Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
44s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
20/10/2022, 22:15
Static task
static1
Behavioral task
behavioral1
Sample
Contract.lnk
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
Contract.lnk
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
liveried/sufferer.dll
Resource
win7-20220901-en
Behavioral task
behavioral4
Sample
liveried/sufferer.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
liveried/waddling.cmd
Resource
win7-20220901-en
Behavioral task
behavioral6
Sample
liveried/waddling.cmd
Resource
win10v2004-20220901-en
General
-
Target
Contract.lnk
-
Size
1KB
-
MD5
ad079ab2d276ebb2d1fd21c312470961
-
SHA1
d0df3afa594bfecfcf11cb93c2847462d6a1d661
-
SHA256
2525a45f8cd187363a9de42cbf14bc00c6d77ddb28246169a1dfa01a89cd9a9c
-
SHA512
14e5f59fddb33efa78b698e31706b9125c135f545c78ed6977f3bb571cd059f5b4e723ccf7ab1f1444a4dc68cef825094e33449cc2c49f4526d4c89765215493
Malware Config
Extracted
qakbot
403.1051
BB04
1666265103
102.156.82.38:995
152.170.17.136:443
216.131.22.236:995
70.173.248.13:443
14.246.151.175:443
160.179.32.101:995
118.175.242.26:995
186.188.80.202:443
41.69.181.145:443
156.220.14.160:993
201.68.209.47:32101
206.1.172.1:443
156.217.185.90:995
190.74.4.20:443
217.78.49.161:443
154.181.199.80:995
200.233.108.153:993
175.205.2.54:443
198.2.51.242:993
181.164.194.228:443
197.204.180.90:443
201.210.121.49:2222
144.202.15.58:443
41.228.249.243:995
200.155.61.245:995
45.230.169.132:995
197.206.119.7:443
193.3.19.137:443
41.105.5.123:443
103.156.237.170:443
73.96.24.39:443
201.210.119.28:993
136.232.184.134:995
105.105.0.165:443
190.193.180.228:443
190.204.101.210:2222
190.33.87.140:443
200.93.11.28:2222
181.56.171.3:995
181.168.145.94:443
94.36.5.31:443
5.163.177.234:443
167.58.254.85:443
191.84.67.34:443
41.99.101.231:443
206.1.233.138:443
58.186.75.42:443
206.1.181.103:443
181.141.3.126:443
187.143.131.190:2222
82.12.196.197:443
200.44.222.59:2222
105.99.146.94:443
187.198.16.39:443
197.2.227.65:443
201.171.199.216:443
105.108.252.186:443
186.213.214.13:2222
85.242.200.96:443
41.97.228.210:443
105.158.71.149:443
41.62.218.170:443
105.103.39.73:443
206.1.233.162:2087
190.203.116.63:2222
152.171.41.171:443
78.179.135.247:443
41.141.216.137:995
200.155.61.245:443
167.58.86.35:995
105.96.250.243:443
189.110.3.60:2222
41.100.121.175:443
41.143.221.72:443
41.111.121.4:995
160.177.88.185:443
41.100.94.61:443
72.88.245.71:443
41.101.153.206:443
41.103.68.151:443
177.152.65.142:443
42.116.54.220:443
181.197.41.173:443
160.177.145.229:443
179.105.126.196:995
2.152.181.194:995
125.26.173.239:443
31.166.182.166:443
196.65.219.83:443
220.134.54.185:2222
202.5.53.143:443
74.141.38.107:443
78.184.31.100:443
41.104.28.115:995
68.35.151.16:443
149.126.159.254:443
109.49.47.10:80
134.35.1.15:443
220.123.29.76:443
201.223.175.208:32100
190.33.241.216:443
201.205.130.251:995
216.131.22.236:443
75.157.229.63:443
163.182.177.80:443
201.212.173.78:443
186.93.143.86:2222
106.243.197.122:443
186.188.96.197:443
181.55.106.237:443
45.184.179.188:2222
88.229.17.133:443
104.237.6.167:443
102.185.146.113:995
186.144.129.196:443
186.48.244.74:443
190.24.54.187:995
186.177.93.18:2222
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1176 6.exe -
Loads dropped DLL 1 IoCs
