:2908
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
PID:1192
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
PID:2860
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
PID:476
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
PID:2348
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
PID:1688
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2360
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:332
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2188
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2388
-
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵PID:668
-
-
C:\Windows\system32\nslookup.exenslookup.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:444
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.6MB
MD5f8b1a168ffad863d4c4199d10d033591
SHA148a08f3d6b3ac212ba0f1642c3f46561fbfb4ac2
SHA2560ec18d05affbc058553c645632ad2da7262affb8d9b4bc306333b06f3c2b0ed1
SHA512fb0fff80db4d4ab3f716190a524bce085d9bd135ddeaffc26bc63eb14f3917c4a8c27a0948b7b7c83de9ed82d6e9ff6e9006e3245d80a85782ceecfe4cd11770