Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
04/05/2023, 21:16
230504-z4frlaha9y 304/05/2023, 20:53
230504-zpsgvafb66 304/05/2023, 20:38
230504-zew3aafa88 804/05/2023, 20:30
230504-y97ltsgg7x 3Analysis
-
max time kernel
259s -
max time network
263s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-de -
resource tags
arch:x64arch:x86image:win10v2004-20230220-delocale:de-deos:windows10-2004-x64systemwindows -
submitted
04/05/2023, 20:53
Static task
static1
Behavioral task
behavioral1
Sample
MossfieldOrigin.exe
Resource
win10-20230220-de
Behavioral task
behavioral2
Sample
MossfieldOrigin.exe
Resource
win10v2004-20230220-de
General
-
Target
MossfieldOrigin.exe
-
Size
33.1MB
-
MD5
bb48e12db27082f17fbaf07fa1f11276
-
SHA1
68b4b598a36f9325169a3a5b1c4e00d86dee3b6e
-
SHA256
83e7c2cd30fbc3fbb7baa0b997d9fa5bf9ed075a510ba2382be7d6c44006273c
-
SHA512
f2b37160c99d6512d10eb260759d731636f418bbdca936c317079963cc286fbf09da75724b5c05b25a937cfa24ddca47d8bf7068ee164ebc5f3590532eb4cd7c
-
SSDEEP
393216:RVkZDbxDV08qbsvOaNpDBcDsxsbqFlUMFkEli4dqRYVHkFtOv9OBBuX6rYRAqs3s:RG/DpKtzIVm09tX6rYSnyQH1lQ
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 16 IoCs
pid Process 1172 powershell.exe 1172 powershell.exe 1176 powershell.exe 1176 powershell.exe 3596 powershell.exe 3596 powershell.exe 2424 powershell.exe 2424 powershell.exe 4308 powershell.exe 1736 powershell.exe 2480 powershell.exe 4308 powershell.exe 1736 powershell.exe 2480 powershell.exe 1064 powershell.exe 1064 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1172 powershell.exe Token: SeDebugPrivilege 1176 powershell.exe Token: SeIncreaseQuotaPrivilege 1172 powershell.exe Token: SeSecurityPrivilege 1172 powershell.exe Token: SeTakeOwnershipPrivilege 1172 powershell.exe Token: SeLoadDriverPrivilege 1172 powershell.exe Token: SeSystemProfilePrivilege 1172 powershell.exe Token: SeSystemtimePrivilege 1172 powershell.exe Token: SeProfSingleProcessPrivilege 1172 powershell.exe Token: SeIncBasePriorityPrivilege 1172 powershell.exe Token: SeCreatePagefilePrivilege 1172 powershell.exe Token: SeBackupPrivilege 1172 powershell.exe Token: SeRestorePrivilege 1172 powershell.exe Token: SeShutdownPrivilege 1172 powershell.exe Token: SeDebugPrivilege 1172 powershell.exe Token: SeSystemEnvironmentPrivilege 1172 powershell.exe Token: SeRemoteShutdownPrivilege 1172 powershell.exe Token: SeUndockPrivilege 1172 powershell.exe Token: SeManageVolumePrivilege 1172 powershell.exe Token: 33 1172 powershell.exe Token: 34 1172 powershell.exe Token: 35 1172 powershell.exe Token: 36 1172 powershell.exe Token: SeDebugPrivilege 3596 powershell.exe Token: SeIncreaseQuotaPrivilege 3596 powershell.exe Token: SeSecurityPrivilege 3596 powershell.exe Token: SeTakeOwnershipPrivilege 3596 powershell.exe Token: SeLoadDriverPrivilege 3596 powershell.exe Token: SeSystemProfilePrivilege 3596 powershell.exe Token: SeSystemtimePrivilege 3596 powershell.exe Token: SeProfSingleProcessPrivilege 3596 powershell.exe Token: SeIncBasePriorityPrivilege 3596 powershell.exe Token: SeCreatePagefilePrivilege 3596 powershell.exe Token: SeBackupPrivilege 3596 powershell.exe