Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    38s
  • max time network
    165s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    22/03/2025, 06:13

General

  • Target

    894b900bb7817bc5ddd0e3ad48eb9c6fbe4ad9ad7741358d311bafe03b988a92.exe

  • Size

    180KB

  • MD5

    a26dfa9f71711828a4e5e3e6857271a7

  • SHA1

    6b6f0282303808f6276f44669a2a4e89d9164fff

  • SHA256

    894b900bb7817bc5ddd0e3ad48eb9c6fbe4ad9ad7741358d311bafe03b988a92

  • SHA512

    c753100036a0d2fd21024d5d0f46a237d02f0afdc6b3abe7e80ed539956c96e550e8beb318316c24cf90937bcbc5e33ff9ed4b09aa17794d9fb4d303f6533993

  • SSDEEP

    3072:t2IdZhG5xJJz5cLQ6XyoF1b3CJtblKXhfRoG0U3LHRnfm7OblaUGU:t2ubG5xJJz6XRzCrb8Xhptl3LHRfmCb

Malware Config

Signatures

  • Event Triggered Execution: AppInit DLLs 1 TTPs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Scheduled Task/Job: Scheduled Task 1 TTPs 15 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\894b900bb7817bc5ddd0e3ad48eb9c6fbe4ad9ad7741358d311bafe03b988a92.exe
    "C:\Users\Admin\AppData\Local\Temp\894b900bb7817bc5ddd0e3ad48eb9c6fbe4ad9ad7741358d311bafe03b988a92.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:932
    • C:\Windows\system32\CMD.exe
      "CMD" netsh advfirewall firewall add rule name=":=@Qf9"1f@0xf3" dir=in action=allow program="C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwd" enable=yes & exit
      2⤵
        PID:2764
      • C:\Windows\system32\cmd.exe
        "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwd" /RL HIGHEST & exit
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2840
        • C:\Windows\system32\schtasks.exe
          schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwd" /RL HIGHEST
          3⤵
          • Scheduled Task/Job: Scheduled Task
          • Suspicious behavior: EnumeratesProcesses
          PID:2976
    • C:\Windows\system32\taskeng.exe
      taskeng.exe {9DB9FAC5-2DF4-44F8-A271-E29EFD415805} S-1-5-21-3692679935-4019334568-335155002-1000:BCXRJFKE\Admin:Interactive:[1]
      1⤵
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1044
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwd
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwd
        2⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:988
        • C:\Windows\system32\cmd.exe
          "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwd" /RL HIGHEST & exit
          3⤵
            PID:1320
            • C:\Windows\system32\schtasks.exe
              schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwd" /RL HIGHEST
              4⤵
              • Scheduled Task/Job: Scheduled Task
              PID:564
        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwd
          C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwd
          2⤵
            PID:1756
            • C:\Windows\system32\cmd.exe
              "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwd" /RL HIGHEST & exit
              3⤵
                PID:624
                • C:\Windows\system32\schtasks.exe
                  schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwd" /RL HIGHEST
                  4⤵
                  • Scheduled Task/Job: Scheduled Task
                  PID:1368
            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwd
              C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwd
              2⤵
                PID:1624
                • C:\Windows\system32\cmd.exe
                  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwd" /RL HIGHEST & exit
                  3⤵
                    PID:1564
                    • C:\Windows\system32\schtasks.exe
                      schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwd" /RL HIGHEST
                      4⤵
                      • Scheduled Task/Job: Scheduled Task
                      PID:1588
                  • C:\Windows\system32\cmd.exe
                    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwd" /RL HIGHEST & exit
                    3⤵
                      PID:920
                      • C:\Windows\system32\schtasks.exe
                        schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwd" /RL HIGHEST
                        4⤵
                        • Scheduled Task/Job: Scheduled Task
                        PID:2016
                    • C:\Windows\system32\cmd.exe
                      "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwd" /RL HIGHEST & exit
                      3⤵
                        PID:2300
                        • C:\Windows\system32\schtasks.exe
                          schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwd" /RL HIGHEST
                          4⤵
                          • Scheduled Task/Job: Scheduled Task
                          PID:1640
                      • C:\Windows\system32\cmd.exe
                        "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwd" /RL HIGHEST & exit
                        3⤵
                          PID:1508
                          • C:\Windows\system32\schtasks.exe
                            schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwd" /RL HIGHEST
                            4⤵
                            • Scheduled Task/Job: Scheduled Task
                            PID:1032
                        • C:\Windows\system32\cmd.exe
                          "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwd" /RL HIGHEST & exit
                          3⤵
                            PID:836
                            • C:\Windows\system32\schtasks.exe
                              schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwd" /RL HIGHEST
                              4⤵
                              • Scheduled Task/Job: Scheduled Task
                              PID:2544
                          • C:\Windows\system32\cmd.exe
                            "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwd" /RL HIGHEST & exit
                            3⤵
                              PID:2868
                              • C:\Windows\system32\schtasks.exe
                                schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwd" /RL HIGHEST
                                4⤵
                                • Scheduled Task/Job: Scheduled Task
                                PID:2856
                            • C:\Windows\system32\cmd.exe
                              "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwd" /RL HIGHEST & exit
                              3⤵
                                PID:2116
                                • C:\Windows\system32\schtasks.exe
                                  schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwd" /RL HIGHEST
                                  4⤵
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:2756
                              • C:\Windows\system32\cmd.exe
                                "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwd" /RL HIGHEST & exit
                                3⤵
                                  PID:2660
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwd" /RL HIGHEST
                                    4⤵
                                    • Scheduled Task/Job: Scheduled Task
                                    PID:3008
                                • C:\Windows\system32\cmd.exe
                                  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwd" /RL HIGHEST & exit
                                  3⤵
                                    PID:264
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwd" /RL HIGHEST
                                      4⤵
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:2644
                                  • C:\Windows\system32\cmd.exe
                                    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwd" /RL HIGHEST & exit
                                    3⤵
                                      PID:1372
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwd" /RL HIGHEST
                                        4⤵
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:2360
                                    • C:\Windows\system32\cmd.exe
                                      "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwd" /RL HIGHEST & exit
                                      3⤵
                                        PID:1696
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwd" /RL HIGHEST
                                          4⤵
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:2984
                                      • C:\Windows\system32\cmd.exe
                                        "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwd" /RL HIGHEST & exit
                                        3⤵
                                          PID:1036
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwd" /RL HIGHEST
                                            4⤵
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:1616

