Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
24/12/2023, 15:01
Static task
static1
Behavioral task
behavioral1
Sample
02b199ad71fba2064099606fd526e061.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
02b199ad71fba2064099606fd526e061.exe
Resource
win10v2004-20231215-en
General
-
Target
02b199ad71fba2064099606fd526e061.exe
-
Size
581KB
-
MD5
02b199ad71fba2064099606fd526e061
-
SHA1
564658cf5085597f874fd1f014f62107d50e1b4e
-
SHA256
103e110f10ddbe29f4808206106c90c6d2e95d9d461f9472cf8e4d86c54deba2
-
SHA512
e20932987a314d8ddc390142d02c79550bcefe97eba66a1858bbcbc717ba192ee80516e69acfe2fc398327d9a1770d7f742e7610ee2c3621c508ef36ff1dbcd7
-
SSDEEP
12288:VaeH77mXp1D+EYiVbgYrbKXjM9QXbWlEk/NxiwB4dbihMqnsebyWyAo:Vak74p5+EbVCziEk/n7WdSbyWI
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2916 becabffccda.exe -
Loads dropped DLL 10 IoCs
pid Process 2240 02b199ad71fba2064099606fd526e061.exe 2240 02b199ad71fba2064099606fd526e061.exe 2240 02b199ad71fba2064099606fd526e061.exe 2936 WerFault.exe 2936 WerFault.exe 2936 WerFault.exe 2936 WerFault.exe 2936 WerFault.exe 2936 WerFault.exe 2936 WerFault.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 2936 2916 WerFault.exe 28 -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2772 wmic.exe Token: SeSecurityPrivilege 2772 wmic.exe Token: SeTakeOwnershipPrivilege 2772 wmic.exe Token: SeLoadDriverPrivilege 2772 wmic.exe Token: SeSystemProfilePrivilege 2772 wmic.exe Token: SeSystemtimePrivilege 2772 wmic.exe Token: SeProfSingleProcessPrivilege 2772 wmic.exe Token: SeIncBasePriorityPrivilege 2772 wmic.exe Token: SeCreatePagefilePrivilege 2772 wmic.exe Token: SeBackupPrivilege 2772 wmic.exe Token: SeRestorePrivilege 2772 wmic.exe Token: SeShutdownPrivilege 2772 wmic.exe Token: SeDebugPrivilege 2772 wmic.exe Token: SeSystemEnvironmentPrivilege 2772 wmic.exe Token: SeRemoteShutdownPrivilege 2772 wmic.exe Token: SeUndockPrivilege 2772 wmic.exe Token: SeManageVolumePrivilege 2772 wmic.exe Token: 33 2772 wmic.exe Token: 34 2772 wmic.exe Token: 35 2772 wmic.exe Token: SeIncreaseQuotaPrivilege 2772 wmic.exe Token: SeSecurityPrivilege 2772 wmic.exe Token: SeTakeOwnershipPrivilege 2772 wmic.exe Token: SeLoadDriverPrivilege 2772 wmic.exe Token: SeSystemProfilePrivilege 2772 wmic.exe Token: SeSystemtimePrivilege 2772 wmic.exe Token: SeProfSingleProcessPrivilege 2772 wmic.exe Token: SeIncBasePriorityPrivilege 2772 wmic.exe Token: SeCreatePagefilePrivilege 2772 wmic.exe Token: SeBackupPrivilege 2772 wmic.exe Token: SeRestorePrivilege 2772 wmic.exe Token: SeShutdownPrivilege 2772 wmic.exe Token: SeDebugPrivilege 2772 wmic.exe Token: SeSystemEnvironmentPrivilege 2772 wmic.exe Token: SeRemoteShutdownPrivilege 2772 wmic.exe Token: SeUndockPrivilege 2772 wmic.exe Token: SeManageVolumePrivilege 2772 wmic.exe Token: 33 2772 wmic.exe Token: 34 2772 wmic.exe Token: 35 2772 wmic.exe Token: SeIncreaseQuotaPrivilege 2208 wmic.exe Token: SeSecurityPrivilege 2208 wmic.exe Token: SeTakeOwnershipPrivilege 2208 wmic.exe Token: SeLoadDriverPrivilege 2208 wmic.exe Token: SeSystemProfilePrivilege 2208 wmic.exe Token: SeSystemtimePrivilege 2208 wmic.exe Token: SeProfSingleProcessPrivilege 2208 wmic.exe Token: SeIncBasePriorityPrivilege 2208 wmic.exe Token: SeCreatePagefilePrivilege 2208 wmic.exe Token: SeBackupPrivilege 2208 wmic.exe Token: SeRestorePrivilege 2208 wmic.exe Token: SeShutdownPrivilege 2208 wmic.exe Token: SeDebugPrivilege 2208 wmic.exe Token: SeSystemEnvironmentPrivilege 2208 wmic.exe Token: SeRemoteShutdownPrivilege 2208 wmic.exe Token: SeUndockPrivilege 2208 wmic.exe Token: SeManageVolumePrivilege 2208 wmic.exe Token: 33 2208 wmic.exe Token: 34 2208 wmic.exe Token: 35 2208 wmic.exe Token: SeIncreaseQuotaPrivilege 2212 wmic.exe Token: SeSecurityPrivilege 2212 wmic.exe Token: SeTakeOwnershipPrivilege 2212 wmic.exe Token: SeLoadDriverPrivilege 2212 wmic.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2240 wrote to memory of 2916 2240 02b199ad71fba2064099606fd526e061.exe 28 PID 2240 wrote to memory of 2916 2240 02b199ad71fba2064099606fd526e061.exe 28 PID 2240 wrote to memory of 2916 2240 02b199ad71fba2064099606fd526e061.exe 28 PID 2240 wrote to memory of 2916 2240 02b199ad71fba2064099606fd526e061.exe 28 PID 2916 wrote to memory of 2772 2916 becabffccda.exe 29 PID 2916 wrote to memory of 2772 2916 becabffccda.exe 29 PID 2916 wrote to memory of 2772 2916 becabffccda.exe 29 PID 2916 wrote to memory of 2772 2916 becabffccda.exe 29 PID 2916 wrote to memory of 2208 2916 becabffccda.exe 32 PID 2916 wrote to memory of 2208 2916 becabffccda.exe 32 PID 2916 wrote to memory of 2208 2916 becabffccda.exe 32 PID 2916 wrote to memory of 2208 2916 becabffccda.exe 32 PID 2916 wrote to memory of 2212 2916 becabffccda.exe 34 PID 2916 wrote to memory of 2212 2916 becabffccda.exe 34 PID 2916 wrote to memory of 2212 2916 becabffccda.exe 34 PID 2916 wrote to memory of 2212 2916 becabffccda.exe 34 PID 2916 wrote to memory of 2892 2916 becabffccda.exe 36 PID 2916 wrote to memory of 2892 2916 becabffccda.exe 36 PID 2916 wrote to memory of 2892 2916 becabffccda.exe 36 PID 2916 wrote to memory of 2892 2916 becabffccda.exe 36 PID 2916 wrote to memory of 1080 2916 becabffccda.exe 38 PID 2916 wrote to memory of 1080 2916 becabffccda.exe 38 PID 2916 wrote to memory of 1080 2916 becabffccda.exe 38 PID 2916 wrote to memory of 1080 2916 becabffccda.exe 38 PID 2916 wrote to memory of 2936 2916 becabffccda.exe 40 PID 2916 wrote to memory of 2936 2916 becabffccda.exe 40 PID 2916 wrote to memory of 2936 2916 becabffccda.exe 40 PID 2916 wrote to memory of 2936 2916 becabffccda.exe 40
