Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
93s -
max time network
133s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
04/12/2022, 08:23
Static task
static1
Behavioral task
behavioral1
Sample
afb464d27ed5f290eb38611eb975fcb564c0ec8ee7a763e576c1f1bae9d475c0.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
afb464d27ed5f290eb38611eb975fcb564c0ec8ee7a763e576c1f1bae9d475c0.exe
Resource
win10v2004-20220812-en
General
-
Target
afb464d27ed5f290eb38611eb975fcb564c0ec8ee7a763e576c1f1bae9d475c0.exe
-
Size
339KB
-
MD5
5b08102ee740b71b4422d8f2c90a25a0
-
SHA1
8047ce470c40f13dca2da3dacec651f01b9b4551
-
SHA256
afb464d27ed5f290eb38611eb975fcb564c0ec8ee7a763e576c1f1bae9d475c0
-
SHA512
624dc6141f46b347aef52dc8130cb108a402a27c5fa8e0118a67a3aa0fbe945e6fcc88759427e52fdc91908fe6c72bb5593129370efdd6b83a742e07a56470d1
-
SSDEEP
6144:0FJ0NkG16FcuAJP1a35uZ29HLGBPhXy2/Bs6q9o2ljiHI1:NlJe00K1Byuj2ljiHI1
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 5060 beeieiijdh.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
pid pid_target Process procid_target 4608 5060 WerFault.exe 78 -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 4928 wmic.exe Token: SeSecurityPrivilege 4928 wmic.exe Token: SeTakeOwnershipPrivilege 4928 wmic.exe Token: SeLoadDriverPrivilege 4928 wmic.exe Token: SeSystemProfilePrivilege 4928 wmic.exe Token: SeSystemtimePrivilege 4928 wmic.exe Token: SeProfSingleProcessPrivilege 4928 wmic.exe Token: SeIncBasePriorityPrivilege 4928 wmic.exe Token: SeCreatePagefilePrivilege 4928 wmic.exe Token: SeBackupPrivilege 4928 wmic.exe Token: SeRestorePrivilege 4928 wmic.exe Token: SeShutdownPrivilege 4928 wmic.exe Token: SeDebugPrivilege 4928 wmic.exe Token: SeSystemEnvironmentPrivilege 4928 wmic.exe Token: SeRemoteShutdownPrivilege 4928 wmic.exe Token: SeUndockPrivilege 4928 wmic.exe Token: SeManageVolumePrivilege 4928 wmic.exe Token: 33 4928 wmic.exe Token: 34 4928 wmic.exe Token: 35 4928 wmic.exe Token: 36 4928 wmic.exe Token: SeIncreaseQuotaPrivilege 4928 wmic.exe Token: SeSecurityPrivilege 4928 wmic.exe Token: SeTakeOwnershipPrivilege 4928 wmic.exe Token: SeLoadDriverPrivilege 4928 wmic.exe Token: SeSystemProfilePrivilege 4928 wmic.exe Token: SeSystemtimePrivilege 4928 wmic.exe Token: SeProfSingleProcessPrivilege 4928 wmic.exe Token: SeIncBasePriorityPrivilege 4928 wmic.exe Token: SeCreatePagefilePrivilege 4928 wmic.exe Token: SeBackupPrivilege 4928 wmic.exe Token: SeRestorePrivilege 4928 wmic.exe Token: SeShutdownPrivilege 4928 wmic.exe Token: SeDebugPrivilege 4928 wmic.exe Token: SeSystemEnvironmentPrivilege 4928 wmic.exe Token: SeRemoteShutdownPrivilege 4928 wmic.exe Token: SeUndockPrivilege 4928 wmic.exe Token: SeManageVolumePrivilege 4928 wmic.exe Token: 33 4928 wmic.exe Token: 34 4928 wmic.exe Token: 35 4928 wmic.exe Token: 36 4928 wmic.exe Token: SeIncreaseQuotaPrivilege 1944 wmic.exe Token: SeSecurityPrivilege 1944 wmic.exe Token: SeTakeOwnershipPrivilege 1944 wmic.exe Token: SeLoadDriverPrivilege 1944 wmic.exe Token: SeSystemProfilePrivilege 1944 wmic.exe Token: SeSystemtimePrivilege 