Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    20s
  • max time network
    44s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    04/12/2022, 12:21

General

  • Target

    af3d519bd12d60130d9ae029fde0d434f5840f102f6c6217bc0ecafaa9baf32d.exe

  • Size

    489KB

  • MD5

    87f875ed4fb7fe7153d7601819e7c65b

  • SHA1

    da1bedeeee6c2e0b8d24639b2394489c0f07c829

  • SHA256

    af3d519bd12d60130d9ae029fde0d434f5840f102f6c6217bc0ecafaa9baf32d

  • SHA512

    bb7fc532656abb7409a5410e4a443d24d52a99f4ef22ec0d910828a833fb1835426644f6061583da7547938381f183d479e04513cdc5cb4ed96650aa163d5a51

  • SSDEEP

    12288:d+QfhJ7kNO9EoUOPKD3ypHaWIjsDEDsj:dXJ7kY9EoUpDipjED

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\af3d519bd12d60130d9ae029fde0d434f5840f102f6c6217bc0ecafaa9baf32d.exe
    "C:\Users\Admin\AppData\Local\Temp\af3d519bd12d60130d9ae029fde0d434f5840f102f6c6217bc0ecafaa9baf32d.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1640
    • C:\Users\Admin\AppData\Local\Temp\befadegfdg_P.exe
      C:\Users\Admin\AppData\Local\Temp\befadegfdg_P.exe 6|8|9|0|5|5|7|1|1|2|7 KUhARDgsMjczMBkpS0xCS0Q9PC8eKEg9S1dKTURIQzspGic7SU5PQkM8LhkpO0BEOCsZLk9QSD5NOlRaRD08Lx4oTT1JVkBNWFRRSjZibGtwNSoocnF0Jz49SksoT0hPLD9JSiZATkFKGS5CSkI9Q0BEOBsoQzA7JisYJkQtOCYwHy09LTUkMRsqPTM8KyoaJzs1OCgqHy5OS0k8TENPWklRSFQ6PVE0ICpLS05DUzxOVzxVRzw2Hy5OS0k8TENPWkdATEM2Gic8WEBaTlFLOxkpPU9FWj5GQ0tHRz81Fy9DSkxTXkBLSU9KRU04Lh8uUkE7RkJZSlBYVFFKNhonTU04LRkuQ1EqNxgmUlBJTUhMQ1hRPUNDSkg+SEw/QD9NSUw4GyhIUl1LT0ZLSUhANnNxc14aJ0lFT1BLTUhMQFlNSkVNWj1AWFE2LBgmSEQ/Plc8LxkpQUpfP1RHQExHPFk9RUNNVElTREI2YFljc2AbKENOVUdGRzhEWkRJPDEuMSgpKDApNCwtMDArGidHQU08RUtESlhDRkpUPEdFPHNwbl8YJlRESD48MDIuKi4nMDIsLx8uQkhRRkNPPD9YU0hLPjcpKS8tKygxLy8uJDAxMzM1LDUpP0Y=
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:1444
      • C:\Windows\SysWOW64\Wbem\wmic.exe
        wmic /output:C:\Users\Admin\AppData\Local\Temp\81670473056.txt bios get serialnumber
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1220
      • C:\Windows\SysWOW64\Wbem\wmic.exe
        wmic /output:C:\Users\Admin\AppData\Local\Temp\81670473056.txt bios get version
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1784
      • C:\Windows\SysWOW64\Wbem\wmic.exe
        wmic /output:C:\Users\Admin\AppData\Local\Temp\81670473056.txt bios get version
        3⤵
          PID:1012
        • C:\Windows\SysWOW64\Wbem\wmic.exe
          wmic /output:C:\Users\Admin\AppData\Local\Temp\81670473056.txt bios get version
          3⤵
            PID:844
          • C:\Windows\SysWOW64\Wbem\wmic.exe
            wmic /output:C:\Users\Admin\AppData\Local\Temp\81670473056.txt bios get version
            3⤵
              PID:2000

        Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\81670473056.txt

          Filesize

          66B

          MD5

          9025468f85256136f923096b01375964

          SHA1

          7fcd174999661594fa5f88890ffb195e9858cc52

          SHA256

          d5418014fa8e6e17d8992fd12c0dfecac8a34855603ea58133e87ea09c2130df

          SHA512

          92cac37c332e6e276a963d659986a79a79867df44682bfc2d77ed7784ffa5e2c149e5960a83d03ef4cf171be40a73e93a110aaa53b95152fa9a9da6b41d31e51

