Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    90s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/11/2022, 11:23

General

  • Target

    ab475592147f66d5b7f6b8dccb37ab85bca51102361675aa81c18443d6fe6994.exe

  • Size

    580KB

  • MD5

    059fa1d49e9db0de5c0f24d883727a1a

  • SHA1

    ea818d9b51d5961708206b9fa528c2e37b97b518

  • SHA256

    ab475592147f66d5b7f6b8dccb37ab85bca51102361675aa81c18443d6fe6994

  • SHA512

    d392529877ffca11150684cb10d36361961d7989b2efa1247c2f3bd5f890f00db4063a20dcfd3b2c927a16e96581f4ab347a69616dd9bc23ca374d845c909ff6

  • SSDEEP

    12288:HxLDrMkUyzJdbH/7/7XfqFaNCA80oUvHaeN4xGhEN0/:HxLfMAzJdbH/7DPLMfQ4xGGQ

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ab475592147f66d5b7f6b8dccb37ab85bca51102361675aa81c18443d6fe6994.exe
    "C:\Users\Admin\AppData\Local\Temp\ab475592147f66d5b7f6b8dccb37ab85bca51102361675aa81c18443d6fe6994.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:5064
    • C:\Users\Admin\AppData\Local\Temp\bcdbcabecbdh.exe
      C:\Users\Admin\AppData\Local\Temp\bcdbcabecbdh.exe 7-4-0-0-5-1-3-6-2-4-3 KExJRDgzNDA1HCxMUUJQREM6Kh4rSz5QV09NSkY+Oy0dKEBJU09IQTc0LjAuHC9DREM6Kh4rTUtLRFU+U1xDQjkyMS8xICpSQkxUQU9YUVJMOGdxbm42LChvZXJxLXFiYyleaWwtZFxzXihnamNoHC9DR0hARUdAOhkrRDE4TVJHQEFPGStEMjhNUkdAQU8ZK0QzOE1SR0BBTxkrRDQ4TVJHQEFPGStENThNUkdAQU8ZK1BSSkNSPVJbTUtFVkE+WDoaLUxPSEBVQ09eQk9KPToZK1BSSkNSPVJbSzpJRT1AbG1ud0JsZWBlcj5rYltsYW8nbGhwGy5CUkNbUktIPSAqRFU/XT9KPUhJTkA8HSlGS1BNW0JSSlZQP1A5MhkrVEg8TUhTTVFcTk5MPRsuUUNLQToqMDIwKzU1MDMwHShSTT0tHyw+US06GStSVUlTRkdDW1Q+SENPSERGRz9DQk5OTD0bLkZNXU5SR1BJTUA8cWxzYR0oTkVUUFFLQ0xDXE5PRVJaQz5TUTkvGStIST9EVTcvHCxCT19EVE0+R0c/XD5KQ1JUT1E/QjljWmhzZRsuQUlVSklIPURfT0hKPzstLygvMS8tLy4uKC0uMy8wOjAzJ0pLHCw9S1dOR04+Pl1FTTYuMDgpMC4qLDUwJy0yMg==
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4180
      • C:\Windows\SysWOW64\Wbem\wmic.exe
        wmic /output:C:\Users\Admin\AppData\Local\Temp\81667870367.txt bios get serialnumber
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4480
      • C:\Windows\SysWOW64\Wbem\wmic.exe
        wmic /output:C:\Users\Admin\AppData\Local\Temp\81667870367.txt bios get version
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4760
      • C:\Windows\SysWOW64\Wbem\wmic.exe
        wmic /output:C:\Users\Admin\AppData\Local\Temp\81667870367.txt bios get version
        3⤵
          PID:4380
        • C:\Windows\SysWOW64\Wbem\wmic.exe
          wmic /output:C:\Users\Admin\AppData\Local\Temp\81667870367.txt bios get version
          3⤵
            PID:2356
          • C:\Windows\SysWOW64\Wbem\wmic.exe
            wmic /output:C:\Users\Admin\AppData\Local\Temp\81667870367.txt bios get version
            3⤵
              PID:2712
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 4180 -s 956
              3⤵
              • Program crash
              PID:4188
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4180 -ip 4180
          1⤵
            PID:3892

          Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\81667870367.txt

            Filesize

            66B

            MD5

            9025468f85256136f923096b01375964

            SHA1

            7fcd174999661594fa5f88890ffb195e9858cc52

            SHA256

            d5418014fa8e6e17d8992fd12c0dfecac8a34855603ea58133e87ea09c2130df

            SHA512

            92cac37c332e6e276a963d659986a79a79867df44682bfc2d77ed7784ffa5e2c149e5960a83d03ef4cf171be40a73e93a110aaa53b95152fa9a9da6b41d31e51

