Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
20s -
max time network
44s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
04/12/2022, 12:21
Static task
static1
Behavioral task
behavioral1
Sample
af3d519bd12d60130d9ae029fde0d434f5840f102f6c6217bc0ecafaa9baf32d.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
af3d519bd12d60130d9ae029fde0d434f5840f102f6c6217bc0ecafaa9baf32d.exe
Resource
win10v2004-20220812-en
General
-
Target
af3d519bd12d60130d9ae029fde0d434f5840f102f6c6217bc0ecafaa9baf32d.exe
-
Size
489KB
-
MD5
87f875ed4fb7fe7153d7601819e7c65b
-
SHA1
da1bedeeee6c2e0b8d24639b2394489c0f07c829
-
SHA256
af3d519bd12d60130d9ae029fde0d434f5840f102f6c6217bc0ecafaa9baf32d
-
SHA512
bb7fc532656abb7409a5410e4a443d24d52a99f4ef22ec0d910828a833fb1835426644f6061583da7547938381f183d479e04513cdc5cb4ed96650aa163d5a51
-
SSDEEP
12288:d+QfhJ7kNO9EoUOPKD3ypHaWIjsDEDsj:dXJ7kY9EoUpDipjED
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1444 befadegfdg_P.exe -
Loads dropped DLL 2 IoCs
pid Process 1640 af3d519bd12d60130d9ae029fde0d434f5840f102f6c6217bc0ecafaa9baf32d.exe 1640 af3d519bd12d60130d9ae029fde0d434f5840f102f6c6217bc0ecafaa9baf32d.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1220 wmic.exe Token: SeSecurityPrivilege 1220 wmic.exe Token: SeTakeOwnershipPrivilege 1220 wmic.exe Token: SeLoadDriverPrivilege 1220 wmic.exe Token: SeSystemProfilePrivilege 1220 wmic.exe Token: SeSystemtimePrivilege 1220 wmic.exe Token: SeProfSingleProcessPrivilege 1220 wmic.exe Token: SeIncBasePriorityPrivilege 1220 wmic.exe Token: SeCreatePagefilePrivilege 1220 wmic.exe Token: SeBackupPrivilege 1220 wmic.exe Token: SeRestorePrivilege 1220 wmic.exe Token: SeShutdownPrivilege 1220 wmic.exe Token: SeDebugPrivilege 1220 wmic.exe Token: SeSystemEnvironmentPrivilege 1220 wmic.exe Token: SeRemoteShutdownPrivilege 1220 wmic.exe Token: SeUndockPrivilege 1220 wmic.exe Token: SeManageVolumePrivilege 1220 wmic.exe Token: 33 1220 wmic.exe Token: 34 1220 wmic.exe Token: 35 1220 wmic.exe Token: SeIncreaseQuotaPrivilege 1220 wmic.exe Token: SeSecurityPrivilege 1220 wmic.exe Token: SeTakeOwnershipPrivilege 1220 wmic.exe Token: SeLoadDriverPrivilege 1220 wmic.exe Token: SeSystemProfilePrivilege 1220 wmic.exe Token: SeSystemtimePrivilege 1220 wmic.exe Token: SeProfSingleProcessPrivilege 1220 wmic.exe Token: SeIncBasePriorityPrivilege 1220 wmic.exe Token: SeCreatePagefilePrivilege 1220 wmic.exe Token: SeBackupPrivilege 1220 wmic.exe Token: SeRestorePrivilege 1220 wmic.exe Token: SeShutdownPrivilege 1220 wmic.exe Token: SeDebugPrivilege 1220 wmic.exe Token: SeSystemEnvironmentPrivilege 1220 wmic.exe Token: SeRemoteShutdownPrivilege 1220 wmic.exe Token: SeUndockPrivilege 1220 wmic.exe Token: SeManageVolumePrivilege 1220 wmic.exe Token: 33 1220 wmic.exe Token: 34 1220 wmic.exe Token: 35 1220 wmic.exe Token: SeIncreaseQuotaPrivilege 1784 wmic.exe Token: SeSecurityPrivilege 1784 wmic.exe Token: SeTakeOwnershipPrivilege 1784 wmic.exe Token: SeLoadDriverPrivilege 1784 wmic.exe Token: SeSystemProfilePrivilege 1784 wmic.exe Token: SeSystemtimePrivilege 1784 wmic.exe Token: SeProfSingleProcessPrivilege 1784 wmic.exe Token: SeIncBasePriorityPrivilege 