1944 wmic.exe Token: SeProfSingleProcessPrivilege 1944 wmic.exe Token: SeIncBasePriorityPrivilege 1944 wmic.exe Token: SeCreatePagefilePrivilege 1944 wmic.exe Token: SeBackupPrivilege 1944 wmic.exe Token: SeRestorePrivilege 1944 wmic.exe Token: SeShutdownPrivilege 1944 wmic.exe Token: SeDebugPrivilege 1944 wmic.exe Token: SeSystemEnvironmentPrivilege 1944 wmic.exe Token: SeRemoteShutdownPrivilege 1944 wmic.exe Token: SeUndockPrivilege 1944 wmic.exe Token: SeManageVolumePrivilege 1944 wmic.exe Token: 33 1944 wmic.exe Token: 34 1944 wmic.exe Token: 35 1944 wmic.exe Token: 36 1944 wmic.exe Token: SeIncreaseQuotaPrivilege 1944 wmic.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 4284 wrote to memory of 5060 4284 afb464d27ed5f290eb38611eb975fcb564c0ec8ee7a763e576c1f1bae9d475c0.exe 78 PID 4284 wrote to memory of 5060 4284 afb464d27ed5f290eb38611eb975fcb564c0ec8ee7a763e576c1f1bae9d475c0.exe 78 PID 4284 wrote to memory of 5060 4284 afb464d27ed5f290eb38611eb975fcb564c0ec8ee7a763e576c1f1bae9d475c0.exe 78 PID 5060 wrote to memory of 4928 5060 beeieiijdh.exe 79 PID 5060 wrote to memory of 4928 5060 beeieiijdh.exe 79 PID 5060 wrote to memory of 4928 5060 beeieiijdh.exe 79 PID 5060 wrote to memory of 1944 5060 beeieiijdh.exe 82 PID 5060 wrote to memory of 1944 5060 beeieiijdh.exe 82 PID 5060 wrote to memory of 1944 5060 beeieiijdh.exe 82 PID 5060 wrote to memory of 436 5060 beeieiijdh.exe 84 PID 5060 wrote to memory of 436 5060 beeieiijdh.exe 84 PID 5060 wrote to memory of 436 5060 beeieiijdh.exe 84 PID 5060 wrote to memory of 224 5060 beeieiijdh.exe 86 PID 5060 wrote to memory of 224 5060 beeieiijdh.exe 86 PID 5060 wrote to memory of 224 5060 beeieiijdh.exe 86 PID 5060 wrote to memory of 4368 5060 beeieiijdh.exe 88 PID 5060 wrote to memory of 4368 5060 beeieiijdh.exe 88 PID 5060 wrote to memory of 4368 5060 beeieiijdh.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\afb464d27ed5f290eb38611eb975fcb564c0ec8ee7a763e576c1f1bae9d475c0.exe"C:\Users\Admin\AppData\Local\Temp\afb464d27ed5f290eb38611eb975fcb564c0ec8ee7a763e576c1f1bae9d475c0.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Users\Admin\AppData\Local\Temp\beeieiijdh.exeC:\Users\Admin\AppData\Local\Temp\beeieiijdh.exe 4^4^8^6^6^9^3^2^0^2^4 K0xBPjcpMDEyNRwrT008SkBBOzAeK0pBTFFJSUhHRDstHCs8Q01LRkI9MDUzMigaKTpGQj0uHCtMSkk+TEBSX0dAOS4xKionHS1TQ05SQUpZT0lJO2hycGw2JyltaXMsRENPRylMSUokPk5QLEVKQkcaKTpJR0NJRUA5RFQzX0ZfS1ZJT2tAbmosb1FZRmt2Lz8wSD82eFYwcjF2b0RnYVw0aUEpbXRtK284RVNIb20xby5vRi9wRG54LElIMD0vSmBdakdvQkkrcC9kSlR4Zy5iTldmKzo1cUQyW0F1UjIyLGRJd3VgQ15cPUFmT28gLUAtOSUrGiZBMD0rLRwrPC03JC4eL0IwOSkpGik7MjstLxwrTEpJPkxAUl9OTkVSOT1TNB0tUFBLQFE7Tlk8UkpBOxwrTEpJPkxAUl9MPUlBNV1vXCphbHNeHCs9Uj9WUlBMOyB3UUpGdxcsQ1hDWz9JPEZDRUI7IC1ES09MWTxJTFVTQ045MRgpTj8+TEtXS1FbTUxGNGVydG42KytZXWZgYGkuX2Bka1srKGVici9ycUtzMEYwOkh3em1RTFNLMGJmazdtPXBwOSogcFhvLz0kcl1uKjcgbV5wMzsuMi0qIEo6UVY9JGk5X21fJ1ppc2IeK1JJNSwaJkFRMTsuMi0qGilJUkxUR0lBW08/RjpMS0VHST1DPU9MQzoeL0dPW05NSE5ASkM9cm5xYRgpTDxRU1JMRUpDV09NPE9dRD9VTzkqGik/RkJFVjktHCdDTVZBV04/SUU/Vz9IOk9XUFJBQDleW2ZqYh4vQktTSkRJOztcR1A7Liw0JisrJys3MywtLi4YKUo4Tz9MSkFIW0FITUs+Skw7cG5xXRopS0ZLRTstMDAwLjMpLTUyHitAS09IRkY+Ql9SRUlBNSsrJi8zLzAsLTEiKyoxMjI6MS4mTEU=2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81670452822.txt bios get serialnumber3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4928
