Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/12/2023, 15:12

General

  • Target

    0331158469df0cd4443f0bd7e63fbebe.exe

  • Size

    744KB

  • MD5

    0331158469df0cd4443f0bd7e63fbebe

  • SHA1

    f18ae560727157cad96a3bd7a852cf7cc27454cb

  • SHA256

    12f051704b66c4b350767037c4a917464c83755ccf27f8096c67b6df2ac6540c

  • SHA512

    afce77e2433d166d60ae17fc31fff186606f0a9fd5d3723da298b4715203f1b8a92569610bb719a9d8fd79f7fdc34f810e0eaaa3359ba2b952341fb27afb5849

  • SSDEEP

    12288:cR0qDrphD0iVoksPMdWo95eqW0LHmTTYUZ7FK2rxwqFpuri+MVzI0CWvfc8vy4ho:cCqDlhDBvsPIWfqBm3TrxXFpv+Mjv88Q

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0331158469df0cd4443f0bd7e63fbebe.exe
    "C:\Users\Admin\AppData\Local\Temp\0331158469df0cd4443f0bd7e63fbebe.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:544
    • C:\Users\Admin\AppData\Local\Temp\beddagcijb.exe
      C:\Users\Admin\AppData\Local\Temp\beddagcijb.exe 1#2#8#4#9#0#9#6#4#5#1 Lk5BQDQxKiozLh8uUU0+R0k7NywbLk1DTFNGUkJDQDgvHy08RUpUQD45LTM3NS8cJkNAPjkrHy5OSks7VTpOW0RDPDErLiwgJk1BTVVEUFdRSUw0YnBvbzktJ29pdiU+QU5KLFJHTCRBR0oqRE1FTRgrOkxAPUdEQzxAci0nYl8xay1yHy08LTROTEc+QFEfLTwuNC0oGis/MjwrKRwmRCs3KSwfLkItOSQxFylMTU5DUztQVlBJQ1I8Qlg7GCtHUkY+UT5TXkNNSDg9FylMTU5DUztQVk44R0E4Hy5DUEFWVUlGORsuRFY9WzpNO0ZFSUQ8HidERlNLWT5NTlZRPU40MRcpUENATUlRS0xfTExIOB8uVEU5KSAmPk8sPB8tSlFFVEBHQVpWREo7S0RFQEc9QkRUUEQ5Fy9ATVtNVE1SQUk8PWtscWAfLlA9UExSRUNKQl5UUT1OVkQ4U084MR8tQEU7RU83LRsuSFFXQFBOOEdFPl5ETDtOUFBLP0A4ZWBqa2EXLztJU0lLTj88W0BQNC4yKTEvLiYvLi4oLjIbLlNHRUE0MSstLys2MC4tLRcvO0lTSUtOPzxbS0lEPzkwLjIvJy4nMSwkLSw5MDUyLygqOEc=
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4724
      • C:\Windows\SysWOW64\Wbem\wmic.exe
        wmic /output:C:\Users\Admin\AppData\Local\Temp\81703448856.txt bios get serialnumber
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:432
      • C:\Windows\SysWOW64\Wbem\wmic.exe
        wmic /output:C:\Users\Admin\AppData\Local\Temp\81703448856.txt bios get version
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2044
      • C:\Windows\SysWOW64\Wbem\wmic.exe
        wmic /output:C:\Users\Admin\AppData\Local\Temp\81703448856.txt bios get version
        3⤵
          PID:1256
        • C:\Windows\SysWOW64\Wbem\wmic.exe
          wmic /output:C:\Users\Admin\AppData\Local\Temp\81703448856.txt bios get version
          3⤵
            PID:4032
          • C:\Windows\SysWOW64\Wbem\wmic.exe
            wmic /output:C:\Users\Admin\AppData\Local\Temp\81703448856.txt bios get version
            3⤵
              PID:4752
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 4724 -s 856
              3⤵
              • Program crash
              PID:4072
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4724 -ip 4724
          1⤵
            PID:3636

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\81703448856.txt

            Filesize

            66B

            MD5

            9025468f85256136f923096b01375964

            SHA1

            7fcd174999661594fa5f88890ffb195e9858cc52

            SHA256

            d5418014fa8e6e17d8992fd12c0dfecac8a34855603ea58133e87ea09c2130df

            SHA512

            92cac37c332e6e276a963d659986a79a79867df44682bfc2d77ed7784ffa5e2c149e5960a83d03ef4cf171be40a73e93a110aaa53b95152fa9a9da6b41d31e51

