Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
05/08/2023, 23:08
Static task
static1
Behavioral task
behavioral1
Sample
21b3ec2a8f16bf7fb571925eda77f05c8c7a32fecd9c43cefba6223c47a80936.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
21b3ec2a8f16bf7fb571925eda77f05c8c7a32fecd9c43cefba6223c47a80936.exe
Resource
win10-20230703-en
General
-
Target
21b3ec2a8f16bf7fb571925eda77f05c8c7a32fecd9c43cefba6223c47a80936.exe
-
Size
9.4MB
-
MD5
718d69c7e8baa9b2fea5078ac9adf6b7
-
SHA1
b409fa7ffde8cc8dbaff27ae6a51d3f599e0ed75
-
SHA256
21b3ec2a8f16bf7fb571925eda77f05c8c7a32fecd9c43cefba6223c47a80936
-
SHA512
ece9d1dac93453594fee0df92f8ad9ffa14ba17d4589773eac2c6f5ae1759d4b22e1067813245d2d5ab613d2b7c45173e5aebd1e72c7a720082474b76d403515
-
SSDEEP
196608:ZeduW/gMzIXjpjzoc1fln3yenGNSZO8WD5UW:jWou0jtzoc1tn3yenG4g8s5UW
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2872 fae64d7b-f774-411b-8dfc-51a5c6ba8440.exe -
Loads dropped DLL 1 IoCs
pid Process 2096 21b3ec2a8f16bf7fb571925eda77f05c8c7a32fecd9c43cefba6223c47a80936.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" fae64d7b-f774-411b-8dfc-51a5c6ba8440.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2336 powershell.exe 1044 powershell.exe 1044 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2336 powershell.exe Token: SeDebugPrivilege 1044 powershell.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 2096 wrote to memory of 2336 2096 21b3ec2a8f16bf7fb571925eda77f05c8c7a32fecd9c43cefba6223c47a80936.exe 28 PID 2096 wrote to memory of 2336 2096 21b3ec2a8f16bf7fb571925eda77f05c8c7a32fecd9c43cefba6223c47a80936.exe 28 PID 2096 wrote to memory of 2336 2096 21b3ec2a8f16bf7fb571925eda77f05c8c7a32fecd9c43cefba6223c47a80936.exe 28 PID 2096 wrote to memory of 2336 2096 21b3ec2a8f16bf7fb571925eda77f05c8c7a32fecd9c43cefba6223c47a80936.exe 28 PID 2096 wrote to memory of 2872 2096 21b3ec2a8f16bf7fb571925eda77f05c8c7a32fecd9c43cefba6223c47a80936.exe 32 PID 2096 wrote to memory of 2872 2096 21b3ec2a8f16bf7fb571925eda77f05c8c7a32fecd9c43cefba6223c47a80936.exe 32 PID 2096 wrote to memory of 2872 2096 21b3ec2a8f16bf7fb571925eda77f05c8c7a32fecd9c43cefba6223c47a80936.exe 32 PID 2096 wrote to memory of 2872 2096 21b3ec2a8f16bf7fb571925eda77f05c8c7a32fecd9c43cefba6223c47a80936.exe 32 PID 2872 wrote to memory of 2284 2872 fae64d7b-f774-411b-8dfc-51a5c6ba8440.exe 33 PID 2872 wrote to memory of 2284 2872 fae64d7b-f774-411b-8dfc-51a5c6ba8440.exe 33 PID 2872 wrote to memory of 2284 2872 fae64d7b-f774-411b-8dfc-51a5c6ba8440.exe 33 PID 2872 wrote to memory of 2284 2872 fae64d7b-f774-411b-8dfc-51a5c6ba8440.exe 33 PID 2872 wrote to memory of 2276 2872 fae64d7b-f774-411b-8dfc-51a5c6ba8440.exe 35 PID 2872 wrote to memory of 2276 2872 fae64d7b-f774-411b-8dfc-51a5c6ba8440.exe 35 PID 2872 wrote to memory of 2276 2872 fae64d7b-f774-411b-8dfc-51a5c6ba8440.exe 35 PID 2872 wrote to memory of 2276 2872 fae64d7b-f774-411b-8dfc-51a5c6ba8440.exe 35 PID 2276 wrote to memory of 756 2276 cmd.exe 37 PID 2276 wrote to memory of 756 2276 cmd.exe 37 PID 2276 wrote to memory of 756 2276 cmd.exe 37 PID 2276 wrote to memory of 756 2276 cmd.exe 37 PID 756 wrote to memory of 1044 756 cmd.exe 38 PID 756 wrote to memory of 1044 756 cmd.exe 38 PID 756 wrote to memory of 1044 756 cmd.exe 38 PID 756 wrote to memory of 1044 756 cmd.exe 38