1784 wmic.exe Token: SeCreatePagefilePrivilege 1784 wmic.exe Token: SeBackupPrivilege 1784 wmic.exe Token: SeRestorePrivilege 1784 wmic.exe Token: SeShutdownPrivilege 1784 wmic.exe Token: SeDebugPrivilege 1784 wmic.exe Token: SeSystemEnvironmentPrivilege 1784 wmic.exe Token: SeRemoteShutdownPrivilege 1784 wmic.exe Token: SeUndockPrivilege 1784 wmic.exe Token: SeManageVolumePrivilege 1784 wmic.exe Token: 33 1784 wmic.exe Token: 34 1784 wmic.exe Token: 35 1784 wmic.exe Token: SeIncreaseQuotaPrivilege 1784 wmic.exe Token: SeSecurityPrivilege 1784 wmic.exe Token: SeTakeOwnershipPrivilege 1784 wmic.exe Token: SeLoadDriverPrivilege 1784 wmic.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 1640 wrote to memory of 1444 1640 af3d519bd12d60130d9ae029fde0d434f5840f102f6c6217bc0ecafaa9baf32d.exe 27 PID 1640 wrote to memory of 1444 1640 af3d519bd12d60130d9ae029fde0d434f5840f102f6c6217bc0ecafaa9baf32d.exe 27 PID 1640 wrote to memory of 1444 1640 af3d519bd12d60130d9ae029fde0d434f5840f102f6c6217bc0ecafaa9baf32d.exe 27 PID 1640 wrote to memory of 1444 1640 af3d519bd12d60130d9ae029fde0d434f5840f102f6c6217bc0ecafaa9baf32d.exe 27 PID 1444 wrote to memory of 1220 1444 befadegfdg_P.exe 28 PID 1444 wrote to memory of 1220 1444 befadegfdg_P.exe 28 PID 1444 wrote to memory of 1220 1444 befadegfdg_P.exe 28 PID 1444 wrote to memory of 1220 1444 befadegfdg_P.exe 28 PID 1444 wrote to memory of 1784 1444 befadegfdg_P.exe 31 PID 1444 wrote to memory of 1784 1444 befadegfdg_P.exe 31 PID 1444 wrote to memory of 1784 1444 befadegfdg_P.exe 31 PID 1444 wrote to memory of 1784 1444 befadegfdg_P.exe 31 PID 1444 wrote to memory of 1012 1444 befadegfdg_P.exe 33 PID 1444 wrote to memory of 1012 1444 befadegfdg_P.exe 33 PID 1444 wrote to memory of 1012 1444 befadegfdg_P.exe 33 PID 1444 wrote to memory of 1012 1444 befadegfdg_P.exe 33 PID 1444 wrote to memory of 844 1444 befadegfdg_P.exe 35 PID 1444 wrote to memory of 844 1444 befadegfdg_P.exe 35 PID 1444 wrote to memory of 844 1444 befadegfdg_P.exe 35 PID 1444 wrote to memory of 844 1444 befadegfdg_P.exe 35 PID 1444 wrote to memory of 2000 1444 befadegfdg_P.exe 37 PID 1444 wrote to memory of 2000 1444 befadegfdg_P.exe 37 PID 1444 wrote to memory of 2000 1444 befadegfdg_P.exe 37 PID 1444 wrote to memory of 2000 1444 befadegfdg_P.exe 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\af3d519bd12d60130d9ae029fde0d434f5840f102f6c6217bc0ecafaa9baf32d.exe"C:\Users\Admin\AppData\Local\Temp\af3d519bd12d60130d9ae029fde0d434f5840f102f6c6217bc0ecafaa9baf32d.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\befadegfdg_P.exeC:\Users\Admin\AppData\Local\Temp\befadegfdg_P.exe 6|8|9|0|5|5|7|1|1|2|7 KUhARDgsMjczMBkpS0xCS0Q9PC8eKEg9S1dKTURIQzspGic7SU5PQkM8LhkpO0BEOCsZLk9QSD5NOlRaRD08Lx4oTT1JVkBNWFRRSjZibGtwNSoocnF0Jz49SksoT0hPLD9JSiZATkFKGS5CSkI9Q0BEOBsoQzA7JisYJkQtOCYwHy09LTUkMRsqPTM8KyoaJzs1OCgqHy5OS0k8TENPWklRSFQ6PVE0ICpLS05DUzxOVzxVRzw2Hy5OS0k8TENPWkdATEM2Gic8WEBaTlFLOxkpPU9FWj5GQ0tHRz81Fy9DSkxTXkBLSU9KRU04Lh8uUkE7RkJZSlBYVFFKNhonTU04LRkuQ1EqNxgmUlBJTUhMQ1hRPUNDSkg+SEw/QD9NSUw4GyhIUl1LT0ZLSUhANnNxc14aJ0lFT1BLTUhMQFlNSkVNWj1AWFE2LBgmSEQ/Plc8LxkpQUpfP1RHQExHPFk9RUNNVElTREI2YFljc2AbKENOVUdGRzhEWkRJPDEuMSgpKDApNCwtMDArGidHQU08RUtESlhDRkpUPEdFPHNwbl8YJlRESD48MDIuKi4nMDIsLx8uQkhRRkNPPD9YU0hLPjcpKS8tKygxLy8uJDAxMzM1LDUpP0Y=2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81670473056.txt bios get serialnumber3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1220
