Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    21s
  • max time network
    59s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    07/11/2022, 11:23

General

  • Target

    ab475592147f66d5b7f6b8dccb37ab85bca51102361675aa81c18443d6fe6994.exe

  • Size

    580KB

  • MD5

    059fa1d49e9db0de5c0f24d883727a1a

  • SHA1

    ea818d9b51d5961708206b9fa528c2e37b97b518

  • SHA256

    ab475592147f66d5b7f6b8dccb37ab85bca51102361675aa81c18443d6fe6994

  • SHA512

    d392529877ffca11150684cb10d36361961d7989b2efa1247c2f3bd5f890f00db4063a20dcfd3b2c927a16e96581f4ab347a69616dd9bc23ca374d845c909ff6

  • SSDEEP

    12288:HxLDrMkUyzJdbH/7/7XfqFaNCA80oUvHaeN4xGhEN0/:HxLfMAzJdbH/7DPLMfQ4xGGQ

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 10 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ab475592147f66d5b7f6b8dccb37ab85bca51102361675aa81c18443d6fe6994.exe
    "C:\Users\Admin\AppData\Local\Temp\ab475592147f66d5b7f6b8dccb37ab85bca51102361675aa81c18443d6fe6994.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1964
    • C:\Users\Admin\AppData\Local\Temp\bcdbcabecbdh.exe
      C:\Users\Admin\AppData\Local\Temp\bcdbcabecbdh.exe 7-4-0-0-5-1-3-6-2-4-3 KExJRDgzNDA1HCxMUUJQREM6Kh4rSz5QV09NSkY+Oy0dKEBJU09IQTc0LjAuHC9DREM6Kh4rTUtLRFU+U1xDQjkyMS8xICpSQkxUQU9YUVJMOGdxbm42LChvZXJxLXFiYyleaWwtZFxzXihnamNoHC9DR0hARUdAOhkrRDE4TVJHQEFPGStEMjhNUkdAQU8ZK0QzOE1SR0BBTxkrRDQ4TVJHQEFPGStENThNUkdAQU8ZK1BSSkNSPVJbTUtFVkE+WDoaLUxPSEBVQ09eQk9KPToZK1BSSkNSPVJbSzpJRT1AbG1ud0JsZWBlcj5rYltsYW8nbGhwGy5CUkNbUktIPSAqRFU/XT9KPUhJTkA8HSlGS1BNW0JSSlZQP1A5MhkrVEg8TUhTTVFcTk5MPRsuUUNLQToqMDIwKzU1MDMwHShSTT0tHyw+US06GStSVUlTRkdDW1Q+SENPSERGRz9DQk5OTD0bLkZNXU5SR1BJTUA8cWxzYR0oTkVUUFFLQ0xDXE5PRVJaQz5TUTkvGStIST9EVTcvHCxCT19EVE0+R0c/XD5KQ1JUT1E/QjljWmhzZRsuQUlVSklIPURfT0hKPzstLygvMS8tLy4uKC0uMy8wOjAzJ0pLHCw9S1dOR04+Pl1FTTYuMDgpMC4qLDUwJy0yMg==
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:980
      • C:\Windows\SysWOW64\Wbem\wmic.exe
        wmic /output:C:\Users\Admin\AppData\Local\Temp\81667874011.txt bios get serialnumber
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1488
      • C:\Windows\SysWOW64\Wbem\wmic.exe
        wmic /output:C:\Users\Admin\AppData\Local\Temp\81667874011.txt bios get version
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:268
      • C:\Windows\SysWOW64\Wbem\wmic.exe
        wmic /output:C:\Users\Admin\AppData\Local\Temp\81667874011.txt bios get version
        3⤵
          PID:1832
        • C:\Windows\SysWOW64\Wbem\wmic.exe
          wmic /output:C:\Users\Admin\AppData\Local\Temp\81667874011.txt bios get version
          3⤵
            PID:1696
          • C:\Windows\SysWOW64\Wbem\wmic.exe
            wmic /output:C:\Users\Admin\AppData\Local\Temp\81667874011.txt bios get version
            3⤵
              PID:1688
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 980 -s 372
              3⤵
              • Loads dropped DLL
              • Program crash
              PID:756

        Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\81667874011.txt

          Filesize

          66B

          MD5

          9025468f85256136f923096b01375964

          SHA1

          7fcd174999661594fa5f88890ffb195e9858cc52

          SHA256

          d5418014fa8e6e17d8992fd12c0dfecac8a34855603ea58133e87ea09c2130df

          SHA512

          92cac37c332e6e276a963d659986a79a79867df44682bfc2d77ed7784ffa5e2c149e5960a83d03ef4cf171be40a73e93a110aaa53b95152fa9a9da6b41d31e51

