Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
183s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
29/11/2022, 06:00
Static task
static1
Behavioral task
behavioral1
Sample
8981751fa2c63c7cba7bc7c38c462df09e2acc54a7bb32afb03e873cde11daa2.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
8981751fa2c63c7cba7bc7c38c462df09e2acc54a7bb32afb03e873cde11daa2.exe
Resource
win10v2004-20221111-en
General
-
Target
8981751fa2c63c7cba7bc7c38c462df09e2acc54a7bb32afb03e873cde11daa2.exe
-
Size
336KB
-
MD5
99f74c9cda2185fe716cb7d670e706f0
-
SHA1
9a70cb8e0575341374ea39b3f7197156c5baf681
-
SHA256
8981751fa2c63c7cba7bc7c38c462df09e2acc54a7bb32afb03e873cde11daa2
-
SHA512
c3e0b2fbc031dfc1ae522003b8dfc962972526f5cd3b5bd90a07653faa2feaa6686c344f598700ebf99897f87267e93c49ba63670121798156700c7929e375df
-
SSDEEP
6144:Gvnm3YkDJaCajEyQH3LGa8J75guUsvcLc7sxnWWdqZW83Ko1TLC5KvTBsK:Gvnm3BDJtOIF8ZEQ0dqZtauTL0ATBsK
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1576 whudm.exe -
Deletes itself 1 IoCs
pid Process 768 cmd.exe -
Loads dropped DLL 3 IoCs
pid Process 768 cmd.exe 768 cmd.exe 1576 whudm.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce 8981751fa2c63c7cba7bc7c38c462df09e2acc54a7bb32afb03e873cde11daa2.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Kills process with taskkill 1 IoCs
pid Process 112 taskkill.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 1212 PING.EXE -
Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 1576 whudm.exe 1576 whudm.exe 1576 whudm.exe 1576 whudm.exe 1576 whudm.exe 1576 whudm.exe 1576 whudm.exe 1576 whudm.exe 1576 whudm.exe 1576 whudm.exe 1576 whudm.exe 1576 whudm.exe 1576 whudm.exe 1576 whudm.exe 1576 whudm.exe 1576 whudm.exe 1576 whudm.exe 1576 whudm.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 112 taskkill.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 1576 whudm.exe 1576 whudm.exe 1576 whudm.exe 1576 whudm.exe -
Suspicious use of SendNotifyMessage 4 IoCs
pid Process 1576 whudm.exe 1576 whudm.exe 1576 whudm.exe 1576 whudm.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 960 wrote to memory of 768 960 8981751fa2c63c7cba7bc7c38c462df09e2acc54a7bb32afb03e873cde11daa2.exe 28 PID 960 wrote to memory of 768 960 8981751fa2c63c7cba7bc7c38c462df09e2acc54a7bb32afb03e873cde11daa2.exe 28 PID 960 wrote to memory of 768 960 8981751fa2c63c7cba7bc7c38c462df09e2acc54a7bb32afb03e873cde11daa2.exe 28 PID 960 wrote to memory of 768 960 8981751fa2c63c7cba7bc7c38c462df09e2acc54a7bb32afb03e873cde11daa2.exe 28 PID 768 wrote to memory of 112 768 cmd.exe 30 PID 768 wrote to memory of 112 768 cmd.exe 30 PID 768 wrote to memory of 112 768 cmd.exe 30 PID 768 wrote to memory of 112 768 cmd.exe 30 PID 768 wrote to memory of 1212 768 cmd.exe 32 PID 768 wrote to memory of 1212 768 cmd.exe 32 PID 768 wrote to memory of 1212 768 cmd.exe 32 PID 768 wrote to memory of 1212 768 cmd.exe 32 PID 768 wrote to memory of 1576 768 cmd.exe 33 PID 768 wrote to memory of 1576 768 cmd.exe 33 PID 768 wrote to memory of 1576 768 cmd.exe 33 PID 768 wrote to memory of 1576 768 cmd.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\8981751fa2c63c7cba7bc7c38c462df09e2acc54a7bb32afb03e873cde11daa2.exe"C:\Users\Admin\AppData\Local\Temp\8981751fa2c63c7cba7bc7c38c462df09e2acc54a7bb32afb03e873cde11daa2.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:960 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /f /pid 960 & ping -n 3 127.1 & del /f /q "C:\Users\Admin\AppData\Local\Temp\8981751fa2c63c7cba7bc7c38c462df09e2acc54a7bb32afb03e873cde11daa2.exe" & start C:\Users\Admin\AppData\Local\whudm.exe -f2⤵
- Deletes itself
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:768 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /pid 9603⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:112
-
-
C:\Windows\SysWOW64\PING.EXEping -n 3 127.13⤵
- Runs ping.exe
PID:1212
-
-
C:\Users\Admin\AppData\Local\whudm.exeC:\Users\Admin\AppData\Local\whudm.exe -f3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1576
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
336KB
MD599f74c9cda2185fe716cb7d670e706f0
SHA19a70cb8e0575341374ea39b3f7197156c5baf681
SHA2568981751fa2c63c7cba7bc7c38c462df09e2acc54a7bb32afb03e873cde11daa2
SHA512c3e0b2fbc031dfc1ae522003b8dfc962972526f5cd3b5bd90a07653faa2feaa6686c344f598700ebf99897f87267e93c49ba63670121798156700c7929e375df
-
Filesize
336KB
MD599f74c9cda2185fe716cb7d670e706f0
SHA19a70cb8e0575341374ea39b3f7197156c5baf681
SHA2568981751fa2c63c7cba7bc7c38c462df09e2acc54a7bb32afb03e873cde11daa2
SHA512c3e0b2fbc031dfc1ae522003b8dfc962972526f5cd3b5bd90a07653faa2feaa6686c344f598700ebf99897f87267e93c49ba63670121798156700c7929e375df
-
Filesize
336KB
MD599f74c9cda2185fe716cb7d670e706f0
SHA19a70cb8e0575341374ea39b3f7197156c5baf681
SHA2568981751fa2c63c7cba7bc7c38c462df09e2acc54a7bb32afb03e873cde11daa2
SHA512c3e0b2fbc031dfc1ae522003b8dfc962972526f5cd3b5bd90a07653faa2feaa6686c344f598700ebf99897f87267e93c49ba63670121798156700c7929e375df
-
Filesize
336KB
MD599f74c9cda2185fe716cb7d670e706f0
SHA19a70cb8e0575341374ea39b3f7197156c5baf681
SHA2568981751fa2c63c7cba7bc7c38c462df09e2acc54a7bb32afb03e873cde11daa2
SHA512c3e0b2fbc031dfc1ae522003b8dfc962972526f5cd3b5bd90a07653faa2feaa6686c344f598700ebf99897f87267e93c49ba63670121798156700c7929e375df
-
Filesize
336KB
MD599f74c9cda2185fe716cb7d670e706f0
SHA19a70cb8e0575341374ea39b3f7197156c5baf681
SHA2568981751fa2c63c7cba7bc7c38c462df09e2acc54a7bb32afb03e873cde11daa2
SHA512c3e0b2fbc031dfc1ae522003b8dfc962972526f5cd3b5bd90a07653faa2feaa6686c344f598700ebf99897f87267e93c49ba63670121798156700c7929e375df