Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    43s
  • max time network
    48s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    04/12/2022, 08:23

General

  • Target

    afb464d27ed5f290eb38611eb975fcb564c0ec8ee7a763e576c1f1bae9d475c0.exe

  • Size

    339KB

  • MD5

    5b08102ee740b71b4422d8f2c90a25a0

  • SHA1

    8047ce470c40f13dca2da3dacec651f01b9b4551

  • SHA256

    afb464d27ed5f290eb38611eb975fcb564c0ec8ee7a763e576c1f1bae9d475c0

  • SHA512

    624dc6141f46b347aef52dc8130cb108a402a27c5fa8e0118a67a3aa0fbe945e6fcc88759427e52fdc91908fe6c72bb5593129370efdd6b83a742e07a56470d1

  • SSDEEP

    6144:0FJ0NkG16FcuAJP1a35uZ29HLGBPhXy2/Bs6q9o2ljiHI1:NlJe00K1Byuj2ljiHI1

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\afb464d27ed5f290eb38611eb975fcb564c0ec8ee7a763e576c1f1bae9d475c0.exe
    "C:\Users\Admin\AppData\Local\Temp\afb464d27ed5f290eb38611eb975fcb564c0ec8ee7a763e576c1f1bae9d475c0.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1348
    • C:\Users\Admin\AppData\Local\Temp\beeieiijdh.exe
      C:\Users\Admin\AppData\Local\Temp\beeieiijdh.exe 4^4^8^6^6^9^3^2^0^2^4 K0xBPjcpMDEyNRwrT008SkBBOzAeK0pBTFFJSUhHRDstHCs8Q01LRkI9MDUzMigaKTpGQj0uHCtMSkk+TEBSX0dAOS4xKionHS1TQ05SQUpZT0lJO2hycGw2JyltaXMsRENPRylMSUokPk5QLEVKQkcaKTpJR0NJRUA5RFQzX0ZfS1ZJT2tAbmosb1FZRmt2Lz8wSD82eFYwcjF2b0RnYVw0aUEpbXRtK284RVNIb20xby5vRi9wRG54LElIMD0vSmBdakdvQkkrcC9kSlR4Zy5iTldmKzo1cUQyW0F1UjIyLGRJd3VgQ15cPUFmT28gLUAtOSUrGiZBMD0rLRwrPC03JC4eL0IwOSkpGik7MjstLxwrTEpJPkxAUl9OTkVSOT1TNB0tUFBLQFE7Tlk8UkpBOxwrTEpJPkxAUl9MPUlBNV1vXCphbHNeHCs9Uj9WUlBMOyB3UUpGdxcsQ1hDWz9JPEZDRUI7IC1ES09MWTxJTFVTQ045MRgpTj8+TEtXS1FbTUxGNGVydG42KytZXWZgYGkuX2Bka1srKGVici9ycUtzMEYwOkh3em1RTFNLMGJmazdtPXBwOSogcFhvLz0kcl1uKjcgbV5wMzsuMi0qIEo6UVY9JGk5X21fJ1ppc2IeK1JJNSwaJkFRMTsuMi0qGilJUkxUR0lBW08/RjpMS0VHST1DPU9MQzoeL0dPW05NSE5ASkM9cm5xYRgpTDxRU1JMRUpDV09NPE9dRD9VTzkqGik/RkJFVjktHCdDTVZBV04/SUU/Vz9IOk9XUFJBQDleW2ZqYh4vQktTSkRJOztcR1A7Liw0JisrJys3MywtLi4YKUo4Tz9MSkFIW0FITUs+Skw7cG5xXRopS0ZLRTstMDAwLjMpLTUyHitAS09IRkY+Ql9SRUlBNSsrJi8zLzAsLTEiKyoxMjI6MS4mTEU=
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:2032
      • C:\Windows\SysWOW64\Wbem\wmic.exe
        wmic /output:C:\Users\Admin\AppData\Local\Temp\81670449182.txt bios get serialnumber
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1224
      • C:\Windows\SysWOW64\Wbem\wmic.exe
        wmic /output:C:\Users\Admin\AppData\Local\Temp\81670449182.txt bios get version
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:892
      • C:\Windows\SysWOW64\Wbem\wmic.exe
        wmic /output:C:\Users\Admin\AppData\Local\Temp\81670449182.txt bios get version
        3⤵
          PID:1092
        • C:\Windows\SysWOW64\Wbem\wmic.exe
          wmic /output:C:\Users\Admin\AppData\Local\Temp\81670449182.txt bios get version
          3⤵
            PID:1468
          • C:\Windows\SysWOW64\Wbem\wmic.exe
            wmic /output:C:\Users\Admin\AppData\Local\Temp\81670449182.txt bios get version
            3⤵
              PID:1544
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 372
              3⤵
              • Loads dropped DLL
              • Program crash
              PID:1816

        Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\81670449182.txt

          Filesize

          66B

          MD5

          9025468f85256136f923096b01375964

          SHA1

          7fcd174999661594fa5f88890ffb195e9858cc52

          SHA256

          d5418014fa8e6e17d8992fd12c0dfecac8a34855603ea58133e87ea09c2130df

          SHA512

          92cac37c332e6e276a963d659986a79a79867df44682bfc2d77ed7784ffa5e2c149e5960a83d03ef4cf171be40a73e93a110aaa53b95152fa9a9da6b41d31e51

        • C:\Users\Admin\AppData\Local\Temp\81670449182.txt

          Filesize

          58B

          MD5

          dd876faf0fd44a5fab3e82368e2e8b15

          SHA1

          01b04083fa278dda3a81705ca5abcfee487a3c90

          SHA256

          5602490a82bcacec8797d25cbb6f643fc9e69f89a2f0e6ec1e8d1f568e77a6b9

          SHA512

          e03d1def5b7fb0ed01a414cead199229ec0e153ff831d3ff5dd36c320572084c56a5e1369c753f868c855455758c0d308941b6187c348051419bd937d014cb8b

