Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
166s -
max time network
175s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
17/11/2023, 15:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0008b0288875151c35294bf8013e1a79e4e00458141b5d09fb9a7dfa30545e7d.exe
Resource
win7-20231020-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
0008b0288875151c35294bf8013e1a79e4e00458141b5d09fb9a7dfa30545e7d.exe
Resource
win10v2004-20231023-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
0008b0288875151c35294bf8013e1a79e4e00458141b5d09fb9a7dfa30545e7d.exe
-
Size
3.6MB
-
MD5
ea4689e60b9a7ff1814f720af5e4305e
-
SHA1
b69853e2e931d6f1e55b0df5d37730a961a9a37d
-
SHA256
0008b0288875151c35294bf8013e1a79e4e00458141b5d09fb9a7dfa30545e7d
-
SHA512
c3596cff947a31818e17c6c927be2071e70ff4ed8d00e72400490ad72b43e37ef567ffb33d6dfc4769fa6ac7220c033691400d2ea841abc3861156d3a949e90c
-
SSDEEP
98304:pkWk3il5nZ5rA0wBIznG89UWz5LjeAP3FUT+p:pkWYil5ZGnIznGPWz5LjecUap
Score
7/10
Malware Config
Signatures
-
Loads dropped DLL 3 IoCs
pid Process 884 0008b0288875151c35294bf8013e1a79e4e00458141b5d09fb9a7dfa30545e7d.exe 884 0008b0288875151c35294bf8013e1a79e4e00458141b5d09fb9a7dfa30545e7d.exe 884 0008b0288875151c35294bf8013e1a79e4e00458141b5d09fb9a7dfa30545e7d.exe -
resource yara_rule behavioral2/memory/884-13079-0x0000000003FA0000-0x0000000003FDE000-memory.dmp upx behavioral2/memory/884-13083-0x0000000003FA0000-0x0000000003FDE000-memory.dmp upx behavioral2/memory/884-13081-0x0000000003FA0000-0x0000000003FDE000-memory.dmp upx behavioral2/memory/884-13085-0x0000000003FA0000-0x0000000003FDE000-memory.dmp upx behavioral2/memory/884-13080-0x0000000003FA0000-0x0000000003FDE000-memory.dmp upx behavioral2/memory/884-13088-0x0000000003FA0000-0x0000000003FDE000-memory.dmp upx behavioral2/memory/884-13090-0x0000000003FA0000-0x0000000003FDE000-memory.dmp upx behavioral2/memory/884-13093-0x0000000003FA0000-0x0000000003FDE000-memory.dmp upx behavioral2/memory/884-13095-0x0000000003FA0000-0x0000000003FDE000-memory.dmp upx behavioral2/memory/884-13099-0x0000000003FA0000-0x0000000003FDE000-memory.dmp upx behavioral2/memory/884-13103-0x0000000003FA0000-0x0000000003FDE000-memory.dmp upx behavioral2/memory/884-13101-0x0000000003FA0000-0x0000000003FDE000-memory.dmp upx behavioral2/memory/884-13106-0x0000000003FA0000-0x0000000003FDE000-memory.dmp upx behavioral2/memory/884-13108-0x0000000003FA0000-0x0000000003FDE000-memory.dmp upx behavioral2/memory/884-13111-0x0000000003FA0000-0x0000000003FDE000-memory.dmp upx behavioral2/memory/884-13113-0x0000000003FA0000-0x0000000003FDE000-memory.dmp upx behavioral2/memory/884-13116-0x0000000003FA0000-0x0000000003FDE000-memory.dmp upx behavioral2/memory/884-13120-0x0000000003FA0000-0x0000000003FDE000-memory.dmp upx behavioral2/memory/884-13118-0x0000000003FA0000-0x0000000003FDE000-memory.dmp upx behavioral2/memory/884-13122-0x0000000003FA0000-0x0000000003FDE000-memory.dmp upx behavioral2/memory/884-13124-0x0000000003FA0000-0x0000000003FDE000-memory.dmp upx behavioral2/memory/884-13127-0x0000000003FA0000-0x0000000003FDE000-memory.dmp upx behavioral2/memory/884-13129-0x0000000003FA0000-0x0000000003FDE000-memory.dmp upx behavioral2/memory/884-13131-0x0000000003FA0000-0x0000000003FDE000-memory.dmp upx -
Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs
pid Process 884 0008b0288875151c35294bf8013e1a79e4e00458141b5d09fb9a7dfa30545e7d.exe 884 0008b0288875151c35294bf8013e1a79e4e00458141b5d09fb9a7dfa30545e7d.exe 884 0008b0288875151c35294bf8013e1a79e4e00458141b5d09fb9a7dfa30545e7d.exe 884 0008b0288875151c35294bf8013e1a79e4e00458141b5d09fb9a7dfa30545e7d.exe 884 0008b0288875151c35294bf8013e1a79e4e00458141b5d09fb9a7dfa30545e7d.exe 884 0008b0288875151c35294bf8013e1a79e4e00458141b5d09fb9a7dfa30545e7d.exe 884 0008b0288875151c35294bf8013e1a79e4e00458141b5d09fb9a7dfa30545e7d.exe 884 0008b0288875151c35294bf8013e1a79e4e00458141b5d09fb9a7dfa30545e7d.exe 884 0008b0288875151c35294bf8013e1a79e4e00458141b5d09fb9a7dfa30545e7d.exe 884 0008b0288875151c35294bf8013e1a79e4e00458141b5d09fb9a7dfa30545e7d.exe 884 0008b0288875151c35294bf8013e1a79e4e00458141b5d09fb9a7dfa30545e7d.exe 884 0008b0288875151c35294bf8013e1a79e4e00458141b5d09fb9a7dfa30545e7d.exe 884 0008b0288875151c35294bf8013e1a79e4e00458141b5d09fb9a7dfa30545e7d.exe 884 0008b0288875151c35294bf8013e1a79e4e00458141b5d09fb9a7dfa30545e7d.exe 884 0008b0288875151c35294bf8013e1a79e4e00458141b5d09fb9a7dfa30545e7d.exe 884 0008b0288875151c35294bf8013e1a79e4e00458141b5d09fb9a7dfa30545e7d.exe 884 0008b0288875151c35294bf8013e1a79e4e00458141b5d09fb9a7dfa30545e7d.exe 884 0008b0288875151c35294bf8013e1a79e4e00458141b5d09fb9a7dfa30545e7d.exe 884 0008b0288875151c35294bf8013e1a79e4e00458141b5d09fb9a7dfa30545e7d.exe 884 0008b0288875151c35294bf8013e1a79e4e00458141b5d09fb9a7dfa30545e7d.exe 884 0008b0288875151c35294bf8013e1a79e4e00458141b5d09fb9a7dfa30545e7d.exe 884 0008b0288875151c35294bf8013e1a79e4e00458141b5d09fb9a7dfa30545e7d.exe 884 0008b0288875151c35294bf8013e1a79e4e00458141b5d09fb9a7dfa30545e7d.exe 884 0008b0288875151c35294bf8013e1a79e4e00458141b5d09fb9a7dfa30545e7d.exe 884 0008b0288875151c35294bf8013e1a79e4e00458141b5d09fb9a7dfa30545e7d.exe 884 0008b0288875151c35294bf8013e1a79e4e00458141b5d09fb9a7dfa30545e7d.exe 884 0008b0288875151c35294bf8013e1a79e4e00458141b5d09fb9a7dfa30545e7d.exe 884 0008b0288875151c35294bf8013e1a79e4e00458141b5d09fb9a7dfa30545e7d.exe 884 0008b0288875151c35294bf8013e1a79e4e00458141b5d09fb9a7dfa30545e7d.exe 884 0008b0288875151c35294bf8013e1a79e4e00458141b5d09fb9a7dfa30545e7d.exe 884 0008b0288875151c35294bf8013e1a79e4e00458141b5d09fb9a7dfa30545e7d.exe 884 0008b0288875151c35294bf8013e1a79e4e00458141b5d09fb9a7dfa30545e7d.exe 884 0008b0288875151c35294bf8013e1a79e4e00458141b5d09fb9a7dfa30545e7d.exe 