Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
43s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
04/12/2022, 08:23
Static task
static1
Behavioral task
behavioral1
Sample
afb464d27ed5f290eb38611eb975fcb564c0ec8ee7a763e576c1f1bae9d475c0.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
afb464d27ed5f290eb38611eb975fcb564c0ec8ee7a763e576c1f1bae9d475c0.exe
Resource
win10v2004-20220812-en
General
-
Target
afb464d27ed5f290eb38611eb975fcb564c0ec8ee7a763e576c1f1bae9d475c0.exe
-
Size
339KB
-
MD5
5b08102ee740b71b4422d8f2c90a25a0
-
SHA1
8047ce470c40f13dca2da3dacec651f01b9b4551
-
SHA256
afb464d27ed5f290eb38611eb975fcb564c0ec8ee7a763e576c1f1bae9d475c0
-
SHA512
624dc6141f46b347aef52dc8130cb108a402a27c5fa8e0118a67a3aa0fbe945e6fcc88759427e52fdc91908fe6c72bb5593129370efdd6b83a742e07a56470d1
-
SSDEEP
6144:0FJ0NkG16FcuAJP1a35uZ29HLGBPhXy2/Bs6q9o2ljiHI1:NlJe00K1Byuj2ljiHI1
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2032 beeieiijdh.exe -
Loads dropped DLL 5 IoCs
pid Process 1348 afb464d27ed5f290eb38611eb975fcb564c0ec8ee7a763e576c1f1bae9d475c0.exe 1816 WerFault.exe 1816 WerFault.exe 1816 WerFault.exe 1816 WerFault.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
pid pid_target Process procid_target 1816 2032 WerFault.exe 27 -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1224 wmic.exe Token: SeSecurityPrivilege 1224 wmic.exe Token: SeTakeOwnershipPrivilege 1224 wmic.exe Token: SeLoadDriverPrivilege 1224 wmic.exe Token: SeSystemProfilePrivilege 1224 wmic.exe Token: SeSystemtimePrivilege 1224 wmic.exe Token: SeProfSingleProcessPrivilege 1224 wmic.exe Token: SeIncBasePriorityPrivilege 1224 wmic.exe Token: SeCreatePagefilePrivilege 1224 wmic.exe Token: SeBackupPrivilege 1224 wmic.exe Token: SeRestorePrivilege 1224 wmic.exe Token: SeShutdownPrivilege 1224 wmic.exe Token: SeDebugPrivilege 1224 wmic.exe Token: SeSystemEnvironmentPrivilege 1224 wmic.exe Token: SeRemoteShutdownPrivilege 1224 wmic.exe Token: SeUndockPrivilege 1224 wmic.exe Token: SeManageVolumePrivilege 1224 wmic.exe Token: 33 1224 wmic.exe Token: 34 1224 wmic.exe Token: 35 1224 wmic.exe Token: SeIncreaseQuotaPrivilege 1224 wmic.exe Token: SeSecurityPrivilege 1224 wmic.exe Token: SeTakeOwnershipPrivilege 1224 wmic.exe Token: SeLoadDriverPrivilege 1224 wmic.exe Token: SeSystemProfilePrivilege 1224 wmic.exe Token: SeSystemtimePrivilege 1224 wmic.exe Token: SeProfSingleProcessPrivilege 1224 wmic.exe Token: SeIncBasePriorityPrivilege 1224 wmic.exe Token: SeCreatePagefilePrivilege 1224 wmic.exe Token: SeBackupPrivilege 1224 wmic.exe Token: SeRestorePrivilege 1224 wmic.exe Token: SeShutdownPrivilege 1224 wmic.exe Token: SeDebugPrivilege 1224 wmic.exe Token: SeSystemEnvironmentPrivilege 1224 wmic.exe Token: SeRemoteShutdownPrivilege 1224 wmic.exe Token: