Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20250129-en -
resource tags
arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system -
submitted
02/02/2025, 17:17
Behavioral task
behavioral1
Sample
fe7243dc134d131dec74c5dd59f6c62e506f2bc5161e75430f9e14f64d8fd8ad.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
fe7243dc134d131dec74c5dd59f6c62e506f2bc5161e75430f9e14f64d8fd8ad.exe
Resource
win10v2004-20250129-en
General
-
Target
fe7243dc134d131dec74c5dd59f6c62e506f2bc5161e75430f9e14f64d8fd8ad.exe
-
Size
1.6MB
-
MD5
b70aa6e991b42e78a1d733f79be471c5
-
SHA1
afdd255af75ebc2f8f2fedf62a3488ec170c72c0
-
SHA256
fe7243dc134d131dec74c5dd59f6c62e506f2bc5161e75430f9e14f64d8fd8ad
-
SHA512
2de01c89744b5a4abff99031313ba4f803d01d4a5edac0b327f7edb797c0ebb182bfc29efed652f7d1d4b9e509273f8c91e5b6a1a555a277a3746e64344f8da5
-
SSDEEP
12288:3HZVm/7ePnv+TWM+6+xTGzgFA+u/x8acJdPACFFbLFi8cj5UQbM72voxoSj:3v+NWu/adRYj5UQOR
Malware Config
Signatures
-
Blackshades
Blackshades is a remote access trojan with various capabilities.
-
Blackshades family
-
Blackshades payload 9 IoCs
resource yara_rule behavioral2/memory/2816-36-0x0000000000400000-0x000000000045C000-memory.dmp family_blackshades behavioral2/memory/2816-43-0x0000000000400000-0x000000000045C000-memory.dmp family_blackshades behavioral2/memory/2816-45-0x0000000000400000-0x000000000045C000-memory.dmp family_blackshades behavioral2/memory/2816-48-0x0000000000400000-0x000000000045C000-memory.dmp family_blackshades behavioral2/memory/2816-49-0x0000000000400000-0x000000000045C000-memory.dmp family_blackshades behavioral2/memory/2816-51-0x0000000000400000-0x000000000045C000-memory.dmp family_blackshades behavioral2/memory/2816-52-0x0000000000400000-0x000000000045C000-memory.dmp family_blackshades behavioral2/memory/2816-53-0x0000000000400000-0x000000000045C000-memory.dmp family_blackshades behavioral2/memory/2816-57-0x0000000000400000-0x000000000045C000-memory.dmp family_blackshades -
Modifies firewall policy service 3 TTPs 10 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Windows Update\\winupdt.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\Windows Updater.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Windows Updater.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1121399784-3202166597-3503557106-1000\Control Panel\International\Geo\Nation fe7243dc134d131dec74c5dd59f6c62e506f2bc5161e75430f9e14f64d8fd8ad.exe -
Executes dropped EXE 2 IoCs
pid Process 216 winupdt.exe 2816 winupdt.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1121399784-3202166597-3503557106-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Window Updates = "C:\\Users\\Admin\\AppData\\Roaming\\Windows Update\\winupdt.exe" reg.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 216 set thread context of 2816 216 winupdt.exe 91 -
resource yara_rule behavioral2/memory/4980-0-0x0000000000400000-0x0000000000592000-memory.dmp upx behavioral2/files/0x0009000000023c3e-16.dat upx behavioral2/memory/4980-28-0x0000000000400000-0x0000000000592000-memory.dmp upx behavioral2/memory/2816-31-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral2/memory/2816-34-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral2/memory/216-37-0x0000000000400000-0x0000000000592000-memory.dmp upx behavioral2/memory/2816-36-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral2/memory/2816-43-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral2/memory/2816-45-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral2/memory/2816-48-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral2/memory/2816-49-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral2/memory/2816-51-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral2/memory/2816-52-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral2/memory/2816-53-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral2/memory/2816-57-0x0000000000400000-0x000000000045C000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 