Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
14/10/2023, 10:50
Static task
static1
Behavioral task
behavioral1
Sample
PAYMENT OF OUTSTANDING BILLS.pdf.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
PAYMENT OF OUTSTANDING BILLS.pdf.exe
Resource
win10v2004-20230915-en
General
-
Target
PAYMENT OF OUTSTANDING BILLS.pdf.exe
-
Size
644KB
-
MD5
432c2dd84816f93dcb064c273e51fe60
-
SHA1
6c3c24235db1b66bf265ea3b103a592a5291d44e
-
SHA256
721ca582a7a8e00d9421c1acaa52906cfe9219cb13be9646b713462e48198c54
-
SHA512
ee04fbc1756eecc5907fbcda3003ccabaaf1244e20ee6296115e42979df6fcae67a35ccfc2fb995d3ce5f4f37da81892e41bf0ddf277056d038c01b728a69695
-
SSDEEP
12288:KURF2iNqUCemnN5t3xUIa0bwol55hsqkMTVIAqXvfIKWOr8JCsBJ1D7j2mEVLIE:KCF14WmrjUtoVhsqkMVIpvAKb4teREE
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2736 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 11 IoCs
pid Process 2212 PAYMENT OF OUTSTANDING BILLS.pdf.exe 2212 PAYMENT OF OUTSTANDING BILLS.pdf.exe 2212 PAYMENT OF OUTSTANDING BILLS.pdf.exe 2212 PAYMENT OF OUTSTANDING BILLS.pdf.exe 2212 PAYMENT OF OUTSTANDING BILLS.pdf.exe 2212 PAYMENT OF OUTSTANDING BILLS.pdf.exe 2212 PAYMENT OF OUTSTANDING BILLS.pdf.exe 2212 PAYMENT OF OUTSTANDING BILLS.pdf.exe 2212 PAYMENT OF OUTSTANDING BILLS.pdf.exe 2212 PAYMENT OF OUTSTANDING BILLS.pdf.exe 2672 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2212 PAYMENT OF OUTSTANDING BILLS.pdf.exe Token: SeDebugPrivilege 2672 powershell.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2212 wrote to memory of 2672 2212 PAYMENT OF OUTSTANDING BILLS.pdf.exe 30 PID 2212 wrote to memory of 2672 2212 PAYMENT OF OUTSTANDING BILLS.pdf.exe 30 PID 2212 wrote to memory of 2672 2212 PAYMENT OF OUTSTANDING BILLS.pdf.exe 30 PID 2212 wrote to memory of 2672 2212 PAYMENT OF OUTSTANDING BILLS.pdf.exe 30 PID 2212 wrote to memory of 2736 2212 PAYMENT OF OUTSTANDING BILLS.pdf.exe 32 PID 2212 wrote to memory of 2736 2212 PAYMENT OF OUTSTANDING BILLS.pdf.exe 32 PID 2212 wrote to memory of 2736 2212 PAYMENT OF OUTSTANDING BILLS.pdf.exe 32 PID 2212 wrote to memory of 2736 2212 PAYMENT OF OUTSTANDING BILLS.pdf.exe 32 PID 2212 wrote to memory of 2548 2212 PAYMENT OF OUTSTANDING BILLS.pdf.exe 34 PID 2212 wrote to memory of 2548 2212 PAYMENT OF OUTSTANDING BILLS.pdf.exe 34 PID 2212 wrote to memory of 2548 2212 PAYMENT OF OUTSTANDING BILLS.pdf.exe 34 PID 2212 wrote to memory of 2548 2212 PAYMENT OF OUTSTANDING BILLS.pdf.exe 34 PID 2212 wrote to memory of 2540 2212 PAYMENT OF OUTSTANDING BILLS.pdf.exe 35 PID 2212 wrote to memory of 2540 2212 PAYMENT OF OUTSTANDING BILLS.pdf.exe 35 PID 2212 wrote to