          • C:\Users\Admin\AppData\Local\Temp\81703448856.txt

            Filesize

            2B

            MD5

            f3b25701fe362ec84616a93a45ce9998

            SHA1

            d62636d8caec13f04e28442a0a6fa1afeb024bbb

            SHA256

            b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

            SHA512

            98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

          • C:\Users\Admin\AppData\Local\Temp\81703448856.txt

            Filesize

            58B

            MD5

            dd876faf0fd44a5fab3e82368e2e8b15

            SHA1

            01b04083fa278dda3a81705ca5abcfee487a3c90

            SHA256

            5602490a82bcacec8797d25cbb6f643fc9e69f89a2f0e6ec1e8d1f568e77a6b9

            SHA512

            e03d1def5b7fb0ed01a414cead199229ec0e153ff831d3ff5dd36c320572084c56a5e1369c753f868c855455758c0d308941b6187c348051419bd937d014cb8b

          • C:\Users\Admin\AppData\Local\Temp\beddagcijb.exe

            Filesize

            32KB

            MD5

            8f131cdac31f02862e62428c67398abd

            SHA1

            87fb4d86b9ae5e0606cf1f0d5e094931d77ab1a9

            SHA256

            c162ec92361aad0bb649a6ff7099e7d43a18c16b723152eb44c6621148eaefae

            SHA512

            1910738a80cbc9635e583efafce985d5bce5c6dbae5a4d5f88db64292d38dc6de39791741f31c7153daab850552dae1ba9de17357d018e6fce0fce130b125db2

          • C:\Users\Admin\AppData\Local\Temp\beddagcijb.exe

            Filesize

            64KB

            MD5

            26eeaa8134767da8de684080aa44f372

            SHA1

            bd84bc07a6ae7b2364589a14c41ac0740f6fdb09

            SHA256

            1386b29439f6a905e5ada27e964f07fb1f98135c0caa63eac473bee08d1df84b

            SHA512

            f8e77b0d0c0ccda294e6069a9bf1b6262a8a567040e31938dfbbd85326fc84d9febe8a5ace087365d71d049031bd4cffc69c19e8598b7f8f2077d57a8ec832f5

          • C:\Users\Admin\AppData\Local\Temp\nsh3E62.tmp\ZipDLL.dll

            Filesize

            109KB

            MD5

            c0303f6e1e125c4b6932bc6841c8d5a9

            SHA1

            67a227da5be3bc879623affd38cd10f2629b44ab

            SHA256

            a3572d99375c249b0532c98ee3064247022e698f46711a0b292f95dad0ddcad7

            SHA512

            bcdceaa252a1c2047a4a45f78a580787ea92acede6f069442e2352c580f72f97e918f9aa20327cdc2dd2b2d3f07076bee133b118ab6aee22896737ed22cdb468

          • C:\Users\Admin\AppData\Local\Temp\nsh3E62.tmp\ZipDLL.dll

            Filesize

            163KB

            MD5

            2dc35ddcabcb2b24919b9afae4ec3091

            SHA1

            9eeed33c3abc656353a7ebd1c66af38cccadd939

            SHA256

            6bbeb39747f1526752980d4dbec2fe2c7347f3cc983a79c92561b92fe472e7a1

            SHA512

            0ccac336924f684da1f73db2dd230a0c932c5b4115ae1fa0e708b9db5e39d2a07dc54dac8d95881a42069cbb2c2886e880cdad715deda83c0de38757a0f6a901

          • C:\Users\Admin\AppData\Local\Temp\nsh3E62.tmp\gcifgrz.dll

            Filesize

            83KB

            MD5

            a8066ac329284a3ca4a92257c5a45a08

            SHA1

            c4a748f0c45f3c3b40f0c77fb453571650bcee85

            SHA256

            3f890b2605bb5cac318db25169deb4eb5740aa798cd623c9d8cc656289f96a43

            SHA512

            983c4ee8b7f242a6df53ce1f09a7e98e4b3811d18a10f994ae5a28d533efe5730a68326e3cb4a13ea03fa8b99e808122e9d2c1eb204e297c05e0780743dd262b

          • C:\Users\Admin\AppData\Local\Temp\nsh3E62.tmp\gcifgrz.dll

            Filesize

            139KB

            MD5

            b4c439640cfb5347cc2204975db3158a

            SHA1

            bcccbd1084a6f6c470c8cf1f6e9c2fd3bb5bd7a3

            SHA256

            e3b5210ec758da667bb2410ea33bd59f65d9310e085514548c61bc5f89af25bd

            SHA512

            7f10205c3de90c6a6a4a1b10ed3292e8c91c77dc5dc9e49a6ff17eaad410eaf5e520abeafd20bced012b889814e10bc63ee7910c102195b4957767fe19ff6279