Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
15/01/2025, 20:36
250115-zd3tfawjan 1015/01/2025, 20:34
250115-zcjzyavrfl 1015/01/2025, 20:30
250115-zamm2svqhq 1015/01/2025, 18:58
250115-xmgw8atjal 10Analysis
-
max time kernel
92s -
max time network
98s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system -
submitted
15/01/2025, 20:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ad31ca449f285250368196306a8ad77a.dll
Resource
win11-20241007-en
windows11-21h2-x64
18 signatures
150 seconds
General
-
Target
ad31ca449f285250368196306a8ad77a.dll
-
Size
5.0MB
-
MD5
ad31ca449f285250368196306a8ad77a
-
SHA1
abefa604d54027fac646df910a9ecbc462b01ec2
-
SHA256
962caf150b14b5804de96484e8b911f93fcb26ab11f7e713d3f0c02a211c2577
-
SHA512
57700c858fd9f1b3bea65af6a75fc9770a8b7b98ae195b3d53d62a4d315012ea28cc28a4e2e7dc55e137e5611cf049f0cfe4ffc6110e3bfe22a437cb52af7c15
-
SSDEEP
49152:Sn+qMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnvxJM0H9:++qPoBhz1aRxcSUDk36SAEdhvxWa9
Score
10/10
Malware Config
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Wannacry family
-
Contacts a large (1669) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Executes dropped EXE 3 IoCs
pid Process 2136 mssecsvc.exe 3184 mssecsvc.exe 1940 tasksche.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 mssecsvc.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE mssecsvc.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies mssecsvc.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 mssecsvc.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\WINDOWS\tasksche.exe mssecsvc.exe File created C:\WINDOWS\mssecsvc.exe rundll32.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 3780 1940 WerFault.exe 80 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mssecsvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mssecsvc.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe -
Modifies data under HKEY_USERS 15 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion mssecsvc.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings\MuiCache BackgroundTransferHost.exe Key created \REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings\MuiCache MiniSearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix BackgroundTransferHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" BackgroundTransferHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" BackgroundTransferHost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1184 taskmgr.exe Token: SeSystemProfilePrivilege 1184 taskmgr.exe Token: SeCreateGlobalPrivilege 1184 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe 1184 taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3360 MiniSearchHost.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 3708 wrote to memory of 2292 3708 rundll32.exe 77 PID 3708 wrote to memory of 2292 3708 rundll32.exe 77 PID 3708 wrote to memory of 2292 3708 rundll32.exe 77 PID 2292 wrote to memory of 2136 2292 rundll32.exe 78 PID 2292 wrote to memory of 2136 2292 rundll32.exe 78 PID 2292 wrote to memory of 2136 2292 rundll32.exe 78 PID 2136 wrote to memory of 1940 2136 mssecsvc.exe 80 PID 2136 wrote to memory of 1940 2136 mssecsvc.exe 80
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ad31ca449f285250368196306a8ad77a.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3708 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ad31ca449f285250368196306a8ad77a.dll,#12⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\WINDOWS\tasksche.exeC:\WINDOWS\tasksche.exe /i4⤵
- Executes dropped EXE
PID:1940 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1940 -s 85⤵
- Program crash
PID:3780
-
-
-
-
-
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe -m security1⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:3184
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1940 -ip 19401⤵PID:1368
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵PID:4904
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1184
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3360
-
C:\Windows\system32\BackgroundTransferHost.exe"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.131⤵
- Modifies registry class
PID:3684
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\BackgroundTransferApi\97afe7df-e72a-43b7-97c2-3ec210cef13d.down_data
Filesize555KB
MD55683c0028832cae4ef93ca39c8ac5029
SHA1248755e4e1db552e0b6f8651b04ca6d1b31a86fb
SHA256855abd360d8a8d6974eba92b70cbd09ce519bc8773439993f9ab37cb6847309e
SHA512aba434bd29be191c823b02ea9b639beb10647bbe7759bbffdaa790dfb1ec2c58d74c525ef11aacda209e4effe322d1d3a07b115446c8914b07a3bce4d8a0e2c3
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
Filesize10KB
MD5ad7a569bafd3a938fe348f531b8ef332
SHA17fdd2f52d07640047bb62e0f3d3c946ddd85c227
SHA256f0e06109256d5577e9f62db2c398974c5002bd6d08892f20517760601b705309
SHA512b762bae338690082d817b3008144926498a1bd2d6d99be33e513c43515808f9a3184bd10254e5c6a1ff90a9211653f066050249030ad9fe0460ec88335b3d423
-
Filesize
3.6MB
MD51da4aa17d6682e2224513e559e86d658
SHA1435b8d0afb90a66bc63eaf9fdb5b1ce27d56dacd
SHA25663500b6a365a6e688afecdf632ea399b6e80529c17d292f1f1839a1c26dfed3d
SHA512bf6993555e3f9ad33ef275db233e80baf7ddf5f66c288fca2cf9cbc24ad6716df50f987a987d1c6abbd851bcc7cb29263c80fe0e43ae9e9ea4c0f9235224a89f
-
Filesize
2.0MB
MD54cf1595972413914ee36c92584da1c4f
SHA12106ca6dde83ca404ef9b00d998fd8b58628e3fb
SHA256156cae52162f94349ad25c4c2833769b20290aa5e48109479e8dd035b094f8bd
SHA51208c5068f30c09e0941c60521ecbe69f4be537db3adaae47026e903f8466067347fcd522f37e9d56c464d0913f3b008038bba1d0fc83637ba0e176bd24fcedb9b