Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20230703-en -
resource tags
arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system -
submitted
08/07/2023, 20:20
Static task
static1
Behavioral task
behavioral1
Sample
645cd161d581e5exeexeexeex.exe
Resource
win7-20230703-en
Behavioral task
behavioral2
Sample
645cd161d581e5exeexeexeex.exe
Resource
win10v2004-20230703-en
General
-
Target
645cd161d581e5exeexeexeex.exe
-
Size
179KB
-
MD5
645cd161d581e5eb5536075b715dc323
-
SHA1
75f7878c4ecf22c81f55d239113a3c45518c919a
-
SHA256
7fff78bb9df78c68bdc95ba65dc5ac5227ee7962df375309cf34379177c976d8
-
SHA512
161cd0ee9a08468812bfc5159a2f44b7411f4f712dce3ea4b1138b6325524a99ce1a4d613f8e2cce1e7d77b00f3279781712ee637dc0506c4c4df45506d4dfb2
-
SSDEEP
3072:4BSF3kHSHUN4yTGnBDhOj3AyxGAlLGGwmyK0z2FWqnSGhloPv2:8SF3kHScNTeBDh43AQQJmyKHWDSl
Malware Config
Extracted
C:\Users\Admin\Pictures\README.hta
Signatures
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Contacts a large (1024) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp2DC5.bmp" 645cd161d581e5exeexeexeex.exe -
Drops file in Program Files directory 6 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\BUSINESS.ONE 645cd161d581e5exeexeexeex.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\DESIGNER.ONE 645cd161d581e5exeexeexeex.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\PLANNERS.ONE 645cd161d581e5exeexeexeex.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\ACADEMIC.ONE 645cd161d581e5exeexeexeex.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\BLANK.ONE 645cd161d581e5exeexeexeex.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\README.hta 645cd161d581e5exeexeexeex.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2372 645cd161d581e5exeexeexeex.exe 2372 645cd161d581e5exeexeexeex.exe 2372 645cd161d581e5exeexeexeex.exe 2372 645cd161d581e5exeexeexeex.exe 2372 645cd161d581e5exeexeexeex.exe 2372 645cd161d581e5exeexeexeex.exe 2372 645cd161d581e5exeexeexeex.exe 2372 645cd161d581e5exeexeexeex.exe 2372 645cd161d581e5exeexeexeex.exe 2372 645cd161d581e5exeexeexeex.exe 2372 645cd161d581e5exeexeexeex.exe 2372 645cd161d581e5exeexeexeex.exe 2372 645cd161d581e5exeexeexeex.exe 2372 645cd161d581e5exeexeexeex.exe 2372 645cd161d581e5exeexeexeex.exe 2372 645cd161d581e5exeexeexeex.exe 2372 645cd161d581e5exeexeexeex.exe 2372 645cd161d581e5exeexeexeex.exe 2372 645cd161d581e5exeexeexeex.exe 2372 645cd161d581e5exeexeexeex.exe 2372 645cd161d581e5exeexeexeex.exe 2372 645cd161d581e5exeexeexeex.exe 2372 645cd161d581e5exeexeexeex.exe 2372 645cd161d581e5exeexeexeex.exe 2372 645cd161d581e5exeexeexeex.exe 2372 645cd161d581e5exeexeexeex.exe 2372 645cd161d581e5exeexeexeex.exe 2372 645cd161d581e5exeexeexeex.exe 2372 645cd161d581e5exeexeexeex.exe 2372 645cd161d581e5exeexeexeex.exe 2372 645cd161d581e5exeexeexeex.exe 2372 645cd161d581e5exeexeexeex.exe 2372 645cd161d581e5exeexeexeex.exe 2372 645cd161d581e5exeexeexeex.exe 2372 645cd161d581e5exeexeexeex.exe 2372 645cd161d581e5exeexeexeex.exe 2372 645cd161d581e5exeexeexeex.exe 2372 645cd161d581e5exeexeexeex.exe 2372 645cd161d581e5exeexeexeex.exe 2372 645cd161d581e5exeexeexeex.exe 2372 645cd161d581e5exeexeexeex.exe 2372 645cd161d581e5exeexeexeex.exe 2372 645cd161d581e5exeexeexeex.exe 2372 645cd161d581e5exeexeexeex.exe 2372 645cd161d581e5exeexeexeex.exe 2372 645cd161d581e5exeexeexeex.exe 2372 645cd161d581e5exeexeexeex.exe 2372 645cd161d581e5exeexeexeex.exe 2372 645cd161d581e5exeexeexeex.exe 2372 645cd161d581e5exeexeexeex.exe 2372 645cd161d581e5exeexeexeex.exe 2372 645cd161d581e5exeexeexeex.exe 2372 645cd161d581e5exeexeexeex.exe 2372 645cd161d581e5exeexeexeex.exe 2372 645cd161d581e5exeexeexeex.exe 2372 645cd161d581e5exeexeexeex.exe 2372 645cd161d581e5exeexeexeex.exe 2372 645cd161d581e5exeexeexeex.exe 2372 645cd161d581e5exeexeexeex.exe 2372 645cd161d581e5exeexeexeex.exe 2372 645cd161d581e5exeexeexeex.exe 2372 645cd161d581e5exeexeexeex.exe 2372 645cd161d581e5exeexeexeex.exe 2372 645cd161d581e5exeexeexeex.