Processes
-
C:\Users\Admin\AppData\Local\Temp\02b199ad71fba2064099606fd526e061.exe"C:\Users\Admin\AppData\Local\Temp\02b199ad71fba2064099606fd526e061.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\becabffccda.exeC:\Users\Admin\AppData\Local\Temp\becabffccda.exe 8-3-8-1-0-2-1-1-1-5-0 J01BQz0wMjIfKlNNP0hIRDsvHy5JRUxUR1FLR0M8LxsvPEZLU0lCPDEzMTApHSdCSUI8Lx8qUEpMPFRDUl5IQzgxLjYsHy9RRFFVQFJXUkpLPWZzc281LydwXXF2LHNnZChhaG0lY2FyYC1oaWZnHSdCTEdCSkg/PSgtMDYxNjI3MCsxMC0sMDc2MzEwMyAnQSk8TlNMQURNLCgtMDYxNjI3MBsvPC81LDEeLkMyOC0pHSdDNDssMB8qRC06JTAgLU9RTj9VO1FXT1JHVUBCVD0YLEhRT0JUQlNaRU1JOTwgLU9RTj9VO1FXTUFLRDwfKkVQQldUUko8Hy5AWD1cO0xESkhNRDggJ0VHUlRdQVFOUlM9TzUxIC1TR0BJS1FMTV5VUEs8HypUQUo9PDEyMS8yMjAoMjAfL1RMPDEbLzxQKTwgLVFUTU9JRUJXVkVKQk5MQElFPj9EVVBLPB8qSUtcSlROUkhMRDh0anJdHy9QRFNUTU5BSz9eVVFEUV4/QVFQNTEgLUdIQ0BYNS4YLklRXkNYSUFFRjteRUxCUVhLVD1BNWVhanJkHypER1RGS08/Q15TRE09OikuNC0xLzAwKikuMjA0ODA3KTxNGCw8TldMS05AP19BTTUwNy8tODgpMS0yJjE0MQ==2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81703446356.txt bios get serialnumber3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2772
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81703446356.txt bios get version3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2208
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81703446356.txt bios get version3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2212
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81703446356.txt bios get version3⤵PID:2892
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81703446356.txt bios get version3⤵PID:1080
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2916 -s 3723⤵
- Loads dropped DLL
- Program crash
PID:2936
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
66B
MD59025468f85256136f923096b01375964
SHA17fcd174999661594fa5f88890ffb195e9858cc52
SHA256d5418014fa8e6e17d8992fd12c0dfecac8a34855603ea58133e87ea09c2130df
SHA51292cac37c332e6e276a963d659986a79a79867df44682bfc2d77ed7784ffa5e2c149e5960a83d03ef4cf171be40a73e93a110aaa53b95152fa9a9da6b41d31e51
-
Filesize
826KB
MD5801856b03c92517f9b6a37f27e47f975
SHA1481d74398b73ecb2d279c34e0e2bc48f442d710a
SHA25640b87503f6cf338d7758e9a31ae690009c16b39d42acab5da88d898b74d06c46
SHA512fc3312d4d756e88c5677d8ab488544a9548ffdbd6180770b0a55d0e5021fffe6dfdec206af03517647315c7da6733b7ef8cfd0e65a82ffafdd16b1154cd526f6
-
Filesize
824KB
MD5cbde8aa466e306604ef67b8f909ea665
