Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
40s -
max time network
44s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
02/02/2023, 12:47
Static task
static1
Behavioral task
behavioral1
Sample
ogbanseef.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
ogbanseef.exe
Resource
win10v2004-20220812-en
General
-
Target
ogbanseef.exe
-
Size
2.4MB
-
MD5
df95e42d4edb19dc4b94941f2b613492
-
SHA1
39037e64ebf0763a42ff4d0312d776d51bbbf06d
-
SHA256
ee116c48b8e4a3fd0e805b90b03ece7fee2e141d05a386a44bf3725b41d7a534
-
SHA512
0a98fbb4bfb9647ddb92c2bfea3504831d29d76274a206d07e88fe5dbf41d8544633008d5d1f2ecfb9390043e14090e1b1812bc41f2519d0d0943c8d3f0227fa
-
SSDEEP
49152:No981ADu1skJBigljMWzOVgEwmiJQgWW4O:N/AUzZYg8iJQw4
Malware Config
Signatures
-
Detect PureCrypter injector 1 IoCs
resource yara_rule behavioral1/memory/1116-55-0x0000000004A80000-0x0000000004CDC000-memory.dmp family_purecrypter -
PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\Eryrascyo = "\"C:\\Users\\Admin\\AppData\\Roaming\\Pqijqagie\\Eryrascyo.exe\"" ogbanseef.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 11 IoCs
pid Process 1260 powershell.exe 1116 ogbanseef.exe 1116 ogbanseef.exe 1116 ogbanseef.exe 1116 ogbanseef.exe 1116 ogbanseef.exe 1116 ogbanseef.exe 1116 ogbanseef.exe 1116 ogbanseef.exe 1116 ogbanseef.exe 1116 ogbanseef.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1116 ogbanseef.exe Token: SeDebugPrivilege 1260 powershell.exe -
Suspicious use of WriteProcessMemory 44 IoCs
description pid Process procid_target PID 1116 wrote to memory of 1260 1116 ogbanseef.exe 26 PID 1116 wrote to memory of 1260 1116 ogbanseef.exe 26 PID 1116 wrote to memory of 1260 1116 ogbanseef.exe 26 PID 1116 wrote to memory of 1260 1116 ogbanseef.exe 26 PID 1116 wrote to memory of 908 1116 ogbanseef.exe 28 PID 1116 wrote to memory of 908 1116 ogbanseef.exe 28 PID 1116 wrote to memory of 908 1116 ogbanseef.exe 28 PID 1116 wrote to memory of 908 1116 ogbanseef.exe 28 PID 1116 wrote to memory of 904 1116 ogbanseef.exe 29 PID 1116 wrote to memory of 904 1116 ogbanseef.exe 29 PID 1116 wrote to memory of 904 1116 ogbanseef.exe 29 PID 1116 wrote to memory of 904 1116 ogbanseef.exe 29 PID 1116 wrote to memory of 580 1116 ogbanseef.exe 30 PID 1116 wrote to memory of 580 1116 ogbanseef.exe 30 PID 1116 wrote to memory of 580 1116 ogbanseef.exe 30 PID 1116 wrote to memory of 580 1116 ogbanseef.exe 30 PID 1116 wrote to memory of 764 1116 ogbanseef.exe 31 PID 1116 wrote to memory of 764 1116 ogbanseef.exe 31 PID 1116 wrote to memory of 764 1116 ogbanseef.exe 31 PID 1116 wrote to memory of 764 1116 ogbanseef.exe 31 PID 1116 wrote to memory of 768 1116 ogbanseef.exe 32 PID 1116 wrote to memory of 768 1116 ogbanseef.exe 32 PID 1116 wrote to memory of 768 1116 ogbanseef.exe 32 PID 1116 wrote to memory of 768 1116 ogbanseef.exe 32 PID 1116 wrote to memory of 460 1116 ogbanseef.exe 33 PID 1116 wrote to memory of 460 1116 ogbanseef.exe 33 PID 1116 wrote to memory of 460 1116 ogbanseef.exe 33 PID 1116 wrote to memory of 460 1116 ogbanseef.exe 33 PID 1116 wrote to memory of 660 1116 ogbanseef.exe 34 PID 1116 wrote to memory of 660 1116 ogbanseef.exe 34 PID 1116 wrote to memory of 660 1116 ogbanseef.exe 34 PID 1116 wrote to memory of 660 1116 ogbanseef.exe 34 PID 1116 wrote to memory of 576 1116 ogbanseef.exe 35 PID 1116 wrote to memory of 576 1116 ogbanseef.exe 35 PID 1116 wrote to memory of 576 1116 ogbanseef.exe 35 PID 1116 wrote to memory of 576 1116 ogbanseef.exe 35 PID 1116 wrote to memory of 824 1116 ogbanseef.exe 36 PID 1116 wrote to memory of 824 1116 ogbanseef.exe 36 PID 1116 wrote to memory of 824 1116 ogbanseef.exe 36 PID 1116 wrote to memory of 824 1116 ogbanseef.exe 36 PID 1116 wrote to memory of 1048 1116 ogbanseef.exe 37 PID 1116 wrote to memory of 1048 1116 ogbanseef.exe 37 PID 1116 wrote to memory of 1048 1116 ogbanseef.exe 37 PID 1116 wrote to memory of 1048 1116 ogbanseef.exe 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\ogbanseef.exe"C:\Users\Admin\AppData\Local\Temp\ogbanseef.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1260
-
-
C:\Users\Admin\AppData\Local\Temp\ogbanseef.exeC:\Users\Admin\AppData\Local\Temp\ogbanseef.exe2⤵PID:908
-
-
C:\Users\Admin\AppData\Local\Temp\ogbanseef.exeC:\Users\Admin\AppData\Local\Temp\ogbanseef.exe2⤵PID:904
-
-
C:\Users\Admin\AppData\Local\Temp\ogbanseef.exeC:\Users\Admin\AppData\Local\Temp\ogbanseef.exe2⤵PID:580
-
-
C:\Users\Admin\AppData\Local\Temp\ogbanseef.exeC:\Users\Admin\AppData\Local\Temp\ogbanseef.exe2⤵PID:764
-
-
C:\Users\Admin\AppData\Local\Temp\ogbanseef.exeC:\Users\Admin\AppData\Local\Temp\ogbanseef.exe2⤵PID:768
-
-
C:\Users\Admin\AppData\Local\Temp\ogbanseef.exeC:\Users\Admin\AppData\Local\Temp\ogbanseef.exe2⤵PID:460
-
-
C:\Users\Admin\AppData\Local\Temp\ogbanseef.exeC:\Users\Admin\AppData\Local\Temp\ogbanseef.exe2⤵PID:660
-
-
C:\Users\Admin\AppData\Local\Temp\ogbanseef.exeC:\Users\Admin\AppData\Local\Temp\ogbanseef.exe2⤵PID:576
-
-
C:\Users\Admin\AppData\Local\Temp\ogbanseef.exeC:\Users\Admin\AppData\Local\Temp\ogbanseef.exe2⤵PID:824
-
-
C:\Users\Admin\AppData\Local\Temp\ogbanseef.exeC:\Users\Admin\AppData\Local\Temp\ogbanseef.exe2⤵PID:1048
-