                                    Network

                                    MITRE ATT&CK Enterprise v15

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    • C:\Windows\xdwd.dll

                                      Filesize

                                      136KB

                                      MD5

                                      16e5a492c9c6ae34c59683be9c51fa31

                                      SHA1

                                      97031b41f5c56f371c28ae0d62a2df7d585adaba

                                      SHA256

                                      35c8d022e1d917f1aabdceae98097ccc072161b302f84c768ca63e4b32ac2b66

                                      SHA512

                                      20fd369172ef5e3e2fde388666b42e8fe5f0c2bfa338c0345f45e98af6561a249ba3ecc48c3f16efcc73f02ecb67b3ddb1e2e8f0e77d18fa00ac34e6379e50b6

                                    • \Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwd

                                      Filesize

                                      180KB

                                      MD5

                                      a26dfa9f71711828a4e5e3e6857271a7

                                      SHA1

                                      6b6f0282303808f6276f44669a2a4e89d9164fff

                                      SHA256

                                      894b900bb7817bc5ddd0e3ad48eb9c6fbe4ad9ad7741358d311bafe03b988a92

                                      SHA512

                                      c753100036a0d2fd21024d5d0f46a237d02f0afdc6b3abe7e80ed539956c96e550e8beb318316c24cf90937bcbc5e33ff9ed4b09aa17794d9fb4d303f6533993

