Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
23/09/2022, 13:07
Static task
static1
Behavioral task
behavioral1
Sample
wire_deposito# 00711 23-09-2022_IMG.exe
Resource
win7-20220812-en
General
-
Target
wire_deposito# 00711 23-09-2022_IMG.exe
-
Size
294KB
-
MD5
ebf3bd44feb646d0113e34451935faec
-
SHA1
ff2c6c0ceacd9a97c845a1e4056ab7e1c097cf51
-
SHA256
3d4bcb3525d58d2270133e0349f8cc3463a2c5b151e8cc7b1580806c6e86fbf8
-
SHA512
b30b45f6c9b86be224078bd524f45df6db5b4d488ad257743c9ceb869e993e2c1c1296361f29c0279890c32a071950c3678651d5d9a70526cd489f96baaa05e1
-
SSDEEP
6144:UL8i9w0XHrJ7Cj3Z3I5shJd78mf9EFV2PsN2sFzVELTlg:ImqF7Mp3IKhJ58mf9E/QOFz8Tlg
Malware Config
Extracted
formbook
dqrv
gBpw3Y4HTb1jiULo0eCNvVa1AUM=
ZrxXzYYGEr9rmw==
WZd0tp8eMltMtoAQ
sTwbDYOvwP/e+cIy7A==
2x9+6pABEr9rmw==
5APZR17a7SLBJ+uLaEHxQVMMVQ==
To5y5LGTop5N9MKIDJI7Rqg=
HmLC9XPWGo8wbVA1OzzbDM4Dgob+z9M=
qU4wemvm5BXKPhm7k4I6bXMpXw==
1/9k1Q9Dz2scN+VeSlk9UKk=
ocWw8L31/TrpUDjjh8hx2g==
ULSzhA6L41v+PzP1wJ5BbXMpXw==
2WPGn5/sP28R
CjKXeM4dKWwZ
219OmV+FktZrolf1zb1esHSEyvduDQ==
O3zrtJsXCr9ekQ==
QakRaQV0wTrlFwfVh8hx2g==
7kG0LMk1hfuox2rTkaJSbXMpXw==
+UQrlVma3UXyhDAA7g==
A4Hkzb/3ubdkJdfXmOw=
Qsael+UDEr9rmw==
oOxFRjFd8q1kg0PEjIk5bXMpXw==
NFrDspXTxv+qMeGuVPqZ
sMemh+bTU9uD6Fj15A==
kqYN9834v3RlP0A=
njYyeHBEs3RlP0A=
6QhlNxNKE/yrnqI48HEpsqWO10dw
kezeEfdyb5OEx3YJ
bvNNNRpX75RBSUz/v/qn88+3gjAQtsWn7A==
2Q5qNzu7j4Q2+9auVPqZ
KH7kVv9t6qNMUf+JY54/s52O10dw
UNfKLvs1Q2MUu3EN+4QzsaWO10dw
EEW2+Yz/Tb126Fj15A==
MGpEna/sP28R
2r1R7SIRo2k=
o+JNKAxIEfmxnYJXN3pcmICntUs=
2PdJIQMfr2EXV0UBwHpoZCtP
fAFhNzu0d4EgsFkj/Q==
ATKmk322gHsj0IQV/K9BbXMpXw==
Y9e999dp7HRlP0A=
zB571CslHBPFnZu1VrZmO9mUQwJ4
DC6tppDPlqGEx3YJ
pS6f7YTrQL126Fj15A==
7GPeGIwJWp7CsnES
Mo58zqfYayXFdSPSUOeT
Gn4D598ZF1yEZHwe
N0qtkZYF2Nly5uakclYMpIGG+/orwco=
3kad1wktvoInD9fXmOw=
LLGk/LnsADrpfjbd2n5oZCtP
qRB0XUvCnYc0892bF6szzQ==
teTVvSlneKuEZHwe
oxqR9pQLZcly6Fj15A==
9zEmeYsN5umTNuFLHsR81KSO10dw
PHbp08n9mErv/NfXmOw=
txgBX3/nv3RlP0A=
I6EDDd4bEr9rmw==
CpD3+skREr9rmw==
Y8Kl4OFreahAsqZNFhC8B9H8gzAQtsWn7A==
hu/YM0vEzfusNi4H235oZCtP
yF1BQPJ17nRlP0A=
DUpQrWuhtPKxKctRMtBzvxuO10dw
JY7o2etmKyHMdTMCjMNhw6/ZW5NnSAiN
muTLDQp7QEXYJxHZh8hx2g==
fLgqAgVrMiHMgCaMXP2WvgugoxaNcTW07A==
easternsd.com
Signatures
-
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2736 set thread context of 744 2736 wire_deposito# 00711 23-09-2022_IMG.exe 82 PID 744 set thread context of 2804 744 aspnet_compiler.exe 48 PID 4932 set thread context of 2804 4932 raserver.exe 48 -
description ioc Process Key created \Registry\User\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 raserver.exe -
Suspicious behavior: EnumeratesProcesses 62 IoCs
pid Process 744 aspnet_compiler.exe 744 aspnet_compiler.exe 744 aspnet_compiler.exe 744 aspnet_compiler.exe 744 aspnet_compiler.exe 744 aspnet_compiler.exe 744 aspnet_compiler.exe 744 aspnet_compiler.exe 4932 raserver.exe 4932 raserver.exe 4932 raserver.exe 4932 raserver.exe 4932 raserver.exe 4932 raserver.exe 4932 raserver.exe 4932 raserver.exe 4932 raserver.exe 4932 raserver.exe 4932 raserver.exe 4932 raserver.exe 4932 raserver.exe 4932 raserver.exe 4932 raserver.exe 4932 raserver.exe 4932 raserver.exe 4932 raserver.exe 4932 raserver.exe 4932 raserver.exe 