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81670452822.txt bios get version3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1944
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81670452822.txt bios get version3⤵PID:436
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81670452822.txt bios get version3⤵PID:224
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81670452822.txt bios get version3⤵PID:4368
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5060 -s 9523⤵
- Program crash
PID:4608
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 5060 -ip 50601⤵PID:1028
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
66B
MD59025468f85256136f923096b01375964
SHA17fcd174999661594fa5f88890ffb195e9858cc52
SHA256d5418014fa8e6e17d8992fd12c0dfecac8a34855603ea58133e87ea09c2130df
SHA51292cac37c332e6e276a963d659986a79a79867df44682bfc2d77ed7784ffa5e2c149e5960a83d03ef4cf171be40a73e93a110aaa53b95152fa9a9da6b41d31e51
-
Filesize
58B
MD5dd876faf0fd44a5fab3e82368e2e8b15
SHA101b04083fa278dda3a81705ca5abcfee487a3c90
SHA2565602490a82bcacec8797d25cbb6f643fc9e69f89a2f0e6ec1e8d1f568e77a6b9
SHA512e03d1def5b7fb0ed01a414cead199229ec0e153ff831d3ff5dd36c320572084c56a5e1369c753f868c855455758c0d308941b6187c348051419bd937d014cb8b
-
Filesize
58B
MD5dd876faf0fd44a5fab3e82368e2e8b15
SHA101b04083fa278dda3a81705ca5abcfee487a3c90
SHA2565602490a82bcacec8797d25cbb6f643fc9e69f89a2f0e6ec1e8d1f568e77a6b9
SHA512e03d1def5b7fb0ed01a414cead199229ec0e153ff831d3ff5dd36c320572084c56a5e1369c753f868c855455758c0d308941b6187c348051419bd937d014cb8b
-
Filesize
58B
MD5dd876faf0fd44a5fab3e82368e2e8b15
SHA101b04083fa278dda3a81705ca5abcfee487a3c90
SHA2565602490a82bcacec8797d25cbb6f643fc9e69f89a2f0e6ec1e8d1f568e77a6b9
SHA512e03d1def5b7fb0ed01a414cead199229ec0e153ff831d3ff5dd36c320572084c56a5e1369c753f868c855455758c0d308941b6187c348051419bd937d014cb8b
-
Filesize
58B
MD5dd876faf0fd44a5fab3e82368e2e8b15
SHA101b04083fa278dda3a81705ca5abcfee487a3c90
SHA2565602490a82bcacec8797d25cbb6f643fc9e69f89a2f0e6ec1e8d1f568e77a6b9
SHA512e03d1def5b7fb0ed01a414cead199229ec0e153ff831d3ff5dd36c320572084c56a5e1369c753f868c855455758c0d308941b6187c348051419bd937d014cb8b
-
Filesize
538KB
MD5455355350aba23c8b4ac75853f646253
SHA18e778c586dc525c7e516ec120a41e553aad93ffb
SHA2564606c28efadc3d2f752b9e73e57c93f931bdcac2c9ae627403103094da25ce03
SHA5120d68d891942933e2647b26625c22732b10535bf16ff65befed3c493f7ac7a133c3d4c6ea8d1f56a97f26a5a386d65da053070160049b0534dd3ba9b3a37c95f8
-
Filesize
538KB
MD5455355350aba23c8b4ac75853f646253
SHA18e778c586dc525c7e516ec120a41e553aad93ffb
SHA2564606c28efadc3d2f752b9e73e57c93f931bdcac2c9ae627403103094da25ce03
SHA5120d68d891942933e2647b26625c22732b10535bf16ff65befed3c493f7ac7a133c3d4c6ea8d1f56a97f26a5a386d65da053070160049b0534dd3ba9b3a37c95f8