SeUndockPrivilege 1224 wmic.exe Token: SeManageVolumePrivilege 1224 wmic.exe Token: 33 1224 wmic.exe Token: 34 1224 wmic.exe Token: 35 1224 wmic.exe Token: SeIncreaseQuotaPrivilege 892 wmic.exe Token: SeSecurityPrivilege 892 wmic.exe Token: SeTakeOwnershipPrivilege 892 wmic.exe Token: SeLoadDriverPrivilege 892 wmic.exe Token: SeSystemProfilePrivilege 892 wmic.exe Token: SeSystemtimePrivilege 892 wmic.exe Token: SeProfSingleProcessPrivilege 892 wmic.exe Token: SeIncBasePriorityPrivilege 892 wmic.exe Token: SeCreatePagefilePrivilege 892 wmic.exe Token: SeBackupPrivilege 892 wmic.exe Token: SeRestorePrivilege 892 wmic.exe Token: SeShutdownPrivilege 892 wmic.exe Token: SeDebugPrivilege 892 wmic.exe Token: SeSystemEnvironmentPrivilege 892 wmic.exe Token: SeRemoteShutdownPrivilege 892 wmic.exe Token: SeUndockPrivilege 892 wmic.exe Token: SeManageVolumePrivilege 892 wmic.exe Token: 33 892 wmic.exe Token: 34 892 wmic.exe Token: 35 892 wmic.exe Token: SeIncreaseQuotaPrivilege 892 wmic.exe Token: SeSecurityPrivilege 892 wmic.exe Token: SeTakeOwnershipPrivilege 892 wmic.exe Token: SeLoadDriverPrivilege 892 wmic.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 1348 wrote to memory of 2032 1348 afb464d27ed5f290eb38611eb975fcb564c0ec8ee7a763e576c1f1bae9d475c0.exe 27 PID 1348 wrote to memory of 2032 1348 afb464d27ed5f290eb38611eb975fcb564c0ec8ee7a763e576c1f1bae9d475c0.exe 27 PID 1348 wrote to memory of 2032 1348 afb464d27ed5f290eb38611eb975fcb564c0ec8ee7a763e576c1f1bae9d475c0.exe 27 PID 1348 wrote to memory of 2032 1348 afb464d27ed5f290eb38611eb975fcb564c0ec8ee7a763e576c1f1bae9d475c0.exe 27 PID 2032 wrote to memory of 1224 2032 beeieiijdh.exe 28 PID 2032 wrote to memory of 1224 2032 beeieiijdh.exe 28 PID 2032 wrote to memory of 1224 2032 beeieiijdh.exe 28 PID 2032 wrote to memory of 1224 2032 beeieiijdh.exe 28 PID 2032 wrote to memory of 892 2032 beeieiijdh.exe 31 PID 2032 wrote to memory of 892 2032 beeieiijdh.exe 31 PID 2032 wrote to memory of 892 2032 beeieiijdh.exe 31 PID 2032 wrote to memory of 892 2032 beeieiijdh.exe 31 PID 2032 wrote to memory of 1092 2032 beeieiijdh.exe 33 PID 2032 wrote to memory of 1092 2032 beeieiijdh.exe 33 PID 2032 wrote to memory of 1092 2032 beeieiijdh.exe 33 PID 2032 wrote to memory of 1092 2032 beeieiijdh.exe 33 PID 2032 wrote to memory of 1468 2032 beeieiijdh.exe 35 PID 2032 wrote to memory of 1468 2032 beeieiijdh.exe 35 PID 2032 wrote to memory of 1468 2032 beeieiijdh.exe 35 PID 2032 wrote to memory of 1468 2032 beeieiijdh.exe 35 PID 2032 wrote to memory of 1544 2032 beeieiijdh.exe 37 PID 2032 wrote to memory of 1544 2032 beeieiijdh.exe 37 PID 2032 wrote to memory of 1544 2032 beeieiijdh.exe 37 PID 2032 wrote to memory of 1544 2032 beeieiijdh.exe 37 PID 2032 wrote to memory of 1816 2032 beeieiijdh.exe 39 PID 2032 wrote to memory of 1816 2032 beeieiijdh.exe 39 PID 2032 wrote to memory of 1816 2032 beeieiijdh.exe 39 PID 2032 wrote to memory of 1816 2032 beeieiijdh.exe 39