Token: SeRestorePrivilege 3596 powershell.exe Token: SeShutdownPrivilege 3596 powershell.exe Token: SeDebugPrivilege 3596 powershell.exe Token: SeSystemEnvironmentPrivilege 3596 powershell.exe Token: SeRemoteShutdownPrivilege 3596 powershell.exe Token: SeUndockPrivilege 3596 powershell.exe Token: SeManageVolumePrivilege 3596 powershell.exe Token: 33 3596 powershell.exe Token: 34 3596 powershell.exe Token: 35 3596 powershell.exe Token: 36 3596 powershell.exe Token: SeDebugPrivilege 2424 powershell.exe Token: SeIncreaseQuotaPrivilege 2424 powershell.exe Token: SeSecurityPrivilege 2424 powershell.exe Token: SeTakeOwnershipPrivilege 2424 powershell.exe Token: SeLoadDriverPrivilege 2424 powershell.exe Token: SeSystemProfilePrivilege 2424 powershell.exe Token: SeSystemtimePrivilege 2424 powershell.exe Token: SeProfSingleProcessPrivilege 2424 powershell.exe Token: SeIncBasePriorityPrivilege 2424 powershell.exe Token: SeCreatePagefilePrivilege 2424 powershell.exe Token: SeBackupPrivilege 2424 powershell.exe Token: SeRestorePrivilege 2424 powershell.exe Token: SeShutdownPrivilege 2424 powershell.exe Token: SeDebugPrivilege 2424 powershell.exe Token: SeSystemEnvironmentPrivilege 2424 powershell.exe Token: SeRemoteShutdownPrivilege 2424 powershell.exe Token: SeUndockPrivilege 2424 powershell.exe Token: SeManageVolumePrivilege 2424 powershell.exe Token: 33 2424 powershell.exe -
Suspicious use of WriteProcessMemory 36 IoCs
description pid Process procid_target PID 1856 wrote to memory of 1844 1856 MossfieldOrigin.exe 84 PID 1856 wrote to memory of 1844 1856 MossfieldOrigin.exe 84 PID 1844 wrote to memory of 2236 1844 cmd.exe 86 PID 1844 wrote to memory of 2236 1844 cmd.exe 86 PID 1856 wrote to memory of 1176 1856 MossfieldOrigin.exe 88 PID 1856 wrote to memory of 1176 1856 MossfieldOrigin.exe 88 PID 1856 wrote to memory of 1172 1856 MossfieldOrigin.exe 87 PID 1856 wrote to memory of 1172 1856 MossfieldOrigin.exe 87 PID 1176 wrote to memory of 4568 1176 powershell.exe 90 PID 1176 wrote to memory of 4568 1176 powershell.exe 90 PID 4568 wrote to memory of 3948 4568 csc.exe 91 PID 4568 wrote to memory of 3948 4568 csc.exe 91 PID 1856 wrote to memory of 3596 1856 MossfieldOrigin.exe 92 PID 1856 wrote to memory of 3596 1856 MossfieldOrigin.exe 92 PID 1856 wrote to memory of 2424 1856 MossfieldOrigin.exe 98 PID 1856 wrote to memory of 2424 1856 MossfieldOrigin.exe 98 PID 1856 wrote to memory of 3356 1856 MossfieldOrigin.exe 100 PID 1856 wrote to memory of 3356 1856 MossfieldOrigin.exe 100 PID 1856 wrote to memory of 2480 1856 MossfieldOrigin.exe 103 PID 1856 wrote to memory of 2480 1856 MossfieldOrigin.exe 103 PID 1856 wrote to memory of 1736 1856 MossfieldOrigin.exe 104 PID 1856 wrote to memory of 1736 1856 MossfieldOrigin.exe 104 PID 1856 wrote to memory of 4308 1856 MossfieldOrigin.exe 105 PID 1856 wrote to memory of 4308 1856 MossfieldOrigin.exe 105 PID 1856 wrote to memory of 4480 1856 MossfieldOrigin.exe 109 PID 1856 wrote to memory of 4480 1856 MossfieldOrigin.exe 109 PID 4480 wrote to memory of 4424 4480 cmd.exe 111 PID 4480 wrote to memory of 4424 4480 cmd.exe 111 