        • C:\Users\Admin\AppData\Local\Temp\81670449182.txt

          Filesize

          58B

          MD5

          dd876faf0fd44a5fab3e82368e2e8b15

          SHA1

          01b04083fa278dda3a81705ca5abcfee487a3c90

          SHA256

          5602490a82bcacec8797d25cbb6f643fc9e69f89a2f0e6ec1e8d1f568e77a6b9

          SHA512

          e03d1def5b7fb0ed01a414cead199229ec0e153ff831d3ff5dd36c320572084c56a5e1369c753f868c855455758c0d308941b6187c348051419bd937d014cb8b

        • C:\Users\Admin\AppData\Local\Temp\81670449182.txt

          Filesize

          58B

          MD5

          dd876faf0fd44a5fab3e82368e2e8b15

          SHA1

          01b04083fa278dda3a81705ca5abcfee487a3c90

          SHA256

          5602490a82bcacec8797d25cbb6f643fc9e69f89a2f0e6ec1e8d1f568e77a6b9

          SHA512

          e03d1def5b7fb0ed01a414cead199229ec0e153ff831d3ff5dd36c320572084c56a5e1369c753f868c855455758c0d308941b6187c348051419bd937d014cb8b

        • C:\Users\Admin\AppData\Local\Temp\81670449182.txt

          Filesize

          58B

          MD5

          dd876faf0fd44a5fab3e82368e2e8b15

          SHA1

          01b04083fa278dda3a81705ca5abcfee487a3c90

          SHA256

          5602490a82bcacec8797d25cbb6f643fc9e69f89a2f0e6ec1e8d1f568e77a6b9

          SHA512

          e03d1def5b7fb0ed01a414cead199229ec0e153ff831d3ff5dd36c320572084c56a5e1369c753f868c855455758c0d308941b6187c348051419bd937d014cb8b

        • C:\Users\Admin\AppData\Local\Temp\beeieiijdh.exe

          Filesize

          538KB

          MD5

          455355350aba23c8b4ac75853f646253

          SHA1

          8e778c586dc525c7e516ec120a41e553aad93ffb

          SHA256

          4606c28efadc3d2f752b9e73e57c93f931bdcac2c9ae627403103094da25ce03

          SHA512

          0d68d891942933e2647b26625c22732b10535bf16ff65befed3c493f7ac7a133c3d4c6ea8d1f56a97f26a5a386d65da053070160049b0534dd3ba9b3a37c95f8

        • \Users\Admin\AppData\Local\Temp\beeieiijdh.exe

          Filesize

          538KB

          MD5

          455355350aba23c8b4ac75853f646253

          SHA1

          8e778c586dc525c7e516ec120a41e553aad93ffb

          SHA256

          4606c28efadc3d2f752b9e73e57c93f931bdcac2c9ae627403103094da25ce03

          SHA512

          0d68d891942933e2647b26625c22732b10535bf16ff65befed3c493f7ac7a133c3d4c6ea8d1f56a97f26a5a386d65da053070160049b0534dd3ba9b3a37c95f8

        • \Users\Admin\AppData\Local\Temp\beeieiijdh.exe

          Filesize

          538KB

          MD5

          455355350aba23c8b4ac75853f646253

          SHA1

          8e778c586dc525c7e516ec120a41e553aad93ffb

          SHA256

          4606c28efadc3d2f752b9e73e57c93f931bdcac2c9ae627403103094da25ce03

          SHA512

          0d68d891942933e2647b26625c22732b10535bf16ff65befed3c493f7ac7a133c3d4c6ea8d1f56a97f26a5a386d65da053070160049b0534dd3ba9b3a37c95f8

        • \Users\Admin\AppData\Local\Temp\beeieiijdh.exe

          Filesize

          538KB

          MD5

          455355350aba23c8b4ac75853f646253

          SHA1

          8e778c586dc525c7e516ec120a41e553aad93ffb

          SHA256

          4606c28efadc3d2f752b9e73e57c93f931bdcac2c9ae627403103094da25ce03

          SHA512

          0d68d891942933e2647b26625c22732b10535bf16ff65befed3c493f7ac7a133c3d4c6ea8d1f56a97f26a5a386d65da053070160049b0534dd3ba9b3a37c95f8

        • \Users\Admin\AppData\Local\Temp\beeieiijdh.exe

          Filesize

          538KB

          MD5

          455355350aba23c8b4ac75853f646253

          SHA1

          8e778c586dc525c7e516ec120a41e553aad93ffb

          SHA256

          4606c28efadc3d2f752b9e73e57c93f931bdcac2c9ae627403103094da25ce03

          SHA512

          0d68d891942933e2647b26625c22732b10535bf16ff65befed3c493f7ac7a133c3d4c6ea8d1f56a97f26a5a386d65da053070160049b0534dd3ba9b3a37c95f8

        • \Users\Admin\AppData\Local\Temp\beeieiijdh.exe

          Filesize

          538KB

          MD5

          455355350aba23c8b4ac75853f646253

          SHA1

          8e778c586dc525c7e516ec120a41e553aad93ffb

          SHA256

          4606c28efadc3d2f752b9e73e57c93f931bdcac2c9ae627403103094da25ce03

          SHA512

          0d68d891942933e2647b26625c22732b10535bf16ff65befed3c493f7ac7a133c3d4c6ea8d1f56a97f26a5a386d65da053070160049b0534dd3ba9b3a37c95f8

        • memory/1348-54-0x0000000075601000-0x0000000075603000-memory.dmp

          Filesize

          8KB