Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
43s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
29/11/2022, 10:02
Static task
static1
Behavioral task
behavioral1
Sample
a485913f71bbd74bb8a1bdce2e2c5d80c107da7d6c08bf088599c1ee62ccb109.exe
Resource
win7-20220812-en
windows7-x64
4 signatures
150 seconds
General
-
Target
a485913f71bbd74bb8a1bdce2e2c5d80c107da7d6c08bf088599c1ee62ccb109.exe
-
Size
4.4MB
-
MD5
dfc4a031492642766e68c03f4d8ec744
-
SHA1
b86b1bcdca1e6e9a9486bed90d2133742f9cb4bb
-
SHA256
a485913f71bbd74bb8a1bdce2e2c5d80c107da7d6c08bf088599c1ee62ccb109
-
SHA512
da05016997b72e8e3fba3391ed42945b42004b5c37220f82d1a7ffc6b2896e29d56108389681c5c2bb6398cabb44f6c7c1b8145501004a2eca53c7661228fc83
-
SSDEEP
49152:Yo96Kfe7dxvqR9srXJhtI2sP8krI/Aah5EkZtGQnld30qN01p:+KcxWn0EiG8lK
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 948 wmic.exe Token: SeSecurityPrivilege 948 wmic.exe Token: SeTakeOwnershipPrivilege 948 wmic.exe Token: SeLoadDriverPrivilege 948 wmic.exe Token: SeSystemProfilePrivilege 948 wmic.exe Token: SeSystemtimePrivilege 948 wmic.exe Token: SeProfSingleProcessPrivilege 948 wmic.exe Token: SeIncBasePriorityPrivilege 948 wmic.exe Token: SeCreatePagefilePrivilege 948 wmic.exe Token: SeBackupPrivilege 948 wmic.exe Token: SeRestorePrivilege 948 wmic.exe Token: SeShutdownPrivilege 948 wmic.exe Token: SeDebugPrivilege 948 wmic.exe Token: SeSystemEnvironmentPrivilege 948 wmic.exe Token: SeRemoteShutdownPrivilege 948 wmic.exe Token: SeUndockPrivilege 948 wmic.exe Token: SeManageVolumePrivilege 948 wmic.exe Token: 33 948 wmic.exe Token: 34 948 wmic.exe Token: 35 948 wmic.exe Token: SeIncreaseQuotaPrivilege 948 wmic.exe Token: SeSecurityPrivilege 948 wmic.exe Token: SeTakeOwnershipPrivilege 948 wmic.exe Token: SeLoadDriverPrivilege 948 wmic.exe Token: SeSystemProfilePrivilege 948 wmic.exe Token: SeSystemtimePrivilege 948 wmic.exe Token: SeProfSingleProcessPrivilege 948 wmic.exe Token: SeIncBasePriorityPrivilege 948 wmic.exe Token: SeCreatePagefilePrivilege 948 wmic.exe Token: SeBackupPrivilege 948 wmic.exe Token: SeRestorePrivilege 948 wmic.exe Token: SeShutdownPrivilege 948 wmic.exe Token: SeDebugPrivilege 948 wmic.exe Token: SeSystemEnvironmentPrivilege 948 wmic.exe Token: SeRemoteShutdownPrivilege 948 wmic.exe Token: SeUndockPrivilege 948 wmic.exe Token: SeManageVolumePrivilege 948 wmic.exe Token: 33 948 wmic.exe Token: 34 948 wmic.exe Token: 35 948 wmic.exe Token: SeIncreaseQuotaPrivilege 516 WMIC.exe Token: SeSecurityPrivilege 516 WMIC.exe Token: SeTakeOwnershipPrivilege 516 WMIC.exe Token: SeLoadDriverPrivilege 516 WMIC.exe Token: SeSystemProfilePrivilege 516 WMIC.exe Token: SeSystemtimePrivilege 516 WMIC.exe Token: SeProfSingleProcessPrivilege 516 WMIC.exe Token: SeIncBasePriorityPrivilege 516 WMIC.exe Token: SeCreatePagefilePrivilege 516 WMIC.exe Token: SeBackupPrivilege 516 WMIC.exe Token: SeRestorePrivilege 516 WMIC.exe Token: SeShutdownPrivilege 516 WMIC.exe Token: SeDebugPrivilege 516 WMIC.exe Token: SeSystemEnvironmentPrivilege 516 WMIC.exe Token: SeRemoteShutdownPrivilege 516 WMIC.exe Token: SeUndockPrivilege 516 WMIC.exe Token: SeManageVolumePrivilege 516 WMIC.exe Token: 33 516 WMIC.exe Token: 34 516 WMIC.exe Token: 35 516 WMIC.exe Token: SeIncreaseQuotaPrivilege 516 WMIC.exe Token: SeSecurityPrivilege 516 WMIC.exe Token: SeTakeOwnershipPrivilege 516 WMIC.exe Token: SeLoadDriverPrivilege 516 WMIC.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 240 wrote to memory of 948 240 a485913f71bbd74bb8a1bdce2e2c5d80c107da7d6c08bf088599c1ee62ccb109.exe 28 PID 240 wrote to memory of 948 240 a485913f71bbd74bb8a1bdce2e2c5d80c107da7d6c08bf088599c1ee62ccb109.exe 28 PID 240 wrote to memory of 948 240 a485913f71bbd74bb8a1bdce2e2c5d80c107da7d6c08bf088599c1ee62ccb109.exe 28 PID 240 wrote to memory of 1008 240 a485913f71bbd74bb8a1bdce2e2c5d80c107da7d6c08bf088599c1ee62ccb109.exe 31 PID 240 wrote to memory of 1008 240 a485913f71bbd74bb8a1bdce2e2c5d80c107da7d6c08bf088599c1ee62ccb109.exe 31 PID 240 wrote to memory of 1008 240 a485913f71bbd74bb8a1bdce2e2c5d80c107da7d6c08bf088599c1ee62ccb109.exe 31 PID 1008 wrote to memory of 516 1008 cmd.exe 33 PID 1008 wrote to memory of 516 1008 cmd.exe 33 PID 1008 wrote to memory of 516 1008 cmd.exe 33 PID 240 wrote to memory of 668 240 a485913f71bbd74bb8a1bdce2e2c5d80c107da7d6c08bf088599c1ee62ccb109.exe 34 PID 240 wrote to memory of 668 240 a485913f71bbd74bb8a1bdce2e2c5d80c107da7d6c08bf088599c1ee62ccb109.exe 34 PID 240 wrote to memory of 668 240 a485913f71bbd74bb8a1bdce2e2c5d80c107da7d6c08bf088599c1ee62ccb109.exe 34 PID 668 wrote to memory of 1740 668 cmd.exe 36 PID 668 wrote to memory of 1740 668 cmd.exe 36 PID 668 wrote to memory of 1740 668 cmd.exe 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\a485913f71bbd74bb8a1bdce2e2c5d80c107da7d6c08bf088599c1ee62ccb109.exe"C:\Users\Admin\AppData\Local\Temp\a485913f71bbd74bb8a1bdce2e2c5d80c107da7d6c08bf088599c1ee62ccb109.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:240 -
C:\Windows\System32\Wbem\wmic.exewmic os get Caption2⤵
- Suspicious use of AdjustPrivilegeToken
PID:948
-
-
C:\Windows\system32\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
- Suspicious use of WriteProcessMemory
PID:1008 -
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Suspicious use of AdjustPrivilegeToken
PID:516
-
-
-
C:\Windows\system32\cmd.execmd /C "wmic cpu get name"2⤵
- Suspicious use of WriteProcessMemory
PID:668 -
C:\Windows\System32\Wbem\WMIC.exewmic cpu get name3⤵PID:1740
-
-