Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
139s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
02/11/2023, 05:58
Static task
static1
Behavioral task
behavioral1
Sample
sample.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
sample.exe
Resource
win10v2004-20231023-en
General
-
Target
sample.exe
-
Size
1.2MB
-
MD5
0c8e88877383ccd23a755f429006b437
-
SHA1
69b3d913a3967153d1e91ba1a31ebed839b297ed
-
SHA256
a864282fea5a536510ae86c77ce46f7827687783628e4f2ceb5bf2c41b8cd3c6
-
SHA512
ba5296a84b7107b293d1afd4752157edaa1a3f1059685ecad2ddea9b9221ee9c8092ce5cae6f2f6a4866e25ca0bf66dd3fbc0786b2a26cb708d2cd536dd85041
-
SSDEEP
24576:utP7hdO1s6Skscec1SgnyN9HPFCCNhQI6GOfaFVIVrYwcMavDiZn3m75/J7:gLO1qkscec0gnyN9HPFCCNSI6GOfaFVp
Malware Config
Signatures
-
Renames multiple (1489) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Public\\bg.jpg" reg.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3684 powershell.exe 3684 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3684 powershell.exe -
Suspicious use of WriteProcessMemory 58 IoCs
description pid Process procid_target PID 3824 wrote to memory of 4988 3824 sample.exe 108 PID 3824 wrote to memory of 4988 3824 sample.exe 108 PID 4988 wrote to memory of 568 4988 cmd.exe 109 PID 4988 wrote to memory of 568 4988 cmd.exe 109 PID 568 wrote to memory of 3040 568 cmd.exe 110 PID 568 wrote to memory of 3040 568 cmd.exe 110 PID 3824 wrote to memory of 1504 3824 sample.exe 111 PID 3824 wrote to memory of 1504 3824 sample.exe 111 PID 1504 wrote to memory of 4092 1504 cmd.exe 112 PID 1504 wrote to memory of 4092 1504 cmd.exe 112 PID 4092 wrote to memory of 3340 4092 cmd.exe 113 PID 4092 wrote to memory of 3340 4092 cmd.exe 113 PID 3824 wrote to memory of 1652 3824 sample.exe 114 PID 3824 wrote to memory of 1652 3824 sample.exe 114 PID 1652 wrote to memory of 1492 1652 cmd.exe 115 PID 1652 wrote to memory of 1492 1652 cmd.exe 115 PID 1492 wrote to memory of 4852 1492 cmd.exe 116 PID 1492 wrote to memory of 4852 1492 cmd.exe 116 PID 3824 wrote to memory of 1336 3824 sample.exe 117 PID 3824 wrote to memory of 1336 3824 sample.exe 117 PID 1336 wrote to memory of 4560 1336 cmd.exe 118 PID 1336 wrote to memory of 4560 1336 cmd.exe 118 PID 4560 wrote to memory of 1480 4560 cmd.exe 119 PID 4560 wrote to memory of 1480 4560 cmd.exe 119 PID 3824 wrote to memory of 3980 3824 sample.exe 120 PID 3824 wrote to memory of 3980 3824 sample.exe 120 PID 3980 wrote to memory of 1228 3980 cmd.exe 121 PID 3980 wrote to memory of 1228 3980 cmd.exe 121 PID 1228 wrote to memory of 4204 1228 cmd.exe 122 PID 1228 wrote to memory of 4204 1228 cmd.exe 122 PID 3824 wrote to memory of 4364 3824 sample.exe 123 PID 3824 wrote to memory of 4364 3824 sample.exe 123 PID 4364 wrote to memory of 3448 4364 cmd.exe 124 PID 4364 wrote to memory of 3448 4364 cmd.exe 124 PID 3448 wrote to memory of 4292 3448 cmd.exe 125 PID 3448 wrote to memory of 4292 3448 cmd.exe 125 PID 3824 wrote to memory of 3060 3824 sample.exe 126 PID 3824 wrote to memory of 3060 3824 sample.exe 126 PID 3060 wrote to memory of 5056 3060 cmd.exe 127 PID 3060 wrote to memory of 5056 3060 cmd.exe 127 PID 5056 wrote to memory of 3796 5056 cmd.exe 128 PID 5056 wrote to memory of 3796 5056 cmd.exe 128 PID 3824 wrote to memory of 808 3824 sample.exe 129 PID 3824 wrote to memory of 808 3824 sample.exe 129 PID 808 wrote to memory of 3172 808 cmd.exe 130 PID 808 wrote to memory of 3172 808 cmd.exe 130 PID 3172 wrote to memory of 2252 3172 cmd.exe 131 PID 3172 wrote to memory of 2252 3172 cmd.exe 131 PID 3824 wrote to memory of 1476 3824 sample.exe 132 PID 3824 wrote to memory of 1476 3824 sample.exe 132 PID 1476 wrote to memory of 1340 1476 cmd.exe 133 PID 1476 wrote to memory of 1340 1476 cmd.exe 133 PID 3824 wrote to memory of 2264 3824 sample.exe 134 PID 3824 wrote to memory of 2264 3824 sample.exe 134 PID 2264 wrote to memory of 856 2264 cmd.exe 135 PID 2264 wrote to memory of 856 2264 cmd.exe 135 PID 856 wrote to memory of 3684 856 cmd.exe 136 PID 856 wrote to memory of 3684 856 cmd.exe 136
Processes
-
C:\Users\Admin\AppData\Local\Temp\sample.exe"C:\Users\Admin\AppData\Local\Temp\sample.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3824 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cmd.exe /c reg delete "HKCU\Conttol Panel\Desktop" /v Wallpaper /f2⤵
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Windows\system32\cmd.execmd.exe /c reg delete "HKCU\Conttol Panel\Desktop" /v Wallpaper /f3⤵
