Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
222s -
max time network
337s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
29/11/2022, 10:02
Static task
static1
Behavioral task
behavioral1
Sample
a485913f71bbd74bb8a1bdce2e2c5d80c107da7d6c08bf088599c1ee62ccb109.exe
Resource
win7-20220812-en
windows7-x64
4 signatures
150 seconds
General
-
Target
a485913f71bbd74bb8a1bdce2e2c5d80c107da7d6c08bf088599c1ee62ccb109.exe
-
Size
4.4MB
-
MD5
dfc4a031492642766e68c03f4d8ec744
-
SHA1
b86b1bcdca1e6e9a9486bed90d2133742f9cb4bb
-
SHA256
a485913f71bbd74bb8a1bdce2e2c5d80c107da7d6c08bf088599c1ee62ccb109
-
SHA512
da05016997b72e8e3fba3391ed42945b42004b5c37220f82d1a7ffc6b2896e29d56108389681c5c2bb6398cabb44f6c7c1b8145501004a2eca53c7661228fc83
-
SSDEEP
49152:Yo96Kfe7dxvqR9srXJhtI2sP8krI/Aah5EkZtGQnld30qN01p:+KcxWn0EiG8lK
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1928 wmic.exe Token: SeSecurityPrivilege 1928 wmic.exe Token: SeTakeOwnershipPrivilege 1928 wmic.exe Token: SeLoadDriverPrivilege 1928 wmic.exe Token: SeSystemProfilePrivilege 1928 wmic.exe Token: SeSystemtimePrivilege 1928 wmic.exe Token: SeProfSingleProcessPrivilege 1928 wmic.exe Token: SeIncBasePriorityPrivilege 1928 wmic.exe Token: SeCreatePagefilePrivilege 1928 wmic.exe Token: SeBackupPrivilege 1928 wmic.exe Token: SeRestorePrivilege 1928 wmic.exe Token: SeShutdownPrivilege 1928 wmic.exe Token: SeDebugPrivilege 1928 wmic.exe Token: SeSystemEnvironmentPrivilege 1928 wmic.exe Token: SeRemoteShutdownPrivilege 1928 wmic.exe Token: SeUndockPrivilege 1928 wmic.exe Token: SeManageVolumePrivilege 1928 wmic.exe Token: 33 1928 wmic.exe Token: 34 1928 wmic.exe Token: 35 1928 wmic.exe Token: 36 1928 wmic.exe Token: SeIncreaseQuotaPrivilege 1928 wmic.exe Token: SeSecurityPrivilege 1928 wmic.exe Token: SeTakeOwnershipPrivilege 1928 wmic.exe Token: SeLoadDriverPrivilege 1928 wmic.exe Token: SeSystemProfilePrivilege 1928 wmic.exe Token: SeSystemtimePrivilege 1928 wmic.exe Token: SeProfSingleProcessPrivilege 1928 wmic.exe Token: SeIncBasePriorityPrivilege 1928 wmic.exe Token: SeCreatePagefilePrivilege 1928 wmic.exe Token: SeBackupPrivilege 1928 wmic.exe Token: SeRestorePrivilege 1928 wmic.exe Token: SeShutdownPrivilege 1928 wmic.exe Token: SeDebugPrivilege 1928 wmic.exe Token: SeSystemEnvironmentPrivilege 1928 wmic.exe Token: SeRemoteShutdownPrivilege 1928 wmic.exe Token: SeUndockPrivilege 1928 wmic.exe Token: SeManageVolumePrivilege 1928 wmic.exe Token: 33 1928 wmic.exe Token: 34 1928 wmic.exe Token: 35 1928 wmic.exe Token: 36 1928 wmic.exe Token: SeIncreaseQuotaPrivilege 2268 WMIC.exe Token: SeSecurityPrivilege 2268 WMIC.exe Token: SeTakeOwnershipPrivilege 2268 WMIC.exe Token: SeLoadDriverPrivilege 2268 WMIC.exe Token: SeSystemProfilePrivilege 2268 WMIC.exe Token: SeSystemtimePrivilege 2268 WMIC.exe Token: SeProfSingleProcessPrivilege 2268 WMIC.exe Token: SeIncBasePriorityPrivilege 2268 WMIC.exe Token: SeCreatePagefilePrivilege 2268 WMIC.exe Token: SeBackupPrivilege 2268 WMIC.exe Token: SeRestorePrivilege 2268 WMIC.exe Token: SeShutdownPrivilege 2268 WMIC.exe Token: SeDebugPrivilege 2268 WMIC.exe Token: SeSystemEnvironmentPrivilege 2268 WMIC.exe Token: SeRemoteShutdownPrivilege 2268 WMIC.exe Token: SeUndockPrivilege 2268 WMIC.exe Token: SeManageVolumePrivilege 2268 WMIC.exe Token: 33 2268 WMIC.exe Token: 34 2268 WMIC.exe Token: 35 2268 WMIC.exe Token: 36 2268 WMIC.exe Token: SeIncreaseQuotaPrivilege 2268 WMIC.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 3088 wrote to memory of 1928 3088 a485913f71bbd74bb8a1bdce2e2c5d80c107da7d6c08bf088599c1ee62ccb109.exe 81 PID 3088 wrote to memory of 1928 3088 a485913f71bbd74bb8a1bdce2e2c5d80c107da7d6c08bf088599c1ee62ccb109.exe 81 PID 3088 wrote to memory of 3396 3088 a485913f71bbd74bb8a1bdce2e2c5d80c107da7d6c08bf088599c1ee62ccb109.exe 84 PID 3088 wrote to memory of 3396 3088 a485913f71bbd74bb8a1bdce2e2c5d80c107da7d6c08bf088599c1ee62ccb109.exe 84 PID 3396 wrote to memory of 2268 3396 cmd.exe 86 PID 3396 wrote to memory of 2268 3396 cmd.exe 86 PID 3088 wrote to memory of 1256 3088 a485913f71bbd74bb8a1bdce2e2c5d80c107da7d6c08bf088599c1ee62ccb109.exe 87 PID 3088 wrote to memory of 1256 3088 a485913f71bbd74bb8a1bdce2e2c5d80c107da7d6c08bf088599c1ee62ccb109.exe 87 PID 1256 wrote to memory of 1236 1256 cmd.exe 89 PID 1256 wrote to memory of 1236 1256 cmd.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\a485913f71bbd74bb8a1bdce2e2c5d80c107da7d6c08bf088599c1ee62ccb109.exe"C:\Users\Admin\AppData\Local\Temp\a485913f71bbd74bb8a1bdce2e2c5d80c107da7d6c08bf088599c1ee62ccb109.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3088 -
C:\Windows\System32\Wbem\wmic.exewmic os get Caption2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1928
-
-
C:\Windows\system32\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
- Suspicious use of WriteProcessMemory
PID:3396 -
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2268
-
-
-
C:\Windows\system32\cmd.execmd /C "wmic cpu get name"2⤵
- Suspicious use of WriteProcessMemory
PID:1256 -
C:\Windows\System32\Wbem\WMIC.exewmic cpu get name3⤵PID:1236
-
-