        • C:\Users\Admin\AppData\Local\Temp\81667874011.txt

          Filesize

          58B

          MD5

          dd876faf0fd44a5fab3e82368e2e8b15

          SHA1

          01b04083fa278dda3a81705ca5abcfee487a3c90

          SHA256

          5602490a82bcacec8797d25cbb6f643fc9e69f89a2f0e6ec1e8d1f568e77a6b9

          SHA512

          e03d1def5b7fb0ed01a414cead199229ec0e153ff831d3ff5dd36c320572084c56a5e1369c753f868c855455758c0d308941b6187c348051419bd937d014cb8b

        • C:\Users\Admin\AppData\Local\Temp\81667874011.txt

          Filesize

          58B

          MD5

          dd876faf0fd44a5fab3e82368e2e8b15

          SHA1

          01b04083fa278dda3a81705ca5abcfee487a3c90

          SHA256

          5602490a82bcacec8797d25cbb6f643fc9e69f89a2f0e6ec1e8d1f568e77a6b9

          SHA512

          e03d1def5b7fb0ed01a414cead199229ec0e153ff831d3ff5dd36c320572084c56a5e1369c753f868c855455758c0d308941b6187c348051419bd937d014cb8b

        • C:\Users\Admin\AppData\Local\Temp\81667874011.txt

          Filesize

          58B

          MD5

          dd876faf0fd44a5fab3e82368e2e8b15

          SHA1

          01b04083fa278dda3a81705ca5abcfee487a3c90

          SHA256

          5602490a82bcacec8797d25cbb6f643fc9e69f89a2f0e6ec1e8d1f568e77a6b9

          SHA512

          e03d1def5b7fb0ed01a414cead199229ec0e153ff831d3ff5dd36c320572084c56a5e1369c753f868c855455758c0d308941b6187c348051419bd937d014cb8b

        • C:\Users\Admin\AppData\Local\Temp\81667874011.txt

          Filesize

          58B

          MD5

          dd876faf0fd44a5fab3e82368e2e8b15

          SHA1

          01b04083fa278dda3a81705ca5abcfee487a3c90

          SHA256

          5602490a82bcacec8797d25cbb6f643fc9e69f89a2f0e6ec1e8d1f568e77a6b9

          SHA512

          e03d1def5b7fb0ed01a414cead199229ec0e153ff831d3ff5dd36c320572084c56a5e1369c753f868c855455758c0d308941b6187c348051419bd937d014cb8b

        • C:\Users\Admin\AppData\Local\Temp\bcdbcabecbdh.exe

          Filesize

          826KB

          MD5

          9ed96ff11811f7636a77b7a047ca2d74

          SHA1

          e5781398b7bd10699edbc4046bce4f6720f57d4a

          SHA256

          7b2e81aece0fa0081dae860564f1775dbcdf361a7845ec09c04843f9d8ca2968

          SHA512

          8a642a8a8a3726f5d1bf068f8811bdf04b0b3d6637f64be2c0dcd1e2236885e228cf557fe22be59b750d51270cd905971c6ab81942dd446f351c0cb427a2cb86

        • \Users\Admin\AppData\Local\Temp\bcdbcabecbdh.exe

          Filesize

          826KB

          MD5

          9ed96ff11811f7636a77b7a047ca2d74

          SHA1

          e5781398b7bd10699edbc4046bce4f6720f57d4a

          SHA256

          7b2e81aece0fa0081dae860564f1775dbcdf361a7845ec09c04843f9d8ca2968

          SHA512

          8a642a8a8a3726f5d1bf068f8811bdf04b0b3d6637f64be2c0dcd1e2236885e228cf557fe22be59b750d51270cd905971c6ab81942dd446f351c0cb427a2cb86

        • \Users\Admin\AppData\Local\Temp\bcdbcabecbdh.exe

          Filesize

          826KB

          MD5

          9ed96ff11811f7636a77b7a047ca2d74

          SHA1

          e5781398b7bd10699edbc4046bce4f6720f57d4a

          SHA256

          7b2e81aece0fa0081dae860564f1775dbcdf361a7845ec09c04843f9d8ca2968

          SHA512

          8a642a8a8a3726f5d1bf068f8811bdf04b0b3d6637f64be2c0dcd1e2236885e228cf557fe22be59b750d51270cd905971c6ab81942dd446f351c0cb427a2cb86

        • \Users\Admin\AppData\Local\Temp\bcdbcabecbdh.exe

          Filesize

          826KB

          MD5

          9ed96ff11811f7636a77b7a047ca2d74

          SHA1

          e5781398b7bd10699edbc4046bce4f6720f57d4a

          SHA256

          7b2e81aece0fa0081dae860564f1775dbcdf361a7845ec09c04843f9d8ca2968

          SHA512

          8a642a8a8a3726f5d1bf068f8811bdf04b0b3d6637f64be2c0dcd1e2236885e228cf557fe22be59b750d51270cd905971c6ab81942dd446f351c0cb427a2cb86