          • C:\Users\Admin\AppData\Local\Temp\81667870367.txt

            Filesize

            58B

            MD5

            dd876faf0fd44a5fab3e82368e2e8b15

            SHA1

            01b04083fa278dda3a81705ca5abcfee487a3c90

            SHA256

            5602490a82bcacec8797d25cbb6f643fc9e69f89a2f0e6ec1e8d1f568e77a6b9

            SHA512

            e03d1def5b7fb0ed01a414cead199229ec0e153ff831d3ff5dd36c320572084c56a5e1369c753f868c855455758c0d308941b6187c348051419bd937d014cb8b

          • C:\Users\Admin\AppData\Local\Temp\81667870367.txt

            Filesize

            58B

            MD5

            dd876faf0fd44a5fab3e82368e2e8b15

            SHA1

            01b04083fa278dda3a81705ca5abcfee487a3c90

            SHA256

            5602490a82bcacec8797d25cbb6f643fc9e69f89a2f0e6ec1e8d1f568e77a6b9

            SHA512

            e03d1def5b7fb0ed01a414cead199229ec0e153ff831d3ff5dd36c320572084c56a5e1369c753f868c855455758c0d308941b6187c348051419bd937d014cb8b

          • C:\Users\Admin\AppData\Local\Temp\81667870367.txt

            Filesize

            58B

            MD5

            dd876faf0fd44a5fab3e82368e2e8b15

            SHA1

            01b04083fa278dda3a81705ca5abcfee487a3c90

            SHA256

            5602490a82bcacec8797d25cbb6f643fc9e69f89a2f0e6ec1e8d1f568e77a6b9

            SHA512

            e03d1def5b7fb0ed01a414cead199229ec0e153ff831d3ff5dd36c320572084c56a5e1369c753f868c855455758c0d308941b6187c348051419bd937d014cb8b

          • C:\Users\Admin\AppData\Local\Temp\81667870367.txt

            Filesize

            58B

            MD5

            dd876faf0fd44a5fab3e82368e2e8b15

            SHA1

            01b04083fa278dda3a81705ca5abcfee487a3c90

            SHA256

            5602490a82bcacec8797d25cbb6f643fc9e69f89a2f0e6ec1e8d1f568e77a6b9

            SHA512

            e03d1def5b7fb0ed01a414cead199229ec0e153ff831d3ff5dd36c320572084c56a5e1369c753f868c855455758c0d308941b6187c348051419bd937d014cb8b

          • C:\Users\Admin\AppData\Local\Temp\bcdbcabecbdh.exe

            Filesize

            826KB

            MD5

            9ed96ff11811f7636a77b7a047ca2d74

            SHA1

            e5781398b7bd10699edbc4046bce4f6720f57d4a

            SHA256

            7b2e81aece0fa0081dae860564f1775dbcdf361a7845ec09c04843f9d8ca2968

            SHA512

            8a642a8a8a3726f5d1bf068f8811bdf04b0b3d6637f64be2c0dcd1e2236885e228cf557fe22be59b750d51270cd905971c6ab81942dd446f351c0cb427a2cb86

          • C:\Users\Admin\AppData\Local\Temp\bcdbcabecbdh.exe

            Filesize

            826KB

            MD5

            9ed96ff11811f7636a77b7a047ca2d74

            SHA1

            e5781398b7bd10699edbc4046bce4f6720f57d4a

            SHA256

            7b2e81aece0fa0081dae860564f1775dbcdf361a7845ec09c04843f9d8ca2968

            SHA512

            8a642a8a8a3726f5d1bf068f8811bdf04b0b3d6637f64be2c0dcd1e2236885e228cf557fe22be59b750d51270cd905971c6ab81942dd446f351c0cb427a2cb86

          • C:\Users\Admin\AppData\Local\Temp\nspC692.tmp\bvc.dll

            Filesize

            117KB

            MD5

            eb6c8f26fd18387ce3ae7e2e87ff367d

            SHA1

            cd2d70b318d3b26991272c34f7b40bf888db3f98

            SHA256

            b3238feac8627b3c3d167885a4e2d048d9922e1758595f1e3e5dd12f40fc6720

            SHA512

            1b03d5febd435c73b23d9d04e937025d19d4dcbc7e5af649fe55538879737fb89b31e12e95787178d66ae8d3cee128a9735cc91b23d6bf114dcaae4ea9e46bab

          • C:\Users\Admin\AppData\Local\Temp\nspC692.tmp\nsisunz.dll

            Filesize

            40KB

            MD5

            5f13dbc378792f23e598079fc1e4422b

            SHA1

            5813c05802f15930aa860b8363af2b58426c8adf

            SHA256

            6e87ecb7f62039fbb6e7676422d1a5e75a32b90dde6865dcb68ee658ba8df61d

            SHA512

            9270635a5294482f49e0292e26d45dd103b85fe27dc163d44531b095c5f9dbde6b904adaf1a888ba3c112a094380394713c796f5195b2566a20f00b42b6578e5