memory of 2540 2212 PAYMENT OF OUTSTANDING BILLS.pdf.exe 35 PID 2212 wrote to memory of 2540 2212 PAYMENT OF OUTSTANDING BILLS.pdf.exe 35 PID 2212 wrote to memory of 2900 2212 PAYMENT OF OUTSTANDING BILLS.pdf.exe 36 PID 2212 wrote to memory of 2900 2212 PAYMENT OF OUTSTANDING BILLS.pdf.exe 36 PID 2212 wrote to memory of 2900 2212 PAYMENT OF OUTSTANDING BILLS.pdf.exe 36 PID 2212 wrote to memory of 2900 2212 PAYMENT OF OUTSTANDING BILLS.pdf.exe 36 PID 2212 wrote to memory of 2708 2212 PAYMENT OF OUTSTANDING BILLS.pdf.exe 37 PID 2212 wrote to memory of 2708 2212 PAYMENT OF OUTSTANDING BILLS.pdf.exe 37 PID 2212 wrote to memory of 2708 2212 PAYMENT OF OUTSTANDING BILLS.pdf.exe 37 PID 2212 wrote to memory of 2708 2212 PAYMENT OF OUTSTANDING BILLS.pdf.exe 37 PID 2212 wrote to memory of 764 2212 PAYMENT OF OUTSTANDING BILLS.pdf.exe 38 PID 2212 wrote to memory of 764 2212 PAYMENT OF OUTSTANDING BILLS.pdf.exe 38 PID 2212 wrote to memory of 764 2212 PAYMENT OF OUTSTANDING BILLS.pdf.exe 38 PID 2212 wrote to memory of 764 2212 PAYMENT OF OUTSTANDING BILLS.pdf.exe 38
Processes
-
C:\Users\Admin\AppData\Local\Temp\PAYMENT OF OUTSTANDING BILLS.pdf.exe"C:\Users\Admin\AppData\Local\Temp\PAYMENT OF OUTSTANDING BILLS.pdf.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Qigahd.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2672
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\Qigahd" /XML "C:\Users\Admin\AppData\Local\Temp\tmpDAE4.tmp"2⤵
- Creates scheduled task(s)
PID:2736
-
-
C:\Users\Admin\AppData\Local\Temp\PAYMENT OF OUTSTANDING BILLS.pdf.exe"C:\Users\Admin\AppData\Local\Temp\PAYMENT OF OUTSTANDING BILLS.pdf.exe"2⤵PID:2548
-
-
C:\Users\Admin\AppData\Local\Temp\PAYMENT OF OUTSTANDING BILLS.pdf.exe"C:\Users\Admin\AppData\Local\Temp\PAYMENT OF OUTSTANDING BILLS.pdf.exe"2⤵PID:2540
-
-
C:\Users\Admin\AppData\Local\Temp\PAYMENT OF OUTSTANDING BILLS.pdf.exe"C:\Users\Admin\AppData\Local\Temp\PAYMENT OF OUTSTANDING BILLS.pdf.exe"2⤵PID:2900
-
-
C:\Users\Admin\AppData\Local\Temp\PAYMENT OF OUTSTANDING BILLS.pdf.exe"C:\Users\Admin\AppData\Local\Temp\PAYMENT OF OUTSTANDING BILLS.pdf.exe"2⤵PID:2708
-
-
C:\Users\Admin\AppData\Local\Temp\PAYMENT OF OUTSTANDING BILLS.pdf.exe"C:\Users\Admin\AppData\Local\Temp\PAYMENT OF OUTSTANDING BILLS.pdf.exe"2⤵PID:764
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD568fe928082dbb9fe960273f4a0f0d694
SHA129d9d508af975c36608df3a07a3db9bb965e5f77
SHA256afd27dc7888521b1c61ca14c46b30fbb447b2de066e6e7e73f4416248d57283d
SHA512aff47ac891881af07b3ad6d7c6ba4642e633ee9682f58571119a4860bb720e1eb237ddf43c731097c39d566f260744e51bb7400beae905078e2d60951a163627