- Suspicious use of WriteProcessMemory
PID:568 -
C:\Windows\system32\reg.exereg delete "HKCU\Conttol Panel\Desktop" /v Wallpaper /f4⤵PID:3040
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cmd.exe /c reg delete "HKCU\Conttol Panel\Desktop" /v WallpaperStyle /f2⤵
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Windows\system32\cmd.execmd.exe /c reg delete "HKCU\Conttol Panel\Desktop" /v WallpaperStyle /f3⤵
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Windows\system32\reg.exereg delete "HKCU\Conttol Panel\Desktop" /v WallpaperStyle /f4⤵PID:3340
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper /t REG_SZ /d 1 /f2⤵
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Windows\system32\cmd.execmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper /t REG_SZ /d 1 /f3⤵
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper /t REG_SZ /d 1 /f4⤵PID:4852
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper /t REG_SZ /d 1 /f2⤵
- Suspicious use of WriteProcessMemory
PID:1336 -
C:\Windows\system32\cmd.execmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper /t REG_SZ /d 1 /f3⤵
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Windows\system32\reg.exereg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper /t REG_SZ /d 1 /f4⤵PID:1480
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cmd.exe /c reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Public\bg.jpg" /f2⤵
- Suspicious use of WriteProcessMemory
PID:3980 -
C:\Windows\system32\cmd.execmd.exe /c reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Public\bg.jpg" /f3⤵
- Suspicious use of WriteProcessMemory
PID:1228 -
C:\Windows\system32\reg.exereg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Public\bg.jpg" /f4⤵
- Sets desktop wallpaper using registry
PID:4204
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v Wallpaper /t REG_SZ /d "C:\Users\Public\bg.jpg" /f2⤵
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\Windows\system32\cmd.execmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v Wallpaper /t REG_SZ /d "C:\Users\Public\bg.jpg" /f3⤵
- Suspicious use of WriteProcessMemory
PID:3448 -
C:\Windows\system32\reg.exereg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v Wallpaper /t REG_SZ /d "C:\Users\Public\bg.jpg" /f4⤵PID:4292
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v WallpaperStyle /t REG_SZ /d 2 /f2⤵
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Windows\system32\cmd.execmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v WallpaperStyle /t REG_SZ /d 2 /f3⤵
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Windows\system32\reg.exereg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v WallpaperStyle /t REG_SZ /d 2 /f4⤵PID:3796
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cmd.exe /c reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d 2 /f2⤵
- Suspicious use of WriteProcessMemory
PID:808 -
C:\Windows\system32\cmd.execmd.exe /c reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d 2 /f3⤵
- Suspicious use of WriteProcessMemory
PID:3172 -
C:\Windows\system32\reg.exereg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d 2 /f4⤵PID:2252
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c rundll32.exe user32.dll,UpdatePerUserSystemParameters2⤵
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Windows\system32\rundll32.exerundll32.exe user32.dll,UpdatePerUserSystemParameters3⤵PID:1340
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cmd.exe /c start powershell.exe -WindowStyle Hidden -Command Sleep -Milliseconds 500; Remove-Item -Force -Path "C:\Users\Admin\AppData\Local\Temp\C:\Users\Admin\AppData\Local\Temp\sample.exe" -ErrorAction SilentlyContinue;2⤵
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Windows\system32\cmd.execmd.exe /c start powershell.exe -WindowStyle Hidden -Command Sleep -Milliseconds 500; Remove-Item -Force -Path "C:\Users\Admin\AppData\Local\Temp\C:\Users\Admin\AppData\Local\Temp\sample.exe" -ErrorAction SilentlyContinue;3⤵
- Suspicious use of WriteProcessMemory
PID:856 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -WindowStyle Hidden -Command Sleep -Milliseconds 500; Remove-Item -Force -Path "C:\Users\Admin\AppData\Local\Temp\C:\Users\Admin\AppData\Local\Temp\sample.exe" -ErrorAction SilentlyContinue;4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3684
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82