Processes
-
C:\Users\Admin\AppData\Local\Temp\afb464d27ed5f290eb38611eb975fcb564c0ec8ee7a763e576c1f1bae9d475c0.exe"C:\Users\Admin\AppData\Local\Temp\afb464d27ed5f290eb38611eb975fcb564c0ec8ee7a763e576c1f1bae9d475c0.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Users\Admin\AppData\Local\Temp\beeieiijdh.exeC:\Users\Admin\AppData\Local\Temp\beeieiijdh.exe 4^4^8^6^6^9^3^2^0^2^4 K0xBPjcpMDEyNRwrT008SkBBOzAeK0pBTFFJSUhHRDstHCs8Q01LRkI9MDUzMigaKTpGQj0uHCtMSkk+TEBSX0dAOS4xKionHS1TQ05SQUpZT0lJO2hycGw2JyltaXMsRENPRylMSUokPk5QLEVKQkcaKTpJR0NJRUA5RFQzX0ZfS1ZJT2tAbmosb1FZRmt2Lz8wSD82eFYwcjF2b0RnYVw0aUEpbXRtK284RVNIb20xby5vRi9wRG54LElIMD0vSmBdakdvQkkrcC9kSlR4Zy5iTldmKzo1cUQyW0F1UjIyLGRJd3VgQ15cPUFmT28gLUAtOSUrGiZBMD0rLRwrPC03JC4eL0IwOSkpGik7MjstLxwrTEpJPkxAUl9OTkVSOT1TNB0tUFBLQFE7Tlk8UkpBOxwrTEpJPkxAUl9MPUlBNV1vXCphbHNeHCs9Uj9WUlBMOyB3UUpGdxcsQ1hDWz9JPEZDRUI7IC1ES09MWTxJTFVTQ045MRgpTj8+TEtXS1FbTUxGNGVydG42KytZXWZgYGkuX2Bka1srKGVici9ycUtzMEYwOkh3em1RTFNLMGJmazdtPXBwOSogcFhvLz0kcl1uKjcgbV5wMzsuMi0qIEo6UVY9JGk5X21fJ1ppc2IeK1JJNSwaJkFRMTsuMi0qGilJUkxUR0lBW08/RjpMS0VHST1DPU9MQzoeL0dPW05NSE5ASkM9cm5xYRgpTDxRU1JMRUpDV09NPE9dRD9VTzkqGik/RkJFVjktHCdDTVZBV04/SUU/Vz9IOk9XUFJBQDleW2ZqYh4vQktTSkRJOztcR1A7Liw0JisrJys3MywtLi4YKUo4Tz9MSkFIW0FITUs+Skw7cG5xXRopS0ZLRTstMDAwLjMpLTUyHitAS09IRkY+Ql9SRUlBNSsrJi8zLzAsLTEiKyoxMjI6MS4mTEU=2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81670449182.txt bios get serialnumber3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1224
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81670449182.txt bios get version3⤵
- Suspicious use of AdjustPrivilegeToken
PID:892
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81670449182.txt bios get version3⤵PID:1092
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81670449182.txt bios get version3⤵PID:1468
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81670449182.txt bios get version3⤵PID:1544
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 3723⤵
- Loads dropped DLL
- Program crash
PID:1816
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
66B
MD59025468f85256136f923096b01375964
SHA17fcd174999661594fa5f88890ffb195e9858cc52
SHA256d5418014fa8e6e17d8992fd12c0dfecac8a34855603ea58133e87ea09c2130df
SHA51292cac37c332e6e276a963d659986a79a79867df44682bfc2d77ed7784ffa5e2c149e5960a83d03ef4cf171be40a73e93a110aaa53b95152fa9a9da6b41d31e51
-
Filesize
58B
MD5dd876faf0fd44a5fab3e82368e2e8b15
SHA101b04083fa278dda3a81705ca5abcfee487a3c90
SHA2565602490a82bcacec8797d25cbb6f643fc9e69f89a2f0e6ec1e8d1f568e77a6b9
SHA512e03d1def5b7fb0ed01a414cead199229ec0e153ff831d3ff5dd36c320572084c56a5e1369c753f868c855455758c0d308941b6187c348051419bd937d014cb8b
