Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
30/08/2023, 06:40
Static task
static1
Behavioral task
behavioral1
Sample
QUOTATION_AUG7FIBA00541·PDF.scr.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
QUOTATION_AUG7FIBA00541·PDF.scr.exe
Resource
win10v2004-20230703-en
General
-
Target
QUOTATION_AUG7FIBA00541·PDF.scr.exe
-
Size
1.9MB
-
MD5
0fcb28f04c3fead1520ea0b7476b0957
-
SHA1
f07204100d8990931fd81ef3ed24591bb0db788c
-
SHA256
511ac21d17ad7b77173c3007465b034ce0a83517749f7263d27243453f6728c3
-
SHA512
8f0708effffbcbd45a459c437d02a9e8887bde14fc259388a12100562bc698d78b379c0c82bc262eeacbb2b58812e3716c8894e0c7e11b2172362033e72e6e0e
-
SSDEEP
24576:k8QUVF5iQ8Q0WuNO/JpxB0FGlAu4OmeMVqHfKP6w1mp8pncTMWanOm:k3+5iHQ6N0H4OLMQHJO+MWY
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rnrkpe = "C:\\Users\\Admin\\AppData\\Roaming\\Rnrkpe.exe" QUOTATION_AUG7FIBA00541·PDF.scr.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2552 set thread context of 2548 2552 QUOTATION_AUG7FIBA00541·PDF.scr.exe 36 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 2576 2548 WerFault.exe 36 -
Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 1340 ipconfig.exe 2584 ipconfig.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2552 QUOTATION_AUG7FIBA00541·PDF.scr.exe -
Suspicious use of WriteProcessMemory 31 IoCs
description pid Process procid_target PID 2552 wrote to memory of 1780 2552 QUOTATION_AUG7FIBA00541·PDF.scr.exe 28 PID 2552 wrote to memory of 1780 2552 QUOTATION_AUG7FIBA00541·PDF.scr.exe 28 PID 2552 wrote to memory of 1780 2552 QUOTATION_AUG7FIBA00541·PDF.scr.exe 28 PID 2552 wrote to memory of 1780 2552 QUOTATION_AUG7FIBA00541·PDF.scr.exe 28 PID 1780 wrote to memory of 1340 1780 cmd.exe 30 PID 1780 wrote to memory of 1340 1780 cmd.exe 30 PID 1780 wrote to memory of 1340 1780 cmd.exe 30 PID 1780 wrote to memory of 1340 1780 cmd.exe 30 PID 2552 wrote to memory of 2372 2552 QUOTATION_AUG7FIBA00541·PDF.scr.exe 33 PID 2552 wrote to memory of 2372 2552 QUOTATION_AUG7FIBA00541·PDF.scr.exe 33 PID 2552 wrote to memory of 2372 2552 QUOTATION_AUG7FIBA00541·PDF.scr.exe 33 PID 2552 wrote to memory of 2372 2552 QUOTATION_AUG7FIBA00541·PDF.scr.exe 33 PID 2372 wrote to memory of 2584 2372 cmd.exe 35 PID 2372 wrote to memory of 2584 2372 cmd.exe 35 PID 2372 wrote to memory of 2584 2372 cmd.exe 35 PID 2372 wrote to memory of 2584 2372 cmd.exe 35 PID 2552 wrote to memory of 2548 2552 QUOTATION_AUG7FIBA00541·PDF.scr.exe 36 PID 2552 wrote to memory of 2548 2552 QUOTATION_AUG7FIBA00541·PDF.scr.exe 36 PID 2552 wrote to memory of 2548 2552 QUOTATION_AUG7FIBA00541·PDF.scr.exe 36 PID 2552 wrote to memory of 2548 2552 QUOTATION_AUG7FIBA00541·PDF.scr.exe 36 PID 2552 wrote to memory of 2548 2552 QUOTATION_AUG7FIBA00541·PDF.scr.exe 36 PID 2552 wrote to memory of 2548 2552 QUOTATION_AUG7FIBA00541·PDF.scr.exe 36 PID 2552 wrote to memory of 2548 2552 QUOTATION_AUG7FIBA00541·PDF.scr.exe 36 PID 2552 wrote to memory of 2548 2552 QUOTATION_AUG7FIBA00541·PDF.scr.exe 36 PID 2552 wrote to memory of 2548 2552 QUOTATION_AUG7FIBA00541·PDF.scr.exe 36 PID 2552 wrote to memory of 2548 2552 QUOTATION_AUG7FIBA00541·PDF.scr.exe 36 PID 2552 wrote to memory of 2548 2552 QUOTATION_AUG7FIBA00541·PDF.scr.exe 36 PID 2548 wrote to memory of 2576 2548 aspnet_compiler.exe 37 PID 2548 wrote to memory of 2576 2548 aspnet_compiler.exe 37 PID 2548 wrote to memory of 2576 2548 aspnet_compiler.exe 37 PID 2548 wrote to memory of 2576 2548 aspnet_compiler.exe 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\QUOTATION_AUG7FIBA00541·PDF.scr.exe"C:\Users\Admin\AppData\Local\Temp\QUOTATION_AUG7FIBA00541·PDF.scr.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ipconfig /release2⤵
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\Windows\SysWOW64\ipconfig.exeipconfig /release3⤵
- Gathers network information
PID:1340
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ipconfig /renew2⤵
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Windows\SysWOW64\ipconfig.exeipconfig /renew3⤵
- Gathers network information
PID:2584
-
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe2⤵
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2548 -s 2003⤵
- Program crash
PID:2576
-
-