Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
23/09/2022, 22:28
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220812-en
General
-
Target
file.exe
-
Size
275KB
-
MD5
795c64cb86bb41b400ef54d253b0ea89
-
SHA1
c467e9b37e8554e9a8882d3eb1e2796bf387412f
-
SHA256
2f45b8aae288b3abbbb7ed8d9ecfa3ae435920d295480b537e2fd6a00a144d21
-
SHA512
3f0581fe8cb910eafe58bb75cc09014955d810fb80255337eac6437e80ed6021397ba04016743f1d295e0c5b3739e4c6564635fedb56b0892a5074868420e083
-
SSDEEP
3072:z+M8SsL6u3IIE75ixwGsvn9rT7sUnWThyILYSxRbBJAD7LFsylNoChrXOBfeE/P:0L7E41svhT7s0WYI9xRb+7maoCdXKe
Malware Config
Extracted
nymaim
208.67.104.97
85.31.46.167
Signatures
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
pid Process 1612 Cleaner.exe -
Deletes itself 1 IoCs
pid Process 756 cmd.exe -
Loads dropped DLL 1 IoCs
pid Process 980 cmd.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
pid pid_target Process procid_target 552 1612 WerFault.exe 30 -
Kills process with taskkill 1 IoCs
pid Process 1592 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 1300 file.exe 1300 file.exe 1300 file.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1612 Cleaner.exe Token: SeDebugPrivilege 1592 taskkill.exe -
Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 1300 wrote to memory of 980 1300 file.exe 28 PID 1300 wrote to memory of 980 1300 file.exe 28 PID 1300 wrote to memory of 980 1300 file.exe 28 PID 1300 wrote to memory of 980 1300 file.exe 28 PID 980 wrote to memory of 1612 980 cmd.exe 30 PID 980 wrote to memory of 1612 980 cmd.exe 30 PID 980 wrote to memory of 1612 980 cmd.exe 30 PID 980 wrote to memory of 1612 980 cmd.exe 30 PID 1612 wrote to memory of 552 1612 Cleaner.exe 32 PID 1612 wrote to memory of 552 1612 Cleaner.exe 32 PID 1612 wrote to memory of 552 1612 Cleaner.exe 32 PID 1300 wrote to memory of 756 1300 file.exe 33 PID 1300 wrote to memory of 756 1300 file.exe 33 PID 1300 wrote to memory of 756 1300 file.exe 33 PID 1300 wrote to memory of 756 1300 file.exe 33 PID 756 wrote to memory of 1592 756 cmd.exe 35 PID 756 wrote to memory of 1592 756 cmd.exe 35 PID 756 wrote to memory of 1592 756 cmd.exe 35 PID 756 wrote to memory of 1592 756 cmd.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\SamSAhw6IXt4Rs8NDoCOeVNi9\Cleaner.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:980 -
C:\Users\Admin\AppData\Local\Temp\SamSAhw6IXt4Rs8NDoCOeVNi9\Cleaner.exe"C:\Users\Admin\AppData\Local\Temp\SamSAhw6IXt4Rs8NDoCOeVNi9\Cleaner.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1612 -s 11524⤵
- Program crash
PID:552
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "file.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\file.exe" & exit2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:756 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "file.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1592
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
236KB
MD52ecb51ab00c5f340380ecf849291dbcf
SHA11a4dffbce2a4ce65495ed79eab42a4da3b660931
SHA256f1b3e0f2750a9103e46a6a4a34f1cf9d17779725f98042cc2475ec66484801cf
SHA512e241a48eafcaf99187035f0870d24d74ae97fe84aaadd2591cceea9f64b8223d77cfb17a038a58eadd3b822c5201a6f7494f26eea6f77d95f77f6c668d088e6b
-
Filesize
3.8MB
MD523c1e8f48ec06960bbd9969c1f404192
SHA1b9384151eb3f2dbd095fa273c248722e1cc74ea3
SHA256301d9c55653f6cd8211aafdaf130092cb7ef8ea2e54db2db97153c1c8abf272c
SHA512f572e3a0ad58b3a1ed22db00b05a3909f7f53f70b84ab736e2dd6ddc54d8781fcffe4a9b33b0dd2836d438a1982b944426fe4ed01bd866bd77e20046220f2b5b
-
Filesize
3.8MB
MD523c1e8f48ec06960bbd9969c1f404192
SHA1b9384151eb3f2dbd095fa273c248722e1cc74ea3
SHA256301d9c55653f6cd8211aafdaf130092cb7ef8ea2e54db2db97153c1c8abf272c
SHA512f572e3a0ad58b3a1ed22db00b05a3909f7f53f70b84ab736e2dd6ddc54d8781fcffe4a9b33b0dd2836d438a1982b944426fe4ed01bd866bd77e20046220f2b5b
-
Filesize
3.8MB
MD523c1e8f48ec06960bbd9969c1f404192
SHA1b9384151eb3f2dbd095fa273c248722e1cc74ea3
SHA256301d9c55653f6cd8211aafdaf130092cb7ef8ea2e54db2db97153c1c8abf272c
SHA512f572e3a0ad58b3a1ed22db00b05a3909f7f53f70b84ab736e2dd6ddc54d8781fcffe4a9b33b0dd2836d438a1982b944426fe4ed01bd866bd77e20046220f2b5b