        • C:\Users\Admin\AppData\Local\Temp\81670473056.txt

          Filesize

          58B

          MD5

          dd876faf0fd44a5fab3e82368e2e8b15

          SHA1

          01b04083fa278dda3a81705ca5abcfee487a3c90

          SHA256

          5602490a82bcacec8797d25cbb6f643fc9e69f89a2f0e6ec1e8d1f568e77a6b9

          SHA512

          e03d1def5b7fb0ed01a414cead199229ec0e153ff831d3ff5dd36c320572084c56a5e1369c753f868c855455758c0d308941b6187c348051419bd937d014cb8b

        • C:\Users\Admin\AppData\Local\Temp\81670473056.txt

          Filesize

          58B

          MD5

          dd876faf0fd44a5fab3e82368e2e8b15

          SHA1

          01b04083fa278dda3a81705ca5abcfee487a3c90

          SHA256

          5602490a82bcacec8797d25cbb6f643fc9e69f89a2f0e6ec1e8d1f568e77a6b9

          SHA512

          e03d1def5b7fb0ed01a414cead199229ec0e153ff831d3ff5dd36c320572084c56a5e1369c753f868c855455758c0d308941b6187c348051419bd937d014cb8b

        • C:\Users\Admin\AppData\Local\Temp\81670473056.txt

          Filesize

          58B

          MD5

          dd876faf0fd44a5fab3e82368e2e8b15

          SHA1

          01b04083fa278dda3a81705ca5abcfee487a3c90

          SHA256

          5602490a82bcacec8797d25cbb6f643fc9e69f89a2f0e6ec1e8d1f568e77a6b9

          SHA512

          e03d1def5b7fb0ed01a414cead199229ec0e153ff831d3ff5dd36c320572084c56a5e1369c753f868c855455758c0d308941b6187c348051419bd937d014cb8b

        • C:\Users\Admin\AppData\Local\Temp\81670473056.txt

          Filesize

          58B

          MD5

          dd876faf0fd44a5fab3e82368e2e8b15

          SHA1

          01b04083fa278dda3a81705ca5abcfee487a3c90

          SHA256

          5602490a82bcacec8797d25cbb6f643fc9e69f89a2f0e6ec1e8d1f568e77a6b9

          SHA512

          e03d1def5b7fb0ed01a414cead199229ec0e153ff831d3ff5dd36c320572084c56a5e1369c753f868c855455758c0d308941b6187c348051419bd937d014cb8b

        • C:\Users\Admin\AppData\Local\Temp\befadegfdg_P.exe

          Filesize

          674KB

          MD5

          93c3c1d0d5299bb9cefe9e9181a17070

          SHA1

          77a89de10714fd3862276d65ca4cb440628d81a4

          SHA256

          fbe70131b58335fc221283fe76ee5ebeef38c677ab97a7a775ec1a8beb32aaa7

          SHA512

          9e2871266f95a6f96fd92db2f37141f4a39b095922e1a6f482a73fbaaeb653464f4ff0e445ef3aec95e9b1f2437245ff68fd7bc1c5e5341c572b24a1e4ab0ce3

        • \Users\Admin\AppData\Local\Temp\befadegfdg_P.exe

          Filesize

          674KB

          MD5

          93c3c1d0d5299bb9cefe9e9181a17070

          SHA1

          77a89de10714fd3862276d65ca4cb440628d81a4

          SHA256

          fbe70131b58335fc221283fe76ee5ebeef38c677ab97a7a775ec1a8beb32aaa7

          SHA512

          9e2871266f95a6f96fd92db2f37141f4a39b095922e1a6f482a73fbaaeb653464f4ff0e445ef3aec95e9b1f2437245ff68fd7bc1c5e5341c572b24a1e4ab0ce3

        • \Users\Admin\AppData\Local\Temp\befadegfdg_P.exe

          Filesize

          674KB

          MD5

          93c3c1d0d5299bb9cefe9e9181a17070

          SHA1

          77a89de10714fd3862276d65ca4cb440628d81a4

          SHA256

          fbe70131b58335fc221283fe76ee5ebeef38c677ab97a7a775ec1a8beb32aaa7

          SHA512

          9e2871266f95a6f96fd92db2f37141f4a39b095922e1a6f482a73fbaaeb653464f4ff0e445ef3aec95e9b1f2437245ff68fd7bc1c5e5341c572b24a1e4ab0ce3

        • memory/1444-70-0x0000000000560000-0x0000000000603000-memory.dmp

          Filesize

          652KB

        • memory/1640-54-0x0000000075071000-0x0000000075073000-memory.dmp

          Filesize

          8KB