Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
115s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
24/09/2022, 22:02
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220812-en
General
-
Target
file.exe
-
Size
284KB
-
MD5
0f2971d01eaa04817d8b249cf92ef256
-
SHA1
10ce251ca6f7a43c27d76b592352baa03a5ed8d0
-
SHA256
bedaf1afc3514b562f9f12ed77db321f3fd72940c9883f9f6f837fae6992d0ce
-
SHA512
f87cb2001c46398881a7d8bb0632afa56a3dd0a6a3f0deccddf858204d7e5cab73da5c9f6117ca0eb405a3311939bd59bcfd469f6d3d26a13e7390ec74fc364a
-
SSDEEP
3072:xkjLhLsmMWPN57R5vPYXghTaEOX50VrWHWYGYBmzlXSlye3sKf+kLYFx33DB1B5Y:MLkWDwXgUXX50VrqbG1SLsXkW3D3w
Malware Config
Extracted
nymaim
208.67.104.97
85.31.46.167
Signatures
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
pid Process 664 Cleaner.exe -
Deletes itself 1 IoCs
pid Process 1832 cmd.exe -
Loads dropped DLL 1 IoCs
pid Process 1168 cmd.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
pid pid_target Process procid_target 1992 664 WerFault.exe 32 -
Kills process with taskkill 1 IoCs
pid Process 1100 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 1764 file.exe 1764 file.exe 1764 file.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 664 Cleaner.exe Token: SeDebugPrivilege 1100 taskkill.exe -
Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 1764 wrote to memory of 1168 1764 file.exe 30 PID 1764 wrote to memory of 1168 1764 file.exe 30 PID 1764 wrote to memory of 1168 1764 file.exe 30 PID 1764 wrote to memory of 1168 1764 file.exe 30 PID 1168 wrote to memory of 664 1168 cmd.exe 32 PID 1168 wrote to memory of 664 1168 cmd.exe 32 PID 1168 wrote to memory of 664 1168 cmd.exe 32 PID 1168 wrote to memory of 664 1168 cmd.exe 32 PID 664 wrote to memory of 1992 664 Cleaner.exe 34 PID 664 wrote to memory of 1992 664 Cleaner.exe 34 PID 664 wrote to memory of 1992 664 Cleaner.exe 34 PID 1764 wrote to memory of 1832 1764 file.exe 35 PID 1764 wrote to memory of 1832 1764 file.exe 35 PID 1764 wrote to memory of 1832 1764 file.exe 35 PID 1764 wrote to memory of 1832 1764 file.exe 35 PID 1832 wrote to memory of 1100 1832 cmd.exe 37 PID 1832 wrote to memory of 1100 1832 cmd.exe 37 PID 1832 wrote to memory of 1100 1832 cmd.exe 37 PID 1832 wrote to memory of 1100 1832 cmd.exe 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\QuOVfp5w3qJzsC71nniZyzRv\Cleaner.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\QuOVfp5w3qJzsC71nniZyzRv\Cleaner.exe"C:\Users\Admin\AppData\Local\Temp\QuOVfp5w3qJzsC71nniZyzRv\Cleaner.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:664 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 664 -s 11484⤵
- Program crash
PID:1992
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "file.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\file.exe" & exit2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "file.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1100
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
236KB
MD52ecb51ab00c5f340380ecf849291dbcf
SHA11a4dffbce2a4ce65495ed79eab42a4da3b660931
SHA256f1b3e0f2750a9103e46a6a4a34f1cf9d17779725f98042cc2475ec66484801cf
SHA512e241a48eafcaf99187035f0870d24d74ae97fe84aaadd2591cceea9f64b8223d77cfb17a038a58eadd3b822c5201a6f7494f26eea6f77d95f77f6c668d088e6b
-
Filesize
3.8MB
MD523c1e8f48ec06960bbd9969c1f404192
SHA1b9384151eb3f2dbd095fa273c248722e1cc74ea3
SHA256301d9c55653f6cd8211aafdaf130092cb7ef8ea2e54db2db97153c1c8abf272c
SHA512f572e3a0ad58b3a1ed22db00b05a3909f7f53f70b84ab736e2dd6ddc54d8781fcffe4a9b33b0dd2836d438a1982b944426fe4ed01bd866bd77e20046220f2b5b
-
Filesize
3.8MB
MD523c1e8f48ec06960bbd9969c1f404192
SHA1b9384151eb3f2dbd095fa273c248722e1cc74ea3
SHA256301d9c55653f6cd8211aafdaf130092cb7ef8ea2e54db2db97153c1c8abf272c
SHA512f572e3a0ad58b3a1ed22db00b05a3909f7f53f70b84ab736e2dd6ddc54d8781fcffe4a9b33b0dd2836d438a1982b944426fe4ed01bd866bd77e20046220f2b5b
-
Filesize
3.8MB
MD523c1e8f48ec06960bbd9969c1f404192
SHA1b9384151eb3f2dbd095fa273c248722e1cc74ea3
SHA256301d9c55653f6cd8211aafdaf130092cb7ef8ea2e54db2db97153c1c8abf272c
SHA512f572e3a0ad58b3a1ed22db00b05a3909f7f53f70b84ab736e2dd6ddc54d8781fcffe4a9b33b0dd2836d438a1982b944426fe4ed01bd866bd77e20046220f2b5b