13 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winupdt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winupdt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fe7243dc134d131dec74c5dd59f6c62e506f2bc5161e75430f9e14f64d8fd8ad.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe -
Modifies registry key 1 TTPs 4 IoCs
pid Process 4052 reg.exe 1432 reg.exe 2720 reg.exe 4352 reg.exe -
Suspicious use of AdjustPrivilegeToken 35 IoCs
description pid Process Token: 1 2816 winupdt.exe Token: SeCreateTokenPrivilege 2816 winupdt.exe Token: SeAssignPrimaryTokenPrivilege 2816 winupdt.exe Token: SeLockMemoryPrivilege 2816 winupdt.exe Token: SeIncreaseQuotaPrivilege 2816 winupdt.exe Token: SeMachineAccountPrivilege 2816 winupdt.exe Token: SeTcbPrivilege 2816 winupdt.exe Token: SeSecurityPrivilege 2816 winupdt.exe Token: SeTakeOwnershipPrivilege 2816 winupdt.exe Token: SeLoadDriverPrivilege 2816 winupdt.exe Token: SeSystemProfilePrivilege 2816 winupdt.exe Token: SeSystemtimePrivilege 2816 winupdt.exe Token: SeProfSingleProcessPrivilege 2816 winupdt.exe Token: SeIncBasePriorityPrivilege 2816 winupdt.exe Token: SeCreatePagefilePrivilege 2816 winupdt.exe Token: SeCreatePermanentPrivilege 2816 winupdt.exe Token: SeBackupPrivilege 2816 winupdt.exe Token: SeRestorePrivilege 2816 winupdt.exe Token: SeShutdownPrivilege 2816 winupdt.exe Token: SeDebugPrivilege 2816 winupdt.exe Token: SeAuditPrivilege 2816 winupdt.exe Token: SeSystemEnvironmentPrivilege 2816 winupdt.exe Token: SeChangeNotifyPrivilege 2816 winupdt.exe Token: SeRemoteShutdownPrivilege 2816 winupdt.exe Token: SeUndockPrivilege 2816 winupdt.exe Token: SeSyncAgentPrivilege 2816 winupdt.exe Token: SeEnableDelegationPrivilege 2816 winupdt.exe Token: SeManageVolumePrivilege 2816 winupdt.exe Token: SeImpersonatePrivilege 2816 winupdt.exe Token: SeCreateGlobalPrivilege 2816 winupdt.exe Token: 31 2816 winupdt.exe Token: 32 2816 winupdt.exe Token: 33 2816 winupdt.exe Token: 34 2816 winupdt.exe Token: 35 2816 winupdt.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 4980 fe7243dc134d131dec74c5dd59f6c62e506f2bc5161e75430f9e14f64d8fd8ad.exe 216 winupdt.exe 2816 winupdt.exe 2816 winupdt.exe 2816 winupdt.exe -
Suspicious use of WriteProcessMemory 41 IoCs
description pid Process procid_target PID 4980 wrote to memory of 4988 4980 fe7243dc134d131dec74c5dd59f6c62e506f2bc5161e75430f9e14f64d8fd8ad.exe 86 PID 4980 wrote to memory of 4988 4980 fe7243dc134d131dec74c5dd59f6c62e506f2bc5161e75430f9e14f64d8fd8ad.exe 86 PID 4980 wrote to memory of 4988 4980 fe7243dc134d131dec74c5dd59f6c62e506f2bc5161e75430f9e14f64d8fd8ad.exe 86 PID 4988 wrote to memory of 4956 4988 cmd.exe 89 PID 4988 wrote to memory of 4956 4988 cmd.exe 89 PID 4988 wrote to memory of 4956 4988 cmd.exe 89 PID 4980 wrote to memory of 216 4980 fe7243dc134d131dec74c5dd59f6c62e506f2bc5161e75430f9e14f64d8fd8ad.exe 90 PID 4980 wrote to memory of 216 4980 fe7243dc134d131dec74c5dd59f6c62e506f2bc5161e75430f9e14f64d8fd8ad.exe 90 PID 4980 wrote to memory of 216 4980 fe7243dc134d131dec74c5dd59f6c62e506f2bc5161e75430f9e14f64d8fd8ad.exe 90 PID 216 wrote to memory of 2816 216 winupdt.exe 91 PID 216 wrote to memory of 2816 216 winupdt.exe 91 PID 216 wrote to memory of 2816 216 winupdt.exe 91 PID 216 wrote to memory of 2816 216 winupdt.exe 91 PID 216 wrote to memory of 2816 216 winupdt.exe 91 PID 216 