4932 raserver.exe 4932 raserver.exe 4932 raserver.exe 4932 raserver.exe 4932 raserver.exe 4932 raserver.exe 4932 raserver.exe 4932 raserver.exe 4932 raserver.exe 4932 raserver.exe 4932 raserver.exe 4932 raserver.exe 4932 raserver.exe 4932 raserver.exe 4932 raserver.exe 4932 raserver.exe 4932 raserver.exe 4932 raserver.exe 4932 raserver.exe 4932 raserver.exe 4932 raserver.exe 4932 raserver.exe 4932 raserver.exe 4932 raserver.exe 4932 raserver.exe 4932 raserver.exe 4932 raserver.exe 4932 raserver.exe 4932 raserver.exe 4932 raserver.exe 4932 raserver.exe 4932 raserver.exe 4932 raserver.exe 4932 raserver.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2804 Explorer.EXE -
Suspicious behavior: MapViewOfSection 7 IoCs
pid Process 744 aspnet_compiler.exe 744 aspnet_compiler.exe 744 aspnet_compiler.exe 4932 raserver.exe 4932 raserver.exe 4932 raserver.exe 4932 raserver.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 744 aspnet_compiler.exe Token: SeDebugPrivilege 4932 raserver.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2736 wrote to memory of 744 2736 wire_deposito# 00711 23-09-2022_IMG.exe 82 PID 2736 wrote to memory of 744 2736 wire_deposito# 00711 23-09-2022_IMG.exe 82 PID 2736 wrote to memory of 744 2736 wire_deposito# 00711 23-09-2022_IMG.exe 82 PID 2736 wrote to memory of 744 2736 wire_deposito# 00711 23-09-2022_IMG.exe 82 PID 2736 wrote to memory of 744 2736 wire_deposito# 00711 23-09-2022_IMG.exe 82 PID 2736 wrote to memory of 744 2736 wire_deposito# 00711 23-09-2022_IMG.exe 82 PID 2804 wrote to memory of 4932 2804 Explorer.EXE 98 PID 2804 wrote to memory of 4932 2804 Explorer.EXE 98 PID 2804 wrote to memory of 4932 2804 Explorer.EXE 98 PID 4932 wrote to memory of 2112 4932 raserver.exe 105 PID 4932 wrote to memory of 2112 4932 raserver.exe 105 PID 4932 wrote to memory of 2112 4932 raserver.exe 105
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\wire_deposito# 00711 23-09-2022_IMG.exe"C:\Users\Admin\AppData\Local\Temp\wire_deposito# 00711 23-09-2022_IMG.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:744
-
-
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵PID:3912
-
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵PID:4588
-
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵PID:4964
-
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵PID:1960
-
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵PID:1636
-
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵PID:1736
-
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵PID:4972
-
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵PID:1984
-
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵PID:520
-
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵PID:5048
-
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵PID:4912
-
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵PID:1180
-
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵PID:2036
-
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵PID:4892
-
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵PID:4924
-
-
C:\Windows\SysWOW64\raserver.exe"C:\Windows\SysWOW64\raserver.exe"2⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:2112
-
-