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81670473056.txt bios get version3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1784
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81670473056.txt bios get version3⤵PID:1012
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81670473056.txt bios get version3⤵PID:844
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81670473056.txt bios get version3⤵PID:2000
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
66B
MD59025468f85256136f923096b01375964
SHA17fcd174999661594fa5f88890ffb195e9858cc52
SHA256d5418014fa8e6e17d8992fd12c0dfecac8a34855603ea58133e87ea09c2130df
SHA51292cac37c332e6e276a963d659986a79a79867df44682bfc2d77ed7784ffa5e2c149e5960a83d03ef4cf171be40a73e93a110aaa53b95152fa9a9da6b41d31e51
-
Filesize
58B
MD5dd876faf0fd44a5fab3e82368e2e8b15
SHA101b04083fa278dda3a81705ca5abcfee487a3c90
SHA2565602490a82bcacec8797d25cbb6f643fc9e69f89a2f0e6ec1e8d1f568e77a6b9
SHA512e03d1def5b7fb0ed01a414cead199229ec0e153ff831d3ff5dd36c320572084c56a5e1369c753f868c855455758c0d308941b6187c348051419bd937d014cb8b
-
Filesize
58B
MD5dd876faf0fd44a5fab3e82368e2e8b15
SHA101b04083fa278dda3a81705ca5abcfee487a3c90
SHA2565602490a82bcacec8797d25cbb6f643fc9e69f89a2f0e6ec1e8d1f568e77a6b9
SHA512e03d1def5b7fb0ed01a414cead199229ec0e153ff831d3ff5dd36c320572084c56a5e1369c753f868c855455758c0d308941b6187c348051419bd937d014cb8b
-
Filesize
58B
MD5dd876faf0fd44a5fab3e82368e2e8b15
SHA101b04083fa278dda3a81705ca5abcfee487a3c90
SHA2565602490a82bcacec8797d25cbb6f643fc9e69f89a2f0e6ec1e8d1f568e77a6b9
SHA512e03d1def5b7fb0ed01a414cead199229ec0e153ff831d3ff5dd36c320572084c56a5e1369c753f868c855455758c0d308941b6187c348051419bd937d014cb8b
-
Filesize
58B
MD5dd876faf0fd44a5fab3e82368e2e8b15
SHA101b04083fa278dda3a81705ca5abcfee487a3c90
SHA2565602490a82bcacec8797d25cbb6f643fc9e69f89a2f0e6ec1e8d1f568e77a6b9
SHA512e03d1def5b7fb0ed01a414cead199229ec0e153ff831d3ff5dd36c320572084c56a5e1369c753f868c855455758c0d308941b6187c348051419bd937d014cb8b
-
Filesize
674KB
MD593c3c1d0d5299bb9cefe9e9181a17070
SHA177a89de10714fd3862276d65ca4cb440628d81a4
SHA256fbe70131b58335fc221283fe76ee5ebeef38c677ab97a7a775ec1a8beb32aaa7
SHA5129e2871266f95a6f96fd92db2f37141f4a39b095922e1a6f482a73fbaaeb653464f4ff0e445ef3aec95e9b1f2437245ff68fd7bc1c5e5341c572b24a1e4ab0ce3
-
Filesize
674KB
MD593c3c1d0d5299bb9cefe9e9181a17070
SHA177a89de10714fd3862276d65ca4cb440628d81a4
SHA256fbe70131b58335fc221283fe76ee5ebeef38c677ab97a7a775ec1a8beb32aaa7
SHA5129e2871266f95a6f96fd92db2f37141f4a39b095922e1a6f482a73fbaaeb653464f4ff0e445ef3aec95e9b1f2437245ff68fd7bc1c5e5341c572b24a1e4ab0ce3
-
Filesize
674KB
MD593c3c1d0d5299bb9cefe9e9181a17070
SHA177a89de10714fd3862276d65ca4cb440628d81a4
SHA256fbe70131b58335fc221283fe76ee5ebeef38c677ab97a7a775ec1a8beb32aaa7
SHA5129e2871266f95a6f96fd92db2f37141f4a39b095922e1a6f482a73fbaaeb653464f4ff0e445ef3aec95e9b1f2437245ff68fd7bc1c5e5341c572b24a1e4ab0ce3