884 0008b0288875151c35294bf8013e1a79e4e00458141b5d09fb9a7dfa30545e7d.exe 884 0008b0288875151c35294bf8013e1a79e4e00458141b5d09fb9a7dfa30545e7d.exe 884 0008b0288875151c35294bf8013e1a79e4e00458141b5d09fb9a7dfa30545e7d.exe 884 0008b0288875151c35294bf8013e1a79e4e00458141b5d09fb9a7dfa30545e7d.exe 884 0008b0288875151c35294bf8013e1a79e4e00458141b5d09fb9a7dfa30545e7d.exe 884 0008b0288875151c35294bf8013e1a79e4e00458141b5d09fb9a7dfa30545e7d.exe 884 0008b0288875151c35294bf8013e1a79e4e00458141b5d09fb9a7dfa30545e7d.exe 884 0008b0288875151c35294bf8013e1a79e4e00458141b5d09fb9a7dfa30545e7d.exe 884 0008b0288875151c35294bf8013e1a79e4e00458141b5d09fb9a7dfa30545e7d.exe 884 0008b0288875151c35294bf8013e1a79e4e00458141b5d09fb9a7dfa30545e7d.exe 884 0008b0288875151c35294bf8013e1a79e4e00458141b5d09fb9a7dfa30545e7d.exe 884 0008b0288875151c35294bf8013e1a79e4e00458141b5d09fb9a7dfa30545e7d.exe 884 0008b0288875151c35294bf8013e1a79e4e00458141b5d09fb9a7dfa30545e7d.exe 884 0008b0288875151c35294bf8013e1a79e4e00458141b5d09fb9a7dfa30545e7d.exe 884 0008b0288875151c35294bf8013e1a79e4e00458141b5d09fb9a7dfa30545e7d.exe 884 0008b0288875151c35294bf8013e1a79e4e00458141b5d09fb9a7dfa30545e7d.exe 884 0008b0288875151c35294bf8013e1a79e4e00458141b5d09fb9a7dfa30545e7d.exe 884 0008b0288875151c35294bf8013e1a79e4e00458141b5d09fb9a7dfa30545e7d.exe 884 0008b0288875151c35294bf8013e1a79e4e00458141b5d09fb9a7dfa30545e7d.exe 884 0008b0288875151c35294bf8013e1a79e4e00458141b5d09fb9a7dfa30545e7d.exe 884 0008b0288875151c35294bf8013e1a79e4e00458141b5d09fb9a7dfa30545e7d.exe 884 0008b0288875151c35294bf8013e1a79e4e00458141b5d09fb9a7dfa30545e7d.exe 884 0008b0288875151c35294bf8013e1a79e4e00458141b5d09fb9a7dfa30545e7d.exe 884 0008b0288875151c35294bf8013e1a79e4e00458141b5d09fb9a7dfa30545e7d.exe 884 0008b0288875151c35294bf8013e1a79e4e00458141b5d09fb9a7dfa30545e7d.exe 884 0008b0288875151c35294bf8013e1a79e4e00458141b5d09fb9a7dfa30545e7d.exe 884 0008b0288875151c35294bf8013e1a79e4e00458141b5d09fb9a7dfa30545e7d.exe 884 0008b0288875151c35294bf8013e1a79e4e00458141b5d09fb9a7dfa30545e7d.exe 884 0008b0288875151c35294bf8013e1a79e4e00458141b5d09fb9a7dfa30545e7d.exe 884 0008b0288875151c35294bf8013e1a79e4e00458141b5d09fb9a7dfa30545e7d.exe 884 0008b0288875151c35294bf8013e1a79e4e00458141b5d09fb9a7dfa30545e7d.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1452 WMIC.exe Token: SeSecurityPrivilege 1452 WMIC.exe Token: SeTakeOwnershipPrivilege 1452 WMIC.exe Token: SeLoadDriverPrivilege 1452 WMIC.exe Token: SeSystemProfilePrivilege 1452 WMIC.exe Token: SeSystemtimePrivilege 1452 WMIC.exe Token: SeProfSingleProcessPrivilege 1452 WMIC.exe Token: SeIncBasePriorityPrivilege 1452 WMIC.exe Token: SeCreatePagefilePrivilege 1452 WMIC.exe Token: SeBackupPrivilege 1452 WMIC.exe Token: SeRestorePrivilege 1452 WMIC.exe Token: SeShutdownPrivilege 1452 WMIC.exe Token: SeDebugPrivilege 1452 WMIC.exe Token: SeSystemEnvironmentPrivilege 1452 WMIC.exe Token: SeRemoteShutdownPrivilege 1452 WMIC.exe Token: SeUndockPrivilege 1452 WMIC.exe Token: SeManageVolumePrivilege 1452 WMIC.exe Token: 33 1452 WMIC.exe Token: 34 1452 WMIC.exe Token: 35 1452 WMIC.exe Token: 36 1452 WMIC.exe Token: SeIncreaseQuotaPrivilege 1452 WMIC.exe Token: SeSecurityPrivilege 1452 WMIC.exe Token: SeTakeOwnershipPrivilege 1452 WMIC.exe Token: SeLoadDriverPrivilege 1452 WMIC.exe Token: SeSystemProfilePrivilege 1452 WMIC.exe Token: SeSystemtimePrivilege 1452 WMIC.exe Token: SeProfSingleProcessPrivilege 1452 WMIC.exe Token: SeIncBasePriorityPrivilege 1452 WMIC.exe Token: SeCreatePagefilePrivilege 1452 WMIC.exe Token: SeBackupPrivilege 1452 WMIC.exe Token: SeRestorePrivilege 1452 WMIC.exe Token: SeShutdownPrivilege 1452 WMIC.exe Token: SeDebugPrivilege 1452 WMIC.exe Token: SeSystemEnvironmentPrivilege 1452 WMIC.exe Token: SeRemoteShutdownPrivilege 1452 WMIC.exe Token: SeUndockPrivilege 1452 WMIC.exe Token: SeManageVolumePrivilege 1452 WMIC.exe Token: 33 1452 WMIC.exe Token: 34 1452 WMIC.exe Token: 35 1452 WMIC.exe Token: 36 1452 WMIC.exe Token: 33 884 0008b0288875151c35294bf8013e1a79e4e00458141b5d09fb9a7dfa30545e7d.exe Token: SeIncBasePriorityPrivilege 884 0008b0288875151c35294bf8013e1a79e4e00458141b5d09fb9a7dfa30545e7d.exe Token: 33 884 0008b0288875151c35294bf8013e1a79e4e00458141b5d09fb9a7dfa30545e7d.exe Token: SeIncBasePriorityPrivilege 884 0008b0288875151c35294bf8013e1a79e4e00458141b5d09fb9a7dfa30545e7d.exe Token: 33 884 0008b0288875151c35294bf8013e1a79e4e00458141b5d09fb9a7dfa30545e7d.exe Token: SeIncBasePriorityPrivilege 884 0008b0288875151c35294bf8013e1a79e4e00458141b5d09fb9a7dfa30545e7d.exe Token: 33 884 0008b0288875151c35294bf8013e1a79e4e00458141b5d09fb9a7dfa30545e7d.exe Token: SeIncBasePriorityPrivilege 884 0008b0288875151c35294bf8013e1a79e4e00458141b5d09fb9a7dfa30545e7d.exe Token: 33 884 0008b0288875151c35294bf8013e1a79e4e00458141b5d09fb9a7dfa30545e7d.exe Token: SeIncBasePriorityPrivilege 884 0008b0288875151c35294bf8013e1a79e4e00458141b5d09fb9a7dfa30545e7d.exe Token: 33 884 0008b0288875151c35294bf8013e1a79e4e00458141b5d09fb9a7dfa30545e7d.exe Token: SeIncBasePriorityPrivilege 884 0008b0288875151c35294bf8013e1a79e4e00458141b5d09fb9a7dfa30545e7d.exe Token: 33 884 0008b0288875151c35294bf8013e1a79e4e00458141b5d09fb9a7dfa30545e7d.exe Token: SeIncBasePriorityPrivilege 884 0008b0288875151c35294bf8013e1a79e4e00458141b5d09fb9a7dfa30545e7d.exe Token: 33 884 0008b0288875151c35294bf8013e1a79e4e00458141b5d09fb9a7dfa30545e7d.exe Token: SeIncBasePriorityPrivilege 884 0008b0288875151c35294bf8013e1a79e4e00458141b5d09fb9a7dfa30545e7d.exe Token: 33 884 0008b0288875151c35294bf8013e1a79e4e00458141b5d09fb9a7dfa30545e7d.exe Token: SeIncBasePriorityPrivilege 884 0008b0288875151c35294bf8013e1a79e4e00458141b5d09fb9a7dfa30545e7d.exe Token: 33 884 0008b0288875151c35294bf8013e1a79e4e00458141b5d09fb9a7dfa30545e7d.exe Token: SeIncBasePriorityPrivilege 884 0008b0288875151c35294bf8013e1a79e4e00458141b5d09fb9a7dfa30545e7d.exe Token: 33 884 0008b0288875151c35294bf8013e1a79e4e00458141b5d09fb9a7dfa30545e7d.exe Token: SeIncBasePriorityPrivilege 884 0008b0288875151c35294bf8013e1a79e4e00458141b5d09fb9a7dfa30545e7d.