Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
24/09/2022, 13:42
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220812-en
General
-
Target
file.exe
-
Size
284KB
-
MD5
5cd9388b0e60981c36bc0553a1ca540a
-
SHA1
3227b002a4f6b6e0b1962ca395133b1dc8c77e84
-
SHA256
4ccaf0fd0ebf9417aae0e341166b21f3429908e3710d1c745344c399893cb669
-
SHA512
7d820dc13a8d8ca8d4798038b1d94122615c5b5f413f9c5de41eb2692ed0a512a6266751d12e8084b20f06ccc7e44f374f471a746c20287a98218b3a357126cc
-
SSDEEP
3072:FJOaLxo02cb5wPpkxYlpkqYSegeCgdLQjNHg7RA+zVRCnWPaVZdiuhz82Dk+Exx1:fLd2VBl3HgNQjF+zV8WPG5Fw+qx32AY
Malware Config
Extracted
nymaim
208.67.104.97
85.31.46.167
Signatures
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
pid Process 572 Cleaner.exe -
Deletes itself 1 IoCs
pid Process 1752 cmd.exe -
Loads dropped DLL 1 IoCs
pid Process 764 cmd.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
pid pid_target Process procid_target 1972 572 WerFault.exe 30 -
Kills process with taskkill 1 IoCs
pid Process 1748 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 1088 file.exe 1088 file.exe 1088 file.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 572 Cleaner.exe Token: SeDebugPrivilege 1748 taskkill.exe -
Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 1088 wrote to memory of 764 1088 file.exe 28 PID 1088 wrote to memory of 764 1088 file.exe 28 PID 1088 wrote to memory of 764 1088 file.exe 28 PID 1088 wrote to memory of 764 1088 file.exe 28 PID 764 wrote to memory of 572 764 cmd.exe 30 PID 764 wrote to memory of 572 764 cmd.exe 30 PID 764 wrote to memory of 572 764 cmd.exe 30 PID 764 wrote to memory of 572 764 cmd.exe 30 PID 572 wrote to memory of 1972 572 Cleaner.exe 32 PID 572 wrote to memory of 1972 572 Cleaner.exe 32 PID 572 wrote to memory of 1972 572 Cleaner.exe 32 PID 1088 wrote to memory of 1752 1088 file.exe 33 PID 1088 wrote to memory of 1752 1088 file.exe 33 PID 1088 wrote to memory of 1752 1088 file.exe 33 PID 1088 wrote to memory of 1752 1088 file.exe 33 PID 1752 wrote to memory of 1748 1752 cmd.exe 35 PID 1752 wrote to memory of 1748 1752 cmd.exe 35 PID 1752 wrote to memory of 1748 1752 cmd.exe 35 PID 1752 wrote to memory of 1748 1752 cmd.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\h1g35uTkizn\Cleaner.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:764 -
C:\Users\Admin\AppData\Local\Temp\h1g35uTkizn\Cleaner.exe"C:\Users\Admin\AppData\Local\Temp\h1g35uTkizn\Cleaner.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:572 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 572 -s 11564⤵
- Program crash
PID:1972
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "file.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\file.exe" & exit2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "file.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1748
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
236KB
MD52ecb51ab00c5f340380ecf849291dbcf
SHA11a4dffbce2a4ce65495ed79eab42a4da3b660931
SHA256f1b3e0f2750a9103e46a6a4a34f1cf9d17779725f98042cc2475ec66484801cf
SHA512e241a48eafcaf99187035f0870d24d74ae97fe84aaadd2591cceea9f64b8223d77cfb17a038a58eadd3b822c5201a6f7494f26eea6f77d95f77f6c668d088e6b
-
Filesize
3.8MB
MD523c1e8f48ec06960bbd9969c1f404192
SHA1b9384151eb3f2dbd095fa273c248722e1cc74ea3
SHA256301d9c55653f6cd8211aafdaf130092cb7ef8ea2e54db2db97153c1c8abf272c
SHA512f572e3a0ad58b3a1ed22db00b05a3909f7f53f70b84ab736e2dd6ddc54d8781fcffe4a9b33b0dd2836d438a1982b944426fe4ed01bd866bd77e20046220f2b5b
-
Filesize
3.8MB
MD523c1e8f48ec06960bbd9969c1f404192
SHA1b9384151eb3f2dbd095fa273c248722e1cc74ea3
SHA256301d9c55653f6cd8211aafdaf130092cb7ef8ea2e54db2db97153c1c8abf272c
SHA512f572e3a0ad58b3a1ed22db00b05a3909f7f53f70b84ab736e2dd6ddc54d8781fcffe4a9b33b0dd2836d438a1982b944426fe4ed01bd866bd77e20046220f2b5b
-
Filesize
3.8MB
MD523c1e8f48ec06960bbd9969c1f404192
SHA1b9384151eb3f2dbd095fa273c248722e1cc74ea3
SHA256301d9c55653f6cd8211aafdaf130092cb7ef8ea2e54db2db97153c1c8abf272c
SHA512f572e3a0ad58b3a1ed22db00b05a3909f7f53f70b84ab736e2dd6ddc54d8781fcffe4a9b33b0dd2836d438a1982b944426fe4ed01bd866bd77e20046220f2b5b