PID 1856 wrote to memory of 1064 1856 MossfieldOrigin.exe 112 PID 1856 wrote to memory of 1064 1856 MossfieldOrigin.exe 112 PID 1856 wrote to memory of 1380 1856 MossfieldOrigin.exe 116 PID 1856 wrote to memory of 1380 1856 MossfieldOrigin.exe 116 PID 1380 wrote to memory of 4532 1380 cmd.exe 118 PID 1380 wrote to memory of 4532 1380 cmd.exe 118 PID 1856 wrote to memory of 4672 1856 MossfieldOrigin.exe 119 PID 1856 wrote to memory of 4672 1856 MossfieldOrigin.exe 119
Processes
-
C:\Users\Admin\AppData\Local\Temp\MossfieldOrigin.exe"C:\Users\Admin\AppData\Local\Temp\MossfieldOrigin.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "chcp"2⤵
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Windows\system32\chcp.comchcp3⤵PID:2236
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1172
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -c " Add-Type -Name Window -Namespace Console -MemberDefinition ' [DllImport(\"Kernel32.dll\")] public static extern IntPtr GetConsoleWindow(); [DllImport(\"user32.dll\")] public static extern bool ShowWindow(IntPtr hWnd, Int32 nCmdShow); ' $consolePtr = [Console.Window]::GetConsoleWindow() #0 hide [Console.Window]::ShowWindow($consolePtr, 0) "2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1176 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\x1qw2cda\x1qw2cda.cmdline"3⤵
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9DFA.tmp" "c:\Users\Admin\AppData\Local\Temp\x1qw2cda\CSC8A4574AB9BBF498B853FE43C29732CB.TMP"4⤵PID:3948
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3596
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2424
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "echo %COMPUTERNAME%.%USERDNSDOMAIN%"2⤵PID:3356
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2480
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1736
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4308
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "findstr /C:"Detected boot environment" "%windir%\Panther\setupact.log""2⤵
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\Windows\system32\findstr.exefindstr /C:"Detected boot environment" "C:\Windows\Panther\setupact.log"3⤵PID:4424
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1064
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /v MachineGuid"2⤵
- Suspicious use of WriteProcessMemory
PID:1380 -
C:\Windows\System32\reg.exeC:\Windows\System32\reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /v MachineGuid3⤵PID:4532
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""undefined\VBoxManage.exe" list vms --long"2⤵PID:4672
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD52f57fde6b33e89a63cf0dfdd6e60a351
SHA1445bf1b07223a04f8a159581a3d37d630273010f
SHA2563b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55
SHA51242857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220
-
Filesize
2KB
MD52f87410b0d834a14ceff69e18946d066
SHA1f2ec80550202d493db61806693439a57b76634f3
SHA2565422bc17b852ad463110de0db9b59ffa4219e065d3e2843618d6ebbd14273c65
SHA512a313702f22450ceff0a1d7f890b0c16cf667dbcd668dbafa6dbecd0791236c0bc68e834d12113cc75352365c2a2b6cfcf30b6ef7c97ea53ed135da50de389db4
