Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
22/12/2023, 15:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
dbb98d0aa782388fd4fc13078251d108.exe
Resource
win7-20231215-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
dbb98d0aa782388fd4fc13078251d108.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
dbb98d0aa782388fd4fc13078251d108.exe
-
Size
440KB
-
MD5
dbb98d0aa782388fd4fc13078251d108
-
SHA1
e1e15929307d22bd4f6b7c28528c29958e66eee2
-
SHA256
b8699065889b97210d65f3f31ba0eddf40adb4c11fefa938ee5002d9bb73c75f
-
SHA512
f194c0d2683c2f5ec7f44bf82187abe943a540cd5b1f55c3e20df3cc1075b3e46a6374aebadcba57879fe7db4c1d954b36a9dcbd012d1faabddccd4db7ce594f
-
SSDEEP
6144:takFq8nVj5phXowVf3pIf5c8Zs9xj3cHv3vYpb7sg/vE/v7NVYOj6lTMfTxv8Z9p:LFNnNhRlufWjsYpb7sgHOv7RMq1vO9p
Score
7/10
Malware Config
Signatures
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion dbb98d0aa782388fd4fc13078251d108.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion dbb98d0aa782388fd4fc13078251d108.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 436 winlogon.exe 436 winlogon.exe 436 winlogon.exe 436 winlogon.exe 436 winlogon.exe 436 winlogon.exe 436 winlogon.exe 436 winlogon.exe 436 winlogon.exe 1076 Explorer.EXE 1076 Explorer.EXE 1076 Explorer.EXE 1076 Explorer.EXE 1076 Explorer.EXE 1076 Explorer.EXE 1076 Explorer.EXE 1076 Explorer.EXE 1076 Explorer.EXE 436 winlogon.exe 436 winlogon.exe 436 winlogon.exe 436 winlogon.exe 436 winlogon.exe 436 winlogon.exe 436 winlogon.exe 436 winlogon.exe 436 winlogon.exe 1076 Explorer.EXE 1076 Explorer.EXE 1076 Explorer.EXE 1076 Explorer.EXE 1076 Explorer.EXE -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2376 dbb98d0aa782388fd4fc13078251d108.exe Token: SeDebugPrivilege 436 winlogon.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe 2376 dbb98d0aa782388fd4fc13078251d108.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2376 wrote to memory of 2712 2376 dbb98d0aa782388fd4fc13078251d108.exe 28 PID 2376 wrote to memory of 2712 2376 dbb98d0aa782388fd4fc13078251d108.exe 28 PID 2376 wrote to memory of 2712 2376 dbb98d0aa782388fd4fc13078251d108.exe 28 PID 2376 wrote to memory of 2712 2376 dbb98d0aa782388fd4fc13078251d108.exe 28 PID 2376 wrote to memory of 2712 2376 dbb98d0aa782388fd4fc13078251d108.exe 28 PID 2376 wrote to memory of 2712 2376 dbb98d0aa782388fd4fc13078251d108.exe 28 PID 2376 wrote to memory of 2712 2376 dbb98d0aa782388fd4fc13078251d108.exe 28 PID 2376 wrote to memory of 2712 2376 dbb98d0aa782388fd4fc13078251d108.exe 28 PID 2376 wrote to memory of 2712 2376 dbb98d0aa782388fd4fc13078251d108.exe 28 PID 2376 wrote to memory of 436 2376 dbb98d0aa782388fd4fc13078251d108.exe 23 PID 2376 wrote to memory of 1076 2376 dbb98d0aa782388fd4fc13078251d108.exe 10
Processes
-
C:\Users\Admin\AppData\Local\Temp\dbb98d0aa782388fd4fc13078251d108.exe"C:\Users\Admin\AppData\Local\Temp\dbb98d0aa782388fd4fc13078251d108.exe"1⤵
- Checks BIOS information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Windows\system32\rundll32.exe-ah bmishkv.dll2⤵PID:2712
-
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1076
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:436