-
Filesize
58B
MD5dd876faf0fd44a5fab3e82368e2e8b15
SHA101b04083fa278dda3a81705ca5abcfee487a3c90
SHA2565602490a82bcacec8797d25cbb6f643fc9e69f89a2f0e6ec1e8d1f568e77a6b9
SHA512e03d1def5b7fb0ed01a414cead199229ec0e153ff831d3ff5dd36c320572084c56a5e1369c753f868c855455758c0d308941b6187c348051419bd937d014cb8b
-
Filesize
58B
MD5dd876faf0fd44a5fab3e82368e2e8b15
SHA101b04083fa278dda3a81705ca5abcfee487a3c90
SHA2565602490a82bcacec8797d25cbb6f643fc9e69f89a2f0e6ec1e8d1f568e77a6b9
SHA512e03d1def5b7fb0ed01a414cead199229ec0e153ff831d3ff5dd36c320572084c56a5e1369c753f868c855455758c0d308941b6187c348051419bd937d014cb8b
-
Filesize
58B
MD5dd876faf0fd44a5fab3e82368e2e8b15
SHA101b04083fa278dda3a81705ca5abcfee487a3c90
SHA2565602490a82bcacec8797d25cbb6f643fc9e69f89a2f0e6ec1e8d1f568e77a6b9
SHA512e03d1def5b7fb0ed01a414cead199229ec0e153ff831d3ff5dd36c320572084c56a5e1369c753f868c855455758c0d308941b6187c348051419bd937d014cb8b
-
Filesize
538KB
MD5455355350aba23c8b4ac75853f646253
SHA18e778c586dc525c7e516ec120a41e553aad93ffb
SHA2564606c28efadc3d2f752b9e73e57c93f931bdcac2c9ae627403103094da25ce03
SHA5120d68d891942933e2647b26625c22732b10535bf16ff65befed3c493f7ac7a133c3d4c6ea8d1f56a97f26a5a386d65da053070160049b0534dd3ba9b3a37c95f8
-
Filesize
538KB
MD5455355350aba23c8b4ac75853f646253
SHA18e778c586dc525c7e516ec120a41e553aad93ffb
SHA2564606c28efadc3d2f752b9e73e57c93f931bdcac2c9ae627403103094da25ce03
SHA5120d68d891942933e2647b26625c22732b10535bf16ff65befed3c493f7ac7a133c3d4c6ea8d1f56a97f26a5a386d65da053070160049b0534dd3ba9b3a37c95f8
-
Filesize
538KB
MD5455355350aba23c8b4ac75853f646253
SHA18e778c586dc525c7e516ec120a41e553aad93ffb
SHA2564606c28efadc3d2f752b9e73e57c93f931bdcac2c9ae627403103094da25ce03
SHA5120d68d891942933e2647b26625c22732b10535bf16ff65befed3c493f7ac7a133c3d4c6ea8d1f56a97f26a5a386d65da053070160049b0534dd3ba9b3a37c95f8
-
Filesize
538KB
MD5455355350aba23c8b4ac75853f646253
SHA18e778c586dc525c7e516ec120a41e553aad93ffb
SHA2564606c28efadc3d2f752b9e73e57c93f931bdcac2c9ae627403103094da25ce03
SHA5120d68d891942933e2647b26625c22732b10535bf16ff65befed3c493f7ac7a133c3d4c6ea8d1f56a97f26a5a386d65da053070160049b0534dd3ba9b3a37c95f8
-
Filesize
538KB
MD5455355350aba23c8b4ac75853f646253
SHA18e778c586dc525c7e516ec120a41e553aad93ffb
SHA2564606c28efadc3d2f752b9e73e57c93f931bdcac2c9ae627403103094da25ce03
SHA5120d68d891942933e2647b26625c22732b10535bf16ff65befed3c493f7ac7a133c3d4c6ea8d1f56a97f26a5a386d65da053070160049b0534dd3ba9b3a37c95f8
-
Filesize
538KB
MD5455355350aba23c8b4ac75853f646253
SHA18e778c586dc525c7e516ec120a41e553aad93ffb
SHA2564606c28efadc3d2f752b9e73e57c93f931bdcac2c9ae627403103094da25ce03
SHA5120d68d891942933e2647b26625c22732b10535bf16ff65befed3c493f7ac7a133c3d4c6ea8d1f56a97f26a5a386d65da053070160049b0534dd3ba9b3a37c95f8