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 884 0008b0288875151c35294bf8013e1a79e4e00458141b5d09fb9a7dfa30545e7d.exe 884 0008b0288875151c35294bf8013e1a79e4e00458141b5d09fb9a7dfa30545e7d.exe 884 0008b0288875151c35294bf8013e1a79e4e00458141b5d09fb9a7dfa30545e7d.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 884 wrote to memory of 4284 884 0008b0288875151c35294bf8013e1a79e4e00458141b5d09fb9a7dfa30545e7d.exe 92 PID 884 wrote to memory of 4284 884 0008b0288875151c35294bf8013e1a79e4e00458141b5d09fb9a7dfa30545e7d.exe 92 PID 884 wrote to memory of 4284 884 0008b0288875151c35294bf8013e1a79e4e00458141b5d09fb9a7dfa30545e7d.exe 92 PID 4284 wrote to memory of 1452 4284 cmd.exe 94 PID 4284 wrote to memory of 1452 4284 cmd.exe 94 PID 4284 wrote to memory of 1452 4284 cmd.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\0008b0288875151c35294bf8013e1a79e4e00458141b5d09fb9a7dfa30545e7d.exe"C:\Users\Admin\AppData\Local\Temp\0008b0288875151c35294bf8013e1a79e4e00458141b5d09fb9a7dfa30545e7d.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:884 -
C:\Windows\SysWOW64\cmd.exe/c wmic diskdrive get serialnumber2⤵
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic diskdrive get serialnumber3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1452
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
67KB
MD53b8cc8eaaca02cb308c85c7280852ade
SHA15813f4d3f28c00e744856860e2fdda1818f60680
SHA256cb22ff7b7dc5235a7d749499dcbcbac10047f2fc9568ecdbafefe7b8f7f760c1
SHA512e1a2b1e595f1099f0b141e33905f050104924c5a6f87b6bb4fc77274441926d826bda035bbfae51bd75d22a207415aca35526270c7005b5545ead636a80e82b0
-
Filesize
67KB
MD53b8cc8eaaca02cb308c85c7280852ade
SHA15813f4d3f28c00e744856860e2fdda1818f60680
SHA256cb22ff7b7dc5235a7d749499dcbcbac10047f2fc9568ecdbafefe7b8f7f760c1
SHA512e1a2b1e595f1099f0b141e33905f050104924c5a6f87b6bb4fc77274441926d826bda035bbfae51bd75d22a207415aca35526270c7005b5545ead636a80e82b0
-
Filesize
67KB
MD53b8cc8eaaca02cb308c85c7280852ade
SHA15813f4d3f28c00e744856860e2fdda1818f60680
SHA256cb22ff7b7dc5235a7d749499dcbcbac10047f2fc9568ecdbafefe7b8f7f760c1
SHA512e1a2b1e595f1099f0b141e33905f050104924c5a6f87b6bb4fc77274441926d826bda035bbfae51bd75d22a207415aca35526270c7005b5545ead636a80e82b0
-
Filesize
67KB
MD53b8cc8eaaca02cb308c85c7280852ade
SHA15813f4d3f28c00e744856860e2fdda1818f60680
SHA256cb22ff7b7dc5235a7d749499dcbcbac10047f2fc9568ecdbafefe7b8f7f760c1
SHA512e1a2b1e595f1099f0b141e33905f050104924c5a6f87b6bb4fc77274441926d826bda035bbfae51bd75d22a207415aca35526270c7005b5545ead636a80e82b0