pid Process 1312 cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 756 regsvr32.exe 1524 wermgr.exe 1524 wermgr.exe 1524 wermgr.exe 1524 wermgr.exe 1524 wermgr.exe 1524 wermgr.exe 1524 wermgr.exe 1524 wermgr.exe 1524 wermgr.exe 1524 wermgr.exe 1524 wermgr.exe 1524 wermgr.exe 1524 wermgr.exe 1524 wermgr.exe 1524 wermgr.exe 1524 wermgr.exe 1524 wermgr.exe 1524 wermgr.exe 1524 wermgr.exe 1524 wermgr.exe 1524 wermgr.exe 1524 wermgr.exe 1524 wermgr.exe 1524 wermgr.exe 1524 wermgr.exe 1524 wermgr.exe 1524 wermgr.exe 1524 wermgr.exe 1524 wermgr.exe 1524 wermgr.exe 1524 wermgr.exe 1524 wermgr.exe 1524 wermgr.exe 1524 wermgr.exe 1524 wermgr.exe 1524 wermgr.exe 1524 wermgr.exe 1524 wermgr.exe 1524 wermgr.exe 1524 wermgr.exe 1524 wermgr.exe 1524 wermgr.exe 1524 wermgr.exe 1524 wermgr.exe 1524 wermgr.exe 1524 wermgr.exe 1524 wermgr.exe 1524 wermgr.exe 1524 wermgr.exe 1524 wermgr.exe 1524 wermgr.exe 1524 wermgr.exe 1524 wermgr.exe 1524 wermgr.exe 1524 wermgr.exe 1524 wermgr.exe 1524 wermgr.exe 1524 wermgr.exe 1524 wermgr.exe 1524 wermgr.exe 1524 wermgr.exe 1524 wermgr.exe 1524 wermgr.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 756 regsvr32.exe -
Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 2020 wrote to memory of 1312 2020 cmd.exe 27 PID 2020 wrote to memory of 1312 2020 cmd.exe 27 PID 2020 wrote to memory of 1312 2020 cmd.exe 27 PID 1312 wrote to memory of 1176 1312 cmd.exe 28 PID 1312 wrote to memory of 1176 1312 cmd.exe 28 PID 1312 wrote to memory of 1176 1312 cmd.exe 28 PID 1176 wrote to memory of 756 1176 6.exe 29 PID 1176 wrote to memory of 756 1176 6.exe 29 PID 1176 wrote to memory of 756 1176 6.exe 29 PID 1176 wrote to memory of 756 1176 6.exe 29 PID 1176 wrote to memory of 756 1176 6.exe 29 PID 1176 wrote to memory of 756 1176 6.exe 29 PID 1176 wrote to memory of 756 1176 6.exe 29 PID 756 wrote to memory of 1524 756 regsvr32.exe 30 PID 756 wrote to memory of 1524 756 regsvr32.exe 30 PID 756 wrote to memory of 1524 756 regsvr32.exe 30 PID 756 wrote to memory of 1524 756 regsvr32.exe 30 PID 756 wrote to memory of 1524 756 regsvr32.exe 30 PID 756 wrote to memory of 1524 756 regsvr32.exe 30
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Contract.lnk1⤵
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c liveried\waddling.cmd reg sv r2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1312 -
C:\Users\Admin\AppData\Local\Temp\6.exeC:\Users\Admin\AppData\Local\Temp\6.exe liveried\sufferer.ssd3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1176 -
C:\Windows\SysWOW64\regsvr32.exeliveried\sufferer.ssd4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:756 -
C:\Windows\SysWOW64\wermgr.exeC:\Windows\SysWOW64\wermgr.exe5⤵
- Suspicious behavior: EnumeratesProcesses
PID:1524
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
19KB
MD559bce9f07985f8a4204f4d6554cff708
SHA1645c424974fbe5fe7a04cac73f1c23c96e1570b8
SHA256ca24aef558647274d019dfb4d7fd1506d84ec278795c30ba53b81bb36130dc57
SHA5123cf5825a9c7fb80ea0bd36775a92d07f34cd3709ed2c7c8f500f1c8baa5242768f6d575bd2477b77e3f177e7a4994d5c5bddb24c6eb43b60a6bd83ea026a8198
-
Filesize
19KB
MD559bce9f07985f8a4204f4d6554cff708
SHA1645c424974fbe5fe7a04cac73f1c23c96e1570b8
SHA256ca24aef558647274d019dfb4d7fd1506d84ec278795c30ba53b81bb36130dc57
SHA5123cf5825a9c7fb80ea0bd36775a92d07f34cd3709ed2c7c8f500f1c8baa5242768f6d575bd2477b77e3f177e7a4994d5c5bddb24c6eb43b60a6bd83ea026a8198