Processes
-
C:\Users\Admin\AppData\Local\Temp\21b3ec2a8f16bf7fb571925eda77f05c8c7a32fecd9c43cefba6223c47a80936.exe"C:\Users\Admin\AppData\Local\Temp\21b3ec2a8f16bf7fb571925eda77f05c8c7a32fecd9c43cefba6223c47a80936.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath $env:Temp -ExclusionProcess *.exe -ExclusionExtension exe; Set-MpPreference -SubmitSamplesConsent NeverSend -PUAProtection Disabled2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2336
-
-
C:\Users\Admin\AppData\Local\Temp\fae64d7b-f774-411b-8dfc-51a5c6ba8440.exe"C:\Users\Admin\AppData\Local\Temp\fae64d7b-f774-411b-8dfc-51a5c6ba8440.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Windows\SysWOW64\nslookup.exenslookup dfslkdjfklhjsrhfgauiehruifghai3⤵PID:2284
-
-
C:\Windows\SysWOW64\cmd.execmd /c cmd < 53⤵
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Windows\SysWOW64\cmd.execmd4⤵
- Suspicious use of WriteProcessMemory
PID:756 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell get-process avastui5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1044
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12KB
MD505bb413f5ba120b0c746740c17c97fa2
SHA161716e2c9f375bfb9da6c36222890717eef4293e
SHA25611cafc97516f7451af19bb5aa550003c28416580928b7f9abe430d743a1ed610
SHA512133ca8be7349bac492476cc7cd9acbb6acde49cab191f07c6d7243e60ff0aac1ee81873d373075998765080068a149530ecc885610db25c6ba122f9e6e504518
-
Filesize
1.8MB
MD5ac9cdaa7e93365384a7af4c7deb940ef
SHA14458ab569efb896eebad6a0c11fd2b4bd2ea3c2d
SHA25630cb69aad54794a964298c87be266406a84f7ff77492db61c9f477f0dae09e28
SHA512eb14329d29e0a6527af1b22ee01470ae54b28aabce64cc96e44ce3a7fde075c63bf117cbd356519d374ea000d0a150eb8ab888067c5d028e67ca31e83f3b8223
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ED7ZH1R2G4KRTXGBAIDU.temp
Filesize7KB
MD55d143f649d512caafd62bb2529fd39f4
SHA1c5eb0bdfb7c6019611727401d43da576763e24d6
SHA256a368655b0207e85ab7f2efc875fca23b21f4e9eb805d098e9d74f99dd06f6ff8
SHA5123042a5b24816ac7e4491ec108318402a268f91c1cb896304605947ce3839d7fbd573fd53bcda021d05d281975676c7a7d16db1d02b73fe56e146da29821eea86
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize7KB
MD55d143f649d512caafd62bb2529fd39f4
SHA1c5eb0bdfb7c6019611727401d43da576763e24d6
SHA256a368655b0207e85ab7f2efc875fca23b21f4e9eb805d098e9d74f99dd06f6ff8
SHA5123042a5b24816ac7e4491ec108318402a268f91c1cb896304605947ce3839d7fbd573fd53bcda021d05d281975676c7a7d16db1d02b73fe56e146da29821eea86
-
Filesize
1.8MB
MD5ac9cdaa7e93365384a7af4c7deb940ef
SHA14458ab569efb896eebad6a0c11fd2b4bd2ea3c2d
SHA25630cb69aad54794a964298c87be266406a84f7ff77492db61c9f477f0dae09e28
SHA512eb14329d29e0a6527af1b22ee01470ae54b28aabce64cc96e44ce3a7fde075c63bf117cbd356519d374ea000d0a150eb8ab888067c5d028e67ca31e83f3b8223