wrote to memory of 2816 216 winupdt.exe 91 PID 216 wrote to memory of 2816 216 winupdt.exe 91 PID 216 wrote to memory of 2816 216 winupdt.exe 91 PID 2816 wrote to memory of 3400 2816 winupdt.exe 92 PID 2816 wrote to memory of 3400 2816 winupdt.exe 92 PID 2816 wrote to memory of 3400 2816 winupdt.exe 92 PID 2816 wrote to memory of 4692 2816 winupdt.exe 93 PID 2816 wrote to memory of 4692 2816 winupdt.exe 93 PID 2816 wrote to memory of 4692 2816 winupdt.exe 93 PID 2816 wrote to memory of 3704 2816 winupdt.exe 95 PID 2816 wrote to memory of 3704 2816 winupdt.exe 95 PID 2816 wrote to memory of 3704 2816 winupdt.exe 95 PID 2816 wrote to memory of 3988 2816 winupdt.exe 96 PID 2816 wrote to memory of 3988 2816 winupdt.exe 96 PID 2816 wrote to memory of 3988 2816 winupdt.exe 96 PID 3400 wrote to memory of 4052 3400 cmd.exe 100 PID 3400 wrote to memory of 4052 3400 cmd.exe 100 PID 3400 wrote to memory of 4052 3400 cmd.exe 100 PID 4692 wrote to memory of 4352 4692 cmd.exe 101 PID 4692 wrote to memory of 4352 4692 cmd.exe 101 PID 4692 wrote to memory of 4352 4692 cmd.exe 101 PID 3704 wrote to memory of 1432 3704 cmd.exe 102 PID 3704 wrote to memory of 1432 3704 cmd.exe 102 PID 3704 wrote to memory of 1432 3704 cmd.exe 102 PID 3988 wrote to memory of 2720 3988 cmd.exe 103 PID 3988 wrote to memory of 2720 3988 cmd.exe 103 PID 3988 wrote to memory of 2720 3988 cmd.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\fe7243dc134d131dec74c5dd59f6c62e506f2bc5161e75430f9e14f64d8fd8ad.exe"C:\Users\Admin\AppData\Local\Temp\fe7243dc134d131dec74c5dd59f6c62e506f2bc5161e75430f9e14f64d8fd8ad.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kdsuy.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Window Updates" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:4956
-
-
-
C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe"C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:216 -
C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe"C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3400 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f5⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:4052
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe:*:Enabled:Windows Messanger" /f4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe:*:Enabled:Windows Messanger" /f5⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:4352
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3704 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f5⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:1432
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Windows Updater.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Windows Updater.exe:*:Enabled:Windows Messanger" /f4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3988 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Windows Updater.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Windows Updater.exe:*:Enabled:Windows Messanger" /f5⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2720
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
158B
MD51954c7e666c5b4d1117ef07bc0c9b8ec
SHA1559e3c0273c1463e9184027b749bdaad0a372681
SHA25635e0dbc8b455ca38976157ce9d0293fd6cdca20f46f1cb69058a1e0f0af6f693
SHA5123939de8d0ab7e67b59ff8bebed5580dafd38d8785193fd42a289728500761a68b9e6660605e19e10d4278dd106fea4b273a208f25485e7389c8f19b2958c926a
-
Filesize
1.6MB
MD5e889f40dce7e795d11914ab78ba03fff
SHA1dca1e1c990de6e72414dfeb0d3b49a48dc6a00a0
SHA256900f9c7aeea1e21e120103e839fde8684d5a2fb5e5b1d0517e09829c445a8c64
SHA512943e7f3ec9be3d91b04f46368bb3a5a1fc9676f74a7cc5000f0a5d509f6e13139f808c700b83199f7ec862aadc5c00617acde9df296ceeda12551a60f63fdb4b