                                    • memory/264-82-0x000007FEF81D0000-0x000007FEF81F2000-memory.dmp

                                      Filesize

                                      136KB

                                    • memory/564-24-0x000007FEF81D0000-0x000007FEF81F2000-memory.dmp

                                      Filesize

                                      136KB

                                    • memory/624-39-0x000007FEF81D0000-0x000007FEF81F2000-memory.dmp

                                      Filesize

                                      136KB

                                    • memory/836-70-0x000007FEF81D0000-0x000007FEF81F2000-memory.dmp

                                      Filesize

                                      136KB

                                    • memory/920-60-0x000007FEF81D0000-0x000007FEF81F2000-memory.dmp

                                      Filesize

                                      136KB

                                    • memory/932-0-0x000007FEF64B3000-0x000007FEF64B4000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/932-1-0x000000013F550000-0x000000013F582000-memory.dmp

                                      Filesize

                                      200KB

                                    • memory/932-11-0x000007FEF64B0000-0x000007FEF6E9C000-memory.dmp

                                      Filesize

                                      9.9MB

                                    • memory/932-5-0x000007FEF64B0000-0x000007FEF6E9C000-memory.dmp

                                      Filesize

                                      9.9MB

                                    • memory/988-23-0x000000013F920000-0x000000013F952000-memory.dmp

                                      Filesize

                                      200KB

                                    • memory/988-26-0x000007FEF81D0000-0x000007FEF81F2000-memory.dmp

                                      Filesize

                                      136KB

                                    • memory/1032-65-0x000007FEF81D0000-0x000007FEF81F2000-memory.dmp

                                      Filesize

                                      136KB

                                    • memory/1036-90-0x000007FEF81D0000-0x000007FEF81F2000-memory.dmp

                                      Filesize

                                      136KB

                                    • memory/1044-36-0x000007FEF81D0000-0x000007FEF81F2000-memory.dmp

                                      Filesize

                                      136KB

                                    • memory/1044-16-0x0000000077C90000-0x0000000077E39000-memory.dmp

                                      Filesize

                                      1.7MB

                                    • memory/1044-18-0x0000000077C90000-0x0000000077E39000-memory.dmp

                                      Filesize

                                      1.7MB

                                    • memory/1044-17-0x0000000077C90000-0x0000000077E39000-memory.dmp

                                      Filesize

                                      1.7MB

                                    • memory/1044-61-0x000007FEF81D0000-0x000007FEF81F2000-memory.dmp

                                      Filesize

                                      136KB

                                    • memory/1044-30-0x000007FEF81D0000-0x000007FEF81F2000-memory.dmp

                                      Filesize

                                      136KB

                                    • memory/1044-27-0x0000000077C90000-0x0000000077E39000-memory.dmp

                                      Filesize

                                      1.7MB

                                    • memory/1044-28-0x000007FEF81D0000-0x000007FEF81F2000-memory.dmp

                                      Filesize

                                      136KB

                                    • memory/1320-25-0x000007FEF81D0000-0x000007FEF81F2000-memory.dmp

                                      Filesize

                                      136KB

                                    • memory/1368-38-0x000007FEF81D0000-0x000007FEF81F2000-memory.dmp

                                      Filesize

                                      136KB

                                    • memory/1372-84-0x000007FEF81D0000-0x000007FEF81F2000-memory.dmp

                                      Filesize

                                      136KB

                                    • memory/1508-66-0x000007FEF81D0000-0x000007FEF81F2000-memory.dmp

                                      Filesize

                                      136KB

                                    • memory/1564-41-0x000007FEF81D0000-0x000007FEF81F2000-memory.dmp

                                      Filesize

                                      136KB

                                    • memory/1588-40-0x000007FEF81D0000-0x000007FEF81F2000-memory.dmp

                                      Filesize

                                      136KB

                                    • memory/1616-89-0x000007FEF81D0000-0x000007FEF81F2000-memory.dmp

                                      Filesize

                                      136KB

