Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
31s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
12/04/2023, 13:37
Static task
static1
Behavioral task
behavioral1
Sample
ORDER SPEC.scr
Resource
win7-20230220-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
ORDER SPEC.scr
Resource
win10v2004-20230221-en
11 signatures
150 seconds
General
-
Target
ORDER SPEC.scr
-
Size
2.7MB
-
MD5
6d5c38d39f2e653c9954f44bc113b9fb
-
SHA1
fa3aa47590e4aaac3c656b4fe114c6f56b76ba20
-
SHA256
dccdd805ab3a1f31780ce46912cce1356dc12084e46e31aa6208052ddcd95054
-
SHA512
c60c31be41343b410d66e78be6b59f9c818b216e380023453ff45571f90de68acbb27c76f3f164965b860f70ddbd12e890f2a82f429f19edc24a5e2d8ce32176
-
SSDEEP
49152:20SnnC+BsY/8q7+gbf+qjw98xyDNGTQmSPcFP9+o:20
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Windows\CurrentVersion\Run\Wyizvjwuet = "\"C:\\Users\\Admin\\AppData\\Roaming\\Cvnpw\\Wyizvjwuet.exe\"" ORDER SPEC.scr -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 11 IoCs
pid Process 1692 powershell.exe 1920 ORDER SPEC.scr 1920 ORDER SPEC.scr 1920 ORDER SPEC.scr 1920 ORDER SPEC.scr 1920 ORDER SPEC.scr 1920 ORDER SPEC.scr 1920 ORDER SPEC.scr 1920 ORDER SPEC.scr 1920 ORDER SPEC.scr 1920 ORDER SPEC.scr -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1692 powershell.exe Token: SeDebugPrivilege 1920 ORDER SPEC.scr -
Suspicious use of WriteProcessMemory 33 IoCs
description pid Process procid_target PID 1920 wrote to memory of 1692 1920 ORDER SPEC.scr 27 PID 1920 wrote to memory of 1692 1920 ORDER SPEC.scr 27 PID 1920 wrote to memory of 1692 1920 ORDER SPEC.scr 27 PID 1920 wrote to memory of 1004 1920 ORDER SPEC.scr 29 PID 1920 wrote to memory of 1004 1920 ORDER SPEC.scr 29 PID 1920 wrote to memory of 1004 1920 ORDER SPEC.scr 29 PID 1920 wrote to memory of 1128 1920 ORDER SPEC.scr 30 PID 1920 wrote to memory of 1128 1920 ORDER SPEC.scr 30 PID 1920 wrote to memory of 1128 1920 ORDER SPEC.scr 30 PID 1920 wrote to memory of 956 1920 ORDER SPEC.scr 32 PID 1920 wrote to memory of 956 1920 ORDER SPEC.scr 32 PID 1920 wrote to memory of 956 1920 ORDER SPEC.scr 32 PID 1920 wrote to memory of 1652 1920 ORDER SPEC.scr 31 PID 1920 wrote to memory of 1652 1920 ORDER SPEC.scr 31 PID 1920 wrote to memory of 1652 1920 ORDER SPEC.scr 31 PID 1920 wrote to memory of 1792 1920 ORDER SPEC.scr 33 PID 1920 wrote to memory of 1792 1920 ORDER SPEC.scr 33 PID 1920 wrote to memory of 1792 1920 ORDER SPEC.scr 33 PID 1920 wrote to memory of 916 1920 ORDER SPEC.scr 34 PID 1920 wrote to memory of 916 1920 ORDER SPEC.scr 34 PID 1920 wrote to memory of 916 1920 ORDER SPEC.scr 34 PID 1920 wrote to memory of 1432 1920 ORDER SPEC.scr 35 PID 1920 wrote to memory of 1432 1920 ORDER SPEC.scr 35 PID 1920 wrote to memory of 1432 1920 ORDER SPEC.scr 35 PID 1920 wrote to memory of 996 1920 ORDER SPEC.scr 36 PID 1920 wrote to memory of 996 1920 ORDER SPEC.scr 36 PID 1920 wrote to memory of 996 1920 ORDER SPEC.scr 36 PID 1920 wrote to memory of 744 1920 ORDER SPEC.scr 37 PID 1920 wrote to memory of 744 1920 ORDER SPEC.scr 37 PID 1920 wrote to memory of 744 1920 ORDER SPEC.scr 37 PID 1920 wrote to memory of 772 1920 ORDER SPEC.scr 38 PID 1920 wrote to memory of 772 1920 ORDER SPEC.scr 38 PID 1920 wrote to memory of 772 1920 ORDER SPEC.scr 38
Processes
-
C:\Users\Admin\AppData\Local\Temp\ORDER SPEC.scr"C:\Users\Admin\AppData\Local\Temp\ORDER SPEC.scr" /S1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1692
-
-
C:\Users\Admin\AppData\Local\Temp\ORDER SPEC.scr"C:\Users\Admin\AppData\Local\Temp\ORDER SPEC.scr"2⤵PID:1004
-
-
C:\Users\Admin\AppData\Local\Temp\ORDER SPEC.scr"C:\Users\Admin\AppData\Local\Temp\ORDER SPEC.scr"2⤵PID:1128
-
-
C:\Users\Admin\AppData\Local\Temp\ORDER SPEC.scr"C:\Users\Admin\AppData\Local\Temp\ORDER SPEC.scr"2⤵PID:1652
-
-
C:\Users\Admin\AppData\Local\Temp\ORDER SPEC.scr"C:\Users\Admin\AppData\Local\Temp\ORDER SPEC.scr"2⤵PID:956
-
-
C:\Users\Admin\AppData\Local\Temp\ORDER SPEC.scr"C:\Users\Admin\AppData\Local\Temp\ORDER SPEC.scr"2⤵PID:1792
-
-
C:\Users\Admin\AppData\Local\Temp\ORDER SPEC.scr"C:\Users\Admin\AppData\Local\Temp\ORDER SPEC.scr"2⤵PID:916
-
-
C:\Users\Admin\AppData\Local\Temp\ORDER SPEC.scr"C:\Users\Admin\AppData\Local\Temp\ORDER SPEC.scr"2⤵PID:1432
-
-
C:\Users\Admin\AppData\Local\Temp\ORDER SPEC.scr"C:\Users\Admin\AppData\Local\Temp\ORDER SPEC.scr"2⤵PID:996
-
-
C:\Users\Admin\AppData\Local\Temp\ORDER SPEC.scr"C:\Users\Admin\AppData\Local\Temp\ORDER SPEC.scr"2⤵PID:744
-
-
C:\Users\Admin\AppData\Local\Temp\ORDER SPEC.scr"C:\Users\Admin\AppData\Local\Temp\ORDER SPEC.scr"2⤵PID:772
-