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeDebugPrivilege 2372 645cd161d581e5exeexeexeex.exe Token: SeIncreaseQuotaPrivilege 2356 WMIC.exe Token: SeSecurityPrivilege 2356 WMIC.exe Token: SeTakeOwnershipPrivilege 2356 WMIC.exe Token: SeLoadDriverPrivilege 2356 WMIC.exe Token: SeSystemProfilePrivilege 2356 WMIC.exe Token: SeSystemtimePrivilege 2356 WMIC.exe Token: SeProfSingleProcessPrivilege 2356 WMIC.exe Token: SeIncBasePriorityPrivilege 2356 WMIC.exe Token: SeCreatePagefilePrivilege 2356 WMIC.exe Token: SeBackupPrivilege 2356 WMIC.exe Token: SeRestorePrivilege 2356 WMIC.exe Token: SeShutdownPrivilege 2356 WMIC.exe Token: SeDebugPrivilege 2356 WMIC.exe Token: SeSystemEnvironmentPrivilege 2356 WMIC.exe Token: SeRemoteShutdownPrivilege 2356 WMIC.exe Token: SeUndockPrivilege 2356 WMIC.exe Token: SeManageVolumePrivilege 2356 WMIC.exe Token: 33 2356 WMIC.exe Token: 34 2356 WMIC.exe Token: 35 2356 WMIC.exe Token: SeIncreaseQuotaPrivilege 2356 WMIC.exe Token: SeSecurityPrivilege 2356 WMIC.exe Token: SeTakeOwnershipPrivilege 2356 WMIC.exe Token: SeLoadDriverPrivilege 2356 WMIC.exe Token: SeSystemProfilePrivilege 2356 WMIC.exe Token: SeSystemtimePrivilege 2356 WMIC.exe Token: SeProfSingleProcessPrivilege 2356 WMIC.exe Token: SeIncBasePriorityPrivilege 2356 WMIC.exe Token: SeCreatePagefilePrivilege 2356 WMIC.exe Token: SeBackupPrivilege 2356 WMIC.exe Token: SeRestorePrivilege 2356 WMIC.exe Token: SeShutdownPrivilege 2356 WMIC.exe Token: SeDebugPrivilege 2356 WMIC.exe Token: SeSystemEnvironmentPrivilege 2356 WMIC.exe Token: SeRemoteShutdownPrivilege 2356 WMIC.exe Token: SeUndockPrivilege 2356 WMIC.exe Token: SeManageVolumePrivilege 2356 WMIC.exe Token: 33 2356 WMIC.exe Token: 34 2356 WMIC.exe Token: 35 2356 WMIC.exe Token: SeBackupPrivilege 2028 vssvc.exe Token: SeRestorePrivilege 2028 vssvc.exe Token: SeAuditPrivilege 2028 vssvc.exe Token: 33 1864 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1864 AUDIODG.EXE Token: 33 1864 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1864 AUDIODG.EXE -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2372 wrote to memory of 2188 2372 645cd161d581e5exeexeexeex.exe 29 PID 2372 wrote to memory of 2188 2372 645cd161d581e5exeexeexeex.exe 29 PID 2372 wrote to memory of 2188 2372 645cd161d581e5exeexeexeex.exe 29 PID 2372 wrote to memory of 2188 2372 645cd161d581e5exeexeexeex.exe 29 PID 2188 wrote to memory of 2356 2188 cmd.exe 31 PID 2188 wrote to memory of 2356 2188 cmd.exe 31 PID 2188 wrote to memory of 2356 2188 cmd.exe 31 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\645cd161d581e5exeexeexeex.exe"C:\Users\Admin\AppData\Local\Temp\645cd161d581e5exeexeexeex.exe"1⤵
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Windows\system32\wbem\WMIC.exeC:\Windows\system32\wbem\wmic.exe shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2356
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2028
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}1⤵PID:2316
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4941⤵
- Suspicious use of AdjustPrivilegeToken
PID:1864
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
61KB
MD518335baf43102d26d64a6db55b959e17
SHA1613d4b1b110afec35fe8a95bf53ba7924bb5bce9
SHA25683ec8ed49f6916d2c918c08d78dda30467abd39469ada00a6b8f499a26029aaa
SHA5123926eccd9464436f4b39bb8632a705646ab30f2b6da8525a673df9148c655b15919c562cbd4e8369dd3d355a8aa32b4d8ffa74e2c4d69e9fcfebdd43dc7f9262