                                    • memory/1624-62-0x000007FEF81D0000-0x000007FEF81F2000-memory.dmp

                                      Filesize

                                      136KB

                                    • memory/1624-74-0x000007FEF81D0000-0x000007FEF81F2000-memory.dmp

                                      Filesize

                                      136KB

                                    • memory/1624-35-0x000000013FB80000-0x000000013FBB2000-memory.dmp

                                      Filesize

                                      200KB

                                    • memory/1624-68-0x000007FEF81D0000-0x000007FEF81F2000-memory.dmp

                                      Filesize

                                      136KB

                                    • memory/1640-63-0x000007FEF81D0000-0x000007FEF81F2000-memory.dmp

                                      Filesize

                                      136KB

                                    • memory/1696-88-0x000007FEF81D0000-0x000007FEF81F2000-memory.dmp

                                      Filesize

                                      136KB

                                    • memory/1756-37-0x000007FEF81D0000-0x000007FEF81F2000-memory.dmp

                                      Filesize

                                      136KB

                                    • memory/2016-59-0x000007FEF81D0000-0x000007FEF81F2000-memory.dmp

                                      Filesize

                                      136KB

                                    • memory/2116-76-0x000007FEF81D0000-0x000007FEF81F2000-memory.dmp

                                      Filesize

                                      136KB

                                    • memory/2300-64-0x000007FEF81D0000-0x000007FEF81F2000-memory.dmp

                                      Filesize

                                      136KB

                                    • memory/2360-83-0x000007FEF81D0000-0x000007FEF81F2000-memory.dmp

                                      Filesize

                                      136KB

                                    • memory/2544-69-0x000007FEF81D0000-0x000007FEF81F2000-memory.dmp

                                      Filesize

                                      136KB

                                    • memory/2644-81-0x000007FEF81D0000-0x000007FEF81F2000-memory.dmp

                                      Filesize

                                      136KB

                                    • memory/2660-78-0x000007FEF81D0000-0x000007FEF81F2000-memory.dmp

                                      Filesize

                                      136KB

                                    • memory/2756-75-0x000007FEF81D0000-0x000007FEF81F2000-memory.dmp

                                      Filesize

                                      136KB

                                    • memory/2840-14-0x000007FEF7320000-0x000007FEF7342000-memory.dmp

                                      Filesize

                                      136KB

                                    • memory/2840-7-0x0000000077C90000-0x0000000077E39000-memory.dmp

                                      Filesize

                                      1.7MB

                                    • memory/2840-15-0x0000000077C90000-0x0000000077E39000-memory.dmp

                                      Filesize

                                      1.7MB

                                    • memory/2840-6-0x0000000077CE1000-0x0000000077CE2000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/2856-71-0x000007FEF81D0000-0x000007FEF81F2000-memory.dmp

                                      Filesize

                                      136KB

                                    • memory/2868-72-0x000007FEF81D0000-0x000007FEF81F2000-memory.dmp

                                      Filesize

                                      136KB

                                    • memory/2976-8-0x0000000077C90000-0x0000000077E39000-memory.dmp

                                      Filesize

                                      1.7MB

                                    • memory/2976-10-0x0000000077C90000-0x0000000077E39000-memory.dmp

                                      Filesize

                                      1.7MB

                                    • memory/2976-9-0x0000000077C90000-0x0000000077E39000-memory.dmp

                                      Filesize

                                      1.7MB

                                    • memory/2976-12-0x000007FEF7320000-0x000007FEF7342000-memory.dmp

                                      Filesize

                                      136KB

                                    • memory/2976-13-0x0000000077C90000-0x0000000077E39000-memory.dmp

                                      Filesize

                                      1.7MB

                                    • memory/2984-87-0x000007FEF81D0000-0x000007FEF81F2000-memory.dmp

                                      Filesize

                                      136KB

                                    • memory/3008-77-0x000007FEF81D0000-0x000007FEF81F2000-memory.dmp

                                      Filesize

                                      136KB