Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    24/12/2023, 15:01

General

  • Target

    02b199ad71fba2064099606fd526e061.exe

  • Size

    581KB

  • MD5

    02b199ad71fba2064099606fd526e061

  • SHA1

    564658cf5085597f874fd1f014f62107d50e1b4e

  • SHA256

    103e110f10ddbe29f4808206106c90c6d2e95d9d461f9472cf8e4d86c54deba2

  • SHA512

    e20932987a314d8ddc390142d02c79550bcefe97eba66a1858bbcbc717ba192ee80516e69acfe2fc398327d9a1770d7f742e7610ee2c3621c508ef36ff1dbcd7

  • SSDEEP

    12288:VaeH77mXp1D+EYiVbgYrbKXjM9QXbWlEk/NxiwB4dbihMqnsebyWyAo:Vak74p5+EbVCziEk/n7WdSbyWI

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 10 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\02b199ad71fba2064099606fd526e061.exe
    "C:\Users\Admin\AppData\Local\Temp\02b199ad71fba2064099606fd526e061.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2240
    • C:\Users\Admin\AppData\Local\Temp\becabffccda.exe
      C:\Users\Admin\AppData\Local\Temp\becabffccda.exe 8-3-8-1-0-2-1-1-1-5-0 J01BQz0wMjIfKlNNP0hIRDsvHy5JRUxUR1FLR0M8LxsvPEZLU0lCPDEzMTApHSdCSUI8Lx8qUEpMPFRDUl5IQzgxLjYsHy9RRFFVQFJXUkpLPWZzc281LydwXXF2LHNnZChhaG0lY2FyYC1oaWZnHSdCTEdCSkg/PSgtMDYxNjI3MCsxMC0sMDc2MzEwMyAnQSk8TlNMQURNLCgtMDYxNjI3MBsvPC81LDEeLkMyOC0pHSdDNDssMB8qRC06JTAgLU9RTj9VO1FXT1JHVUBCVD0YLEhRT0JUQlNaRU1JOTwgLU9RTj9VO1FXTUFLRDwfKkVQQldUUko8Hy5AWD1cO0xESkhNRDggJ0VHUlRdQVFOUlM9TzUxIC1TR0BJS1FMTV5VUEs8HypUQUo9PDEyMS8yMjAoMjAfL1RMPDEbLzxQKTwgLVFUTU9JRUJXVkVKQk5MQElFPj9EVVBLPB8qSUtcSlROUkhMRDh0anJdHy9QRFNUTU5BSz9eVVFEUV4/QVFQNTEgLUdIQ0BYNS4YLklRXkNYSUFFRjteRUxCUVhLVD1BNWVhanJkHypER1RGS08/Q15TRE09OikuNC0xLzAwKikuMjA0ODA3KTxNGCw8TldMS05AP19BTTUwNy8tODgpMS0yJjE0MQ==
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:2916
      • C:\Windows\SysWOW64\Wbem\wmic.exe
        wmic /output:C:\Users\Admin\AppData\Local\Temp\81703446356.txt bios get serialnumber
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2772
      • C:\Windows\SysWOW64\Wbem\wmic.exe
        wmic /output:C:\Users\Admin\AppData\Local\Temp\81703446356.txt bios get version
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2208
      • C:\Windows\SysWOW64\Wbem\wmic.exe
        wmic /output:C:\Users\Admin\AppData\Local\Temp\81703446356.txt bios get version
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2212
      • C:\Windows\SysWOW64\Wbem\wmic.exe
        wmic /output:C:\Users\Admin\AppData\Local\Temp\81703446356.txt bios get version
        3⤵
          PID:2892
        • C:\Windows\SysWOW64\Wbem\wmic.exe
          wmic /output:C:\Users\Admin\AppData\Local\Temp\81703446356.txt bios get version
          3⤵
            PID:1080
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2916 -s 372
            3⤵
            • Loads dropped DLL
            • Program crash
            PID:2936

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\81703446356.txt

        Filesize

        66B

        MD5

        9025468f85256136f923096b01375964

        SHA1

        7fcd174999661594fa5f88890ffb195e9858cc52

        SHA256

        d5418014fa8e6e17d8992fd12c0dfecac8a34855603ea58133e87ea09c2130df

        SHA512

        92cac37c332e6e276a963d659986a79a79867df44682bfc2d77ed7784ffa5e2c149e5960a83d03ef4cf171be40a73e93a110aaa53b95152fa9a9da6b41d31e51

      • \Users\Admin\AppData\Local\Temp\becabffccda.exe

        Filesize

        826KB

        MD5

        801856b03c92517f9b6a37f27e47f975

        SHA1

        481d74398b73ecb2d279c34e0e2bc48f442d710a

        SHA256

        40b87503f6cf338d7758e9a31ae690009c16b39d42acab5da88d898b74d06c46

        SHA512

        fc3312d4d756e88c5677d8ab488544a9548ffdbd6180770b0a55d0e5021fffe6dfdec206af03517647315c7da6733b7ef8cfd0e65a82ffafdd16b1154cd526f6

