Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
30/09/2022, 23:13
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220812-en
General
-
Target
file.exe
-
Size
233KB
-
MD5
66434467c3e517ff2b658695389ad049
-
SHA1
f057b1e4617eaccb9b10c41f1c5684f577df2a77
-
SHA256
7875a44f2882e5189ee7a3196bca5384fa63f7a5d157432dcc0e289df76e50f6
-
SHA512
58728baf12ee29af0a666bff19a2750e7153b641ace00681c133f61bc7af959cac5e84d227f7f9ecd18c1a04843cb2fbe88965fe4977fb8f0cc613bd8f4c3055
-
SSDEEP
3072:7IAUyweDLPRt0dxETp67eptLMuf4P27lhHnAdnwOx1Tm2whPTm1w/a8K+YdAFd:+eD3dCIQV2BhHnAdwOxohPow/CAFd
Malware Config
Extracted
nymaim
208.67.104.97
85.31.46.167
Signatures
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
pid Process 620 Cleaner.exe -
Deletes itself 1 IoCs
pid Process 2044 cmd.exe -
Loads dropped DLL 1 IoCs
pid Process 1604 cmd.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
pid pid_target Process procid_target 1664 620 WerFault.exe 31 -
Kills process with taskkill 1 IoCs
pid Process 1140 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 740 file.exe 740 file.exe 740 file.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 620 Cleaner.exe Token: SeDebugPrivilege 1140 taskkill.exe -
Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 740 wrote to memory of 1604 740 file.exe 29 PID 740 wrote to memory of 1604 740 file.exe 29 PID 740 wrote to memory of 1604 740 file.exe 29 PID 740 wrote to memory of 1604 740 file.exe 29 PID 1604 wrote to memory of 620 1604 cmd.exe 31 PID 1604 wrote to memory of 620 1604 cmd.exe 31 PID 1604 wrote to memory of 620 1604 cmd.exe 31 PID 1604 wrote to memory of 620 1604 cmd.exe 31 PID 620 wrote to memory of 1664 620 Cleaner.exe 33 PID 620 wrote to memory of 1664 620 Cleaner.exe 33 PID 620 wrote to memory of 1664 620 Cleaner.exe 33 PID 740 wrote to memory of 2044 740 file.exe 34 PID 740 wrote to memory of 2044 740 file.exe 34 PID 740 wrote to memory of 2044 740 file.exe 34 PID 740 wrote to memory of 2044 740 file.exe 34 PID 2044 wrote to memory of 1140 2044 cmd.exe 36 PID 2044 wrote to memory of 1140 2044 cmd.exe 36 PID 2044 wrote to memory of 1140 2044 cmd.exe 36 PID 2044 wrote to memory of 1140 2044 cmd.exe 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:740 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\fBOp9sDLUasmnYPr9qiq7q6I\Cleaner.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\fBOp9sDLUasmnYPr9qiq7q6I\Cleaner.exe"C:\Users\Admin\AppData\Local\Temp\fBOp9sDLUasmnYPr9qiq7q6I\Cleaner.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:620 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 620 -s 11524⤵
- Program crash
PID:1664
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "file.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\file.exe" & exit2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "file.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1140
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
236KB
MD52ecb51ab00c5f340380ecf849291dbcf
SHA11a4dffbce2a4ce65495ed79eab42a4da3b660931
SHA256f1b3e0f2750a9103e46a6a4a34f1cf9d17779725f98042cc2475ec66484801cf
SHA512e241a48eafcaf99187035f0870d24d74ae97fe84aaadd2591cceea9f64b8223d77cfb17a038a58eadd3b822c5201a6f7494f26eea6f77d95f77f6c668d088e6b
-
Filesize
4.0MB
MD5a1a19faf0af29841daeeaad999d899bd
SHA1f67b9afdab167d5bcc544358b0e7fd2858784508
SHA256f349739486dcb45f7cd39440784224c66a5d2c4bd2a47c48606e2f481a0fabe7
SHA512a66ec486262e797bafd4fa032a719e499217993479fa78938e43db13289fe6fefc0ef3c3359e3cacb6223134396852be7cc9122c46ae74db3e9842d7f4fe65a8
-
Filesize
4.0MB
MD5a1a19faf0af29841daeeaad999d899bd
SHA1f67b9afdab167d5bcc544358b0e7fd2858784508
SHA256f349739486dcb45f7cd39440784224c66a5d2c4bd2a47c48606e2f481a0fabe7
SHA512a66ec486262e797bafd4fa032a719e499217993479fa78938e43db13289fe6fefc0ef3c3359e3cacb6223134396852be7cc9122c46ae74db3e9842d7f4fe65a8
-
Filesize
4.0MB
MD5a1a19faf0af29841daeeaad999d899bd
SHA1f67b9afdab167d5bcc544358b0e7fd2858784508
SHA256f349739486dcb45f7cd39440784224c66a5d2c4bd2a47c48606e2f481a0fabe7
SHA512a66ec486262e797bafd4fa032a719e499217993479fa78938e43db13289fe6fefc0ef3c3359e3cacb6223134396852be7cc9122c46ae74db3e9842d7f4fe65a8