        • \Users\Admin\AppData\Local\Temp\bcdbcabecbdh.exe

          Filesize

          826KB

          MD5

          9ed96ff11811f7636a77b7a047ca2d74

          SHA1

          e5781398b7bd10699edbc4046bce4f6720f57d4a

          SHA256

          7b2e81aece0fa0081dae860564f1775dbcdf361a7845ec09c04843f9d8ca2968

          SHA512

          8a642a8a8a3726f5d1bf068f8811bdf04b0b3d6637f64be2c0dcd1e2236885e228cf557fe22be59b750d51270cd905971c6ab81942dd446f351c0cb427a2cb86

        • \Users\Admin\AppData\Local\Temp\bcdbcabecbdh.exe

          Filesize

          826KB

          MD5

          9ed96ff11811f7636a77b7a047ca2d74

          SHA1

          e5781398b7bd10699edbc4046bce4f6720f57d4a

          SHA256

          7b2e81aece0fa0081dae860564f1775dbcdf361a7845ec09c04843f9d8ca2968

          SHA512

          8a642a8a8a3726f5d1bf068f8811bdf04b0b3d6637f64be2c0dcd1e2236885e228cf557fe22be59b750d51270cd905971c6ab81942dd446f351c0cb427a2cb86

        • \Users\Admin\AppData\Local\Temp\bcdbcabecbdh.exe

          Filesize

          826KB

          MD5

          9ed96ff11811f7636a77b7a047ca2d74

          SHA1

          e5781398b7bd10699edbc4046bce4f6720f57d4a

          SHA256

          7b2e81aece0fa0081dae860564f1775dbcdf361a7845ec09c04843f9d8ca2968

          SHA512

          8a642a8a8a3726f5d1bf068f8811bdf04b0b3d6637f64be2c0dcd1e2236885e228cf557fe22be59b750d51270cd905971c6ab81942dd446f351c0cb427a2cb86

        • \Users\Admin\AppData\Local\Temp\bcdbcabecbdh.exe

          Filesize

          826KB

          MD5

          9ed96ff11811f7636a77b7a047ca2d74

          SHA1

          e5781398b7bd10699edbc4046bce4f6720f57d4a

          SHA256

          7b2e81aece0fa0081dae860564f1775dbcdf361a7845ec09c04843f9d8ca2968

          SHA512

          8a642a8a8a3726f5d1bf068f8811bdf04b0b3d6637f64be2c0dcd1e2236885e228cf557fe22be59b750d51270cd905971c6ab81942dd446f351c0cb427a2cb86

        • \Users\Admin\AppData\Local\Temp\bcdbcabecbdh.exe

          Filesize

          826KB

          MD5

          9ed96ff11811f7636a77b7a047ca2d74

          SHA1

          e5781398b7bd10699edbc4046bce4f6720f57d4a

          SHA256

          7b2e81aece0fa0081dae860564f1775dbcdf361a7845ec09c04843f9d8ca2968

          SHA512

          8a642a8a8a3726f5d1bf068f8811bdf04b0b3d6637f64be2c0dcd1e2236885e228cf557fe22be59b750d51270cd905971c6ab81942dd446f351c0cb427a2cb86

        • \Users\Admin\AppData\Local\Temp\nsyA823.tmp\bvc.dll

          Filesize

          117KB

          MD5

          eb6c8f26fd18387ce3ae7e2e87ff367d

          SHA1

          cd2d70b318d3b26991272c34f7b40bf888db3f98

          SHA256

          b3238feac8627b3c3d167885a4e2d048d9922e1758595f1e3e5dd12f40fc6720

          SHA512

          1b03d5febd435c73b23d9d04e937025d19d4dcbc7e5af649fe55538879737fb89b31e12e95787178d66ae8d3cee128a9735cc91b23d6bf114dcaae4ea9e46bab

        • \Users\Admin\AppData\Local\Temp\nsyA823.tmp\nsisunz.dll

          Filesize

          40KB

          MD5

          5f13dbc378792f23e598079fc1e4422b

          SHA1

          5813c05802f15930aa860b8363af2b58426c8adf

          SHA256

          6e87ecb7f62039fbb6e7676422d1a5e75a32b90dde6865dcb68ee658ba8df61d

          SHA512

          9270635a5294482f49e0292e26d45dd103b85fe27dc163d44531b095c5f9dbde6b904adaf1a888ba3c112a094380394713c796f5195b2566a20f00b42b6578e5

        • memory/1964-54-0x0000000075281000-0x0000000075283000-memory.dmp

          Filesize

          8KB