-
Filesize
2KB
MD54eb400925f6065f4a30605fa85e114c8
SHA120b9e82684e82e1e2e28fa4544829ea78fd03c1c
SHA2561a548941fde07792cbe4ac9eab97f29a5f7cbc2e126f64368301dbaf9013af28
SHA512a53758b74e6fc2ec5200eb9a88eef72e6d011d9ceff6e2cd27348270c06ee101a72ecb98a5467481d539952c21b53dfae8e93d9c3dbf05e2b0ce3eb1e0dd2387
-
Filesize
2KB
MD5910539cdc76a750d2c492e31fe8d484e
SHA129a156b0af48af213330ab7007306a7c4e48e058
SHA2563a0224e78878215c0a42a3ee994d2c28460a2b26690c2422c51df07b655fbfc9
SHA512d78c7cc654bfc9b510734e861516bd198545b34033d7986e9dfc87da6a796d92372a9522e1dea7d15a40bf2caaa1bf8eac90e07d7995a798a903104b77a984fb
-
Filesize
2KB
MD5c3a06929af71e23edaf1fa5ec6752698
SHA1f4a37072442c4eb61b9f194a61b688fb7bc4a3e5
SHA2564775dc65660d47c971c95f4ba1d4d606de7ff1d805a6b0fb985d2f7b75eec59d
SHA512527d762aaf4053d20d1c1dadd8ca4822e530490d9422366e9587e9946bfd0ca90d324072dc94c9e3c0f68c65b78da4e7897de1257aba659a2295678595374adc
-
Filesize
2KB
MD5c3a06929af71e23edaf1fa5ec6752698
SHA1f4a37072442c4eb61b9f194a61b688fb7bc4a3e5
SHA2564775dc65660d47c971c95f4ba1d4d606de7ff1d805a6b0fb985d2f7b75eec59d
SHA512527d762aaf4053d20d1c1dadd8ca4822e530490d9422366e9587e9946bfd0ca90d324072dc94c9e3c0f68c65b78da4e7897de1257aba659a2295678595374adc
-
Filesize
2KB
MD5c3a06929af71e23edaf1fa5ec6752698
SHA1f4a37072442c4eb61b9f194a61b688fb7bc4a3e5
SHA2564775dc65660d47c971c95f4ba1d4d606de7ff1d805a6b0fb985d2f7b75eec59d
SHA512527d762aaf4053d20d1c1dadd8ca4822e530490d9422366e9587e9946bfd0ca90d324072dc94c9e3c0f68c65b78da4e7897de1257aba659a2295678595374adc
-
Filesize
1KB
MD50c83132f3b4428be9e9905fa12c762da
SHA1d3346091e54e33fde5638d27d8f4a528027a16a0
SHA2562b9b236c722f3c69a55dac09674e9b42a5e4c2fe31958c605334392f19c1f8e6
SHA51264a7a310b673360786f76e33c3725b8d9a54a3a4388372731c7c335dc196842300f727de1191e362a65b66c0556a0fb0c35e60160bb7d2cd611412badcf9e3f4
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
3KB
MD572c9885edc1e9b5b6c2645b684863854
SHA1461f6d8acf525b55e7faa135ee1fa0c8e49da7ec
SHA25628a18e63eae6a52b4b9b2eea12a7f8d31dda594eebc30158de0d96a24b47ef01
SHA512a7add876e7c47c8012b076b5735401a4e34b483c866bff8dfe0ae4db79a9b78d3996d64842c163e1e94fe8427278f7cd50fb849e873c8f55a90ae1f8bb97b585
-
Filesize
652B
MD5e7123a10935b695d7c4e500383a7b898
SHA174a144cb71a0f2a2c8805feafa6c0971d047f6a6
SHA2567a5a32524141e5740dc8b7c89e549d1f20e8a4f4c3503475835fcb47edcedf67
SHA512a3a9bcada87e00909fdafb9f23de9b84c8a2bc7d61842d606b25913086976f95c255a34835f5fd5623a04da4688dd96d981f920b823caadbe25d7eac69084feb
-
Filesize
312B
MD5ecbf151f81ff98f7dff196304a40239e
SHA1ccf6b97b6f8276656b042d64f0595963fe9ec79c
SHA256295ca195631c485c876e7c468ddcbb3fe7cd219d3e5005a2441be2de54e62ac8
SHA5124526a59055a18af6c0c13fb9f55a9a9bc15aa1407b697849e19b6cc32c88ee7206b3efff806bd154d36bce144ae1d9c407c6ea0f5077c54fbe92cd172c203720
-
Filesize
369B
MD5d5660155dd8670d54fad9ab4baad1e44
SHA1e71b616f701cd61cebacb6cb102304c4e84d25e6
SHA256ac1a5d0559a951c3881836e067272340594e24899c34f9bd2011a2857d10ff67
SHA51227ee156adf9e1fce325057c578fa60653755c558ae596320e7cd511339600e21397003278070224c606c7a9350a6dc4e64cd1c4022412c93ba91e8f7e7be6ab2