      • \Users\Admin\AppData\Local\Temp\becabffccda.exe

        Filesize

        824KB

        MD5

        cbde8aa466e306604ef67b8f909ea665

        SHA1

        6cb37a37fa6a0d0b82214ef9f837b2c373bb01ee

        SHA256

        b76fe3f3b9dbd5efffa24b48027b51149ceb4319de989344ba239d6a7b274ff7

        SHA512

        96ad3ca3954546aaecf962a3931809f7b990f3618c3d9f4ff8dbc1629341467197e594f613c3ff4517ead128788fc256e566e7d50f91aa6484547cbba96dbcd7

      • \Users\Admin\AppData\Local\Temp\becabffccda.exe

        Filesize

        351KB

        MD5

        7a3ab6591d0ca712143150bbe4f1fbd4

        SHA1

        f583507a147d871cb822d302a07b8234c80f5fb9

        SHA256

        a178254af5b37a7419a397d9b15dc21280fc0f65e559787a1bddc5e9d3b75f9b

        SHA512

        755813f90419b18be82676a9e7cf8865c68818aa2fb47042a7b92be2c7545d6b68766038a0301bad3091877606503196cc24991a4366b25cab7bcce83c800fa7

      • \Users\Admin\AppData\Local\Temp\becabffccda.exe

        Filesize

        444KB

        MD5

        490d5f85e2ec876d19f32e0fb22e24d9

        SHA1

        423ecd3c6bd03280152f45d4658a1985068f50a4

        SHA256

        fc7866eaf8b94ce4ca0b0fdcab9385c965e8e624ba38636ddbec6ce66892362d

        SHA512

        ee91f6ccfd746ca897a2d26672992809e32b5218fb5b0fb28b7bd092cf4c144c34b2b64570ff984e6f3a23b0ba040d915db3b5686f593af5702d73c502d30180

      • \Users\Admin\AppData\Local\Temp\becabffccda.exe

        Filesize

        328KB

        MD5

        e55256630a0213b67431e46867c5771b

        SHA1

        07596578630ef0898ba93ff6f0220849266f8f76

        SHA256

        4209e37075de2af6fbd9a459ef9d37e332e29057b59457985f19ea1de851d6b6

        SHA512

        faadd19250bbbb1cabf3bdd1c643ec8604c3d243a5f853e707e6f46bc9a2a6c34d13502cca4b9845c9c6f99a1c1524b40990e6473d5367e3abe4f3aaad0d6ed9

      • \Users\Admin\AppData\Local\Temp\becabffccda.exe

        Filesize

        257KB

        MD5

        fc34310153b915db2b4ca8748f3b5c70

        SHA1

        416a163940ab16da1afbefff8a753ab860ce59e9

        SHA256

        2ff96ba60d7a28c7400ad96e1320e296267b9eab3e76139dce64f222e4141a6b

        SHA512

        2fc4b9c9b8b865a3ad9cc368bb2ede555091d0b781cda5a8be069696885575d52835f6428784defe4ced325b9d1f73e25345e0e1bd111ef313efc44f87de46f6

      • \Users\Admin\AppData\Local\Temp\becabffccda.exe

        Filesize

        234KB

        MD5

        62f8bf014b095b2851ac696e4b0dffee

        SHA1

        ad637a06c3633c29420d9d46d125f1eecac560fa

        SHA256

        54e7ecb0a2ed6dd19e314385e714661f5c40d32d957713d53f5b2a7b6242b93e

        SHA512

        a55ddd90208ced02d7496931134f865f176ab5fb7e39e77e86ea9b8e1519cf093eda9c7e93c343e0200526ecf5b804a951e80735255b196e047fd39c0a799d43

      • \Users\Admin\AppData\Local\Temp\becabffccda.exe

        Filesize

        261KB

        MD5

        f3f48b3ec45b4a83b16bda240d0ccd66

        SHA1

        68dd07c90712c2993af62c256aaaf05b69cdd9ce

        SHA256

        c426deefbfe809a5ad687e26c63d41837fdc101f7dd70b442e0c19314d16be0a

        SHA512

        d6085660d5c063009c1bf0f82b76de783bad032ae935bdee7c8969b04cce274fca15653fdd8d513fd32b8c462613e9a193808e918810c28d9e66df3579c03571

      • \Users\Admin\AppData\Local\Temp\nst4DB4.tmp\llff.dll

        Filesize

        118KB

        MD5

        a0950be73d1245b9c64f53491b51cccd

        SHA1

        2b18116ecd177fffdf977a2b1778e34aeb620684

        SHA256

        4a49aa14a58368f89b1d28fe384fd9fc312516faa26e26dabf744ded46308819

        SHA512

        689e4b5ca543f7a43d3bb48d2c0ffc8d7daa42d0c434698c6ea09af6907607e949dd74e8afce48e676bac6f461ead2506ed7208a6a5658696cbe26a41b398f1c

      • \Users\Admin\AppData\Local\Temp\nst4DB4.tmp\nsisunz.dll

        Filesize

        40KB

        MD5

        5f13dbc378792f23e598079fc1e4422b

        SHA1

        5813c05802f15930aa860b8363af2b58426c8adf

        SHA256

        6e87ecb7f62039fbb6e7676422d1a5e75a32b90dde6865dcb68ee658ba8df61d

        SHA512

        9270635a5294482f49e0292e26d45dd103b85fe27dc163d44531b095c5f9dbde6b904adaf1a888ba3c112a094380394713c796f5195b2566a20f00b42b6578e5