SHA16cb37a37fa6a0d0b82214ef9f837b2c373bb01ee
SHA256b76fe3f3b9dbd5efffa24b48027b51149ceb4319de989344ba239d6a7b274ff7
SHA51296ad3ca3954546aaecf962a3931809f7b990f3618c3d9f4ff8dbc1629341467197e594f613c3ff4517ead128788fc256e566e7d50f91aa6484547cbba96dbcd7
-
Filesize
351KB
MD57a3ab6591d0ca712143150bbe4f1fbd4
SHA1f583507a147d871cb822d302a07b8234c80f5fb9
SHA256a178254af5b37a7419a397d9b15dc21280fc0f65e559787a1bddc5e9d3b75f9b
SHA512755813f90419b18be82676a9e7cf8865c68818aa2fb47042a7b92be2c7545d6b68766038a0301bad3091877606503196cc24991a4366b25cab7bcce83c800fa7
-
Filesize
444KB
MD5490d5f85e2ec876d19f32e0fb22e24d9
SHA1423ecd3c6bd03280152f45d4658a1985068f50a4
SHA256fc7866eaf8b94ce4ca0b0fdcab9385c965e8e624ba38636ddbec6ce66892362d
SHA512ee91f6ccfd746ca897a2d26672992809e32b5218fb5b0fb28b7bd092cf4c144c34b2b64570ff984e6f3a23b0ba040d915db3b5686f593af5702d73c502d30180
-
Filesize
328KB
MD5e55256630a0213b67431e46867c5771b
SHA107596578630ef0898ba93ff6f0220849266f8f76
SHA2564209e37075de2af6fbd9a459ef9d37e332e29057b59457985f19ea1de851d6b6
SHA512faadd19250bbbb1cabf3bdd1c643ec8604c3d243a5f853e707e6f46bc9a2a6c34d13502cca4b9845c9c6f99a1c1524b40990e6473d5367e3abe4f3aaad0d6ed9
-
Filesize
257KB
MD5fc34310153b915db2b4ca8748f3b5c70
SHA1416a163940ab16da1afbefff8a753ab860ce59e9
SHA2562ff96ba60d7a28c7400ad96e1320e296267b9eab3e76139dce64f222e4141a6b
SHA5122fc4b9c9b8b865a3ad9cc368bb2ede555091d0b781cda5a8be069696885575d52835f6428784defe4ced325b9d1f73e25345e0e1bd111ef313efc44f87de46f6
-
Filesize
234KB
MD562f8bf014b095b2851ac696e4b0dffee
SHA1ad637a06c3633c29420d9d46d125f1eecac560fa
SHA25654e7ecb0a2ed6dd19e314385e714661f5c40d32d957713d53f5b2a7b6242b93e
SHA512a55ddd90208ced02d7496931134f865f176ab5fb7e39e77e86ea9b8e1519cf093eda9c7e93c343e0200526ecf5b804a951e80735255b196e047fd39c0a799d43
-
Filesize
261KB
MD5f3f48b3ec45b4a83b16bda240d0ccd66
SHA168dd07c90712c2993af62c256aaaf05b69cdd9ce
SHA256c426deefbfe809a5ad687e26c63d41837fdc101f7dd70b442e0c19314d16be0a
SHA512d6085660d5c063009c1bf0f82b76de783bad032ae935bdee7c8969b04cce274fca15653fdd8d513fd32b8c462613e9a193808e918810c28d9e66df3579c03571
-
Filesize
118KB
MD5a0950be73d1245b9c64f53491b51cccd
SHA12b18116ecd177fffdf977a2b1778e34aeb620684
SHA2564a49aa14a58368f89b1d28fe384fd9fc312516faa26e26dabf744ded46308819
SHA512689e4b5ca543f7a43d3bb48d2c0ffc8d7daa42d0c434698c6ea09af6907607e949dd74e8afce48e676bac6f461ead2506ed7208a6a5658696cbe26a41b398f1c
-
Filesize
40KB
MD55f13dbc378792f23e598079fc1e4422b
SHA15813c05802f15930aa860b8363af2b58426c8adf
SHA2566e87ecb7f62039fbb6e7676422d1a5e75a32b90dde6865dcb68ee658ba8df61d
SHA5129270635a5294482f49e0292e26d45dd103b85fe27dc163d44531b095c5f9dbde6b904adaf1a888ba3c112a094380394713c796f5195b2566a20f00b42b6578e5