Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
38s -
max time network
42s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
21/09/2022, 07:48
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220812-en
windows7-x64
4 signatures
150 seconds
General
-
Target
file.exe
-
Size
5.7MB
-
MD5
294b523aa2161c9cd5c9b777593caeb1
-
SHA1
0c5824d59d5bd053c4d43fbccbf1a2f12738a349
-
SHA256
b123fe42bed02d6a2e7bf2eaf4c808301e2d8fb1d79af42a3168037057ab491f
-
SHA512
2a2690a61603fb98c128599752405b7d7a90b72e5e180cdd67db344cf0e2a2bb637af0ced63c9744e36fff1f94e8c64c353ac8d675326e118f70572c29219525
-
SSDEEP
49152:PrK4gFKXDqnfpuIHTfg7DbQzDFeygR9fbTMZ0yVoESNrjeRaXkutlkE1gFvFYOaB:PrK41Onfw2fUygLfbTd99e/GY9av/ie
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2020 wmic.exe Token: SeSecurityPrivilege 2020 wmic.exe Token: SeTakeOwnershipPrivilege 2020 wmic.exe Token: SeLoadDriverPrivilege 2020 wmic.exe Token: SeSystemProfilePrivilege 2020 wmic.exe Token: SeSystemtimePrivilege 2020 wmic.exe Token: SeProfSingleProcessPrivilege 2020 wmic.exe Token: SeIncBasePriorityPrivilege 2020 wmic.exe Token: SeCreatePagefilePrivilege 2020 wmic.exe Token: SeBackupPrivilege 2020 wmic.exe Token: SeRestorePrivilege 2020 wmic.exe Token: SeShutdownPrivilege 2020 wmic.exe Token: SeDebugPrivilege 2020 wmic.exe Token: SeSystemEnvironmentPrivilege 2020 wmic.exe Token: SeRemoteShutdownPrivilege 2020 wmic.exe Token: SeUndockPrivilege 2020 wmic.exe Token: SeManageVolumePrivilege 2020 wmic.exe Token: 33 2020 wmic.exe Token: 34 2020 wmic.exe Token: 35 2020 wmic.exe Token: SeIncreaseQuotaPrivilege 2020 wmic.exe Token: SeSecurityPrivilege 2020 wmic.exe Token: SeTakeOwnershipPrivilege 2020 wmic.exe Token: SeLoadDriverPrivilege 2020 wmic.exe Token: SeSystemProfilePrivilege 2020 wmic.exe Token: SeSystemtimePrivilege 2020 wmic.exe Token: SeProfSingleProcessPrivilege 2020 wmic.exe Token: SeIncBasePriorityPrivilege 2020 wmic.exe Token: SeCreatePagefilePrivilege 2020 wmic.exe Token: SeBackupPrivilege 2020 wmic.exe Token: SeRestorePrivilege 2020 wmic.exe Token: SeShutdownPrivilege 2020 wmic.exe Token: SeDebugPrivilege 2020 wmic.exe Token: SeSystemEnvironmentPrivilege 2020 wmic.exe Token: SeRemoteShutdownPrivilege 2020 wmic.exe Token: SeUndockPrivilege 2020 wmic.exe Token: SeManageVolumePrivilege 2020 wmic.exe Token: 33 2020 wmic.exe Token: 34 2020 wmic.exe Token: 35 2020 wmic.exe Token: SeIncreaseQuotaPrivilege 828 WMIC.exe Token: SeSecurityPrivilege 828 WMIC.exe Token: SeTakeOwnershipPrivilege 828 WMIC.exe Token: SeLoadDriverPrivilege 828 WMIC.exe Token: SeSystemProfilePrivilege 828 WMIC.exe Token: SeSystemtimePrivilege 828 WMIC.exe Token: SeProfSingleProcessPrivilege 828 WMIC.exe Token: SeIncBasePriorityPrivilege 828 WMIC.exe Token: SeCreatePagefilePrivilege 828 WMIC.exe Token: SeBackupPrivilege 828 WMIC.exe Token: SeRestorePrivilege 828 WMIC.exe Token: SeShutdownPrivilege 828 WMIC.exe Token: SeDebugPrivilege 828 WMIC.exe Token: SeSystemEnvironmentPrivilege 828 WMIC.exe Token: SeRemoteShutdownPrivilege 828 WMIC.exe Token: SeUndockPrivilege 828 WMIC.exe Token: SeManageVolumePrivilege 828 WMIC.exe Token: 33 828 WMIC.exe Token: 34 828 WMIC.exe Token: 35 828 WMIC.exe Token: SeIncreaseQuotaPrivilege 828 WMIC.exe Token: SeSecurityPrivilege 828 WMIC.exe Token: SeTakeOwnershipPrivilege 828 WMIC.exe Token: SeLoadDriverPrivilege 828 WMIC.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 784 wrote to memory of 2020 784 file.exe 26 PID 784 wrote to memory of 2020 784 file.exe 26 PID 784 wrote to memory of 2020 784 file.exe 26 PID 784 wrote to memory of 2020 784 file.exe 26 PID 784 wrote to memory of 1528 784 file.exe 29 PID 784 wrote to memory of 1528 784 file.exe 29 PID 784 wrote to memory of 1528 784 file.exe 29 PID 784 wrote to memory of 1528 784 file.exe 29 PID 1528 wrote to memory of 828 1528 cmd.exe 31 PID 1528 wrote to memory of 828 1528 cmd.exe 31 PID 1528 wrote to memory of 828 1528 cmd.exe 31 PID 1528 wrote to memory of 828 1528 cmd.exe 31 PID 784 wrote to memory of 988 784 file.exe 32 PID 784 wrote to memory of 988 784 file.exe 32 PID 784 wrote to memory of 988 784 file.exe 32 PID 784 wrote to memory of 988 784 file.exe 32 PID 988 wrote to memory of 1100 988 cmd.exe 34 PID 988 wrote to memory of 1100 988 cmd.exe 34 PID 988 wrote to memory of 1100 988 cmd.exe 34 PID 988 wrote to memory of 1100 988 cmd.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:784 -
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2020
-
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Suspicious use of AdjustPrivilegeToken
PID:828
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic cpu get name"2⤵
- Suspicious use of WriteProcessMemory
PID:988 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get name3⤵PID:1100
-
-