Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
24/12/2023, 16:18
Static task
static1
Behavioral task
behavioral1
Sample
05526cc5eaf0401d9eb6a42e4c085352.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
05526cc5eaf0401d9eb6a42e4c085352.exe
Resource
win10v2004-20231215-en
General
-
Target
05526cc5eaf0401d9eb6a42e4c085352.exe
-
Size
684KB
-
MD5
05526cc5eaf0401d9eb6a42e4c085352
-
SHA1
a0b4bc7c112e2ebee618335fc69fbbb177029ab0
-
SHA256
48d0d379a7ef0a457545673807c7e689c1845aec6bf781b115788967b79ef7fe
-
SHA512
fafe575e0611271019cafb6f27f84ab1dca325d33b06982b789df2dbf5b217e6d176bc9dbcec81d9dea3cef4b5d617fa206d03c420b14fee6a01ec3b6a89175a
-
SSDEEP
12288:t+/O3rxp6wUwlKfkPiiinSLxx9YUBXlI1g45I0s8S/VC0Afc8vy4hb:t+Mp6OvxxKUW34n40V86G
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 4688 bedfgbbhcd.exe -
Loads dropped DLL 2 IoCs
pid Process 3356 05526cc5eaf0401d9eb6a42e4c085352.exe 3356 05526cc5eaf0401d9eb6a42e4c085352.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 3212 4688 WerFault.exe 89 -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1836 wmic.exe Token: SeSecurityPrivilege 1836 wmic.exe Token: SeTakeOwnershipPrivilege 1836 wmic.exe Token: SeLoadDriverPrivilege 1836 wmic.exe Token: SeSystemProfilePrivilege 1836 wmic.exe Token: SeSystemtimePrivilege 1836 wmic.exe Token: SeProfSingleProcessPrivilege 1836 wmic.exe Token: SeIncBasePriorityPrivilege 1836 wmic.exe Token: SeCreatePagefilePrivilege 1836 wmic.exe Token: SeBackupPrivilege 1836 wmic.exe Token: SeRestorePrivilege 1836 wmic.exe Token: SeShutdownPrivilege 1836 wmic.exe Token: SeDebugPrivilege 1836 wmic.exe Token: SeSystemEnvironmentPrivilege 1836 wmic.exe Token: SeRemoteShutdownPrivilege 1836 wmic.exe Token: SeUndockPrivilege 1836 wmic.exe Token: SeManageVolumePrivilege 1836 wmic.exe Token: 33 1836 wmic.exe Token: 34 1836 wmic.exe Token: 35 1836 wmic.exe Token: 36 1836 wmic.exe Token: SeIncreaseQuotaPrivilege 1836 wmic.exe Token: SeSecurityPrivilege 1836 wmic.exe Token: SeTakeOwnershipPrivilege 1836 wmic.exe Token: SeLoadDriverPrivilege 1836 wmic.exe Token: SeSystemProfilePrivilege 1836 wmic.exe Token: SeSystemtimePrivilege 1836 wmic.exe Token: SeProfSingleProcessPrivilege 1836 wmic.exe Token: SeIncBasePriorityPrivilege 1836 wmic.exe Token: SeCreatePagefilePrivilege 1836 wmic.exe Token: SeBackupPrivilege 1836 wmic.exe Token: SeRestorePrivilege 1836 wmic.exe Token: SeShutdownPrivilege 1836 wmic.exe Token: SeDebugPrivilege 1836 wmic.exe Token: SeSystemEnvironmentPrivilege 1836 wmic.exe Token: SeRemoteShutdownPrivilege 1836 wmic.exe Token: SeUndockPrivilege 1836 wmic.exe Token: SeManageVolumePrivilege 1836 wmic.exe Token: 33 1836 wmic.exe Token: 34 1836 wmic.exe Token: 35 1836 wmic.exe Token: 36 1836 wmic.exe Token: SeIncreaseQuotaPrivilege 3624 wmic.exe Token: SeSecurityPrivilege 3624 wmic.exe Token: SeTakeOwnershipPrivilege 3624 wmic.exe Token: SeLoadDriverPrivilege 3624 wmic.exe Token: SeSystemProfilePrivilege 3624 wmic.exe Token: SeSystemtimePrivilege 3624 wmic.exe Token: SeProfSingleProcessPrivilege 3624 wmic.exe Token: SeIncBasePriorityPrivilege 3624 wmic.exe Token: SeCreatePagefilePrivilege 3624 wmic.exe Token: SeBackupPrivilege 3624 wmic.exe Token: SeRestorePrivilege 3624 wmic.exe Token: SeShutdownPrivilege 3624 wmic.exe Token: SeDebugPrivilege 3624 wmic.exe Token: SeSystemEnvironmentPrivilege 3624 wmic.exe Token: SeRemoteShutdownPrivilege 3624 wmic.exe Token: SeUndockPrivilege 3624 wmic.exe Token: SeManageVolumePrivilege 3624 wmic.exe Token: 33 3624 wmic.exe Token: 34 3624 wmic.exe Token: 35 3624 wmic.exe Token: 36 3624 wmic.exe Token: SeIncreaseQuotaPrivilege 3624 wmic.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 3356 wrote to memory of 4688 3356 05526cc5eaf0401d9eb6a42e4c085352.exe 89 PID 3356 wrote to memory of 4688 3356 05526cc5eaf0401d9eb6a42e4c085352.exe 89 PID 3356 wrote to memory of 4688 3356 05526cc5eaf0401d9eb6a42e4c085352.exe 89 PID 4688 wrote to memory of 1836 4688 bedfgbbhcd.exe 91 PID 4688 wrote to memory of 1836 4688 bedfgbbhcd.exe 91 PID 4688 wrote to memory of 1836 4688 bedfgbbhcd.exe 91 PID 4688 wrote to memory of 3624 4688 bedfgbbhcd.exe 94 PID 4688 wrote to memory of 3624 4688 bedfgbbhcd.exe 94 PID 4688 wrote to memory of 3624 4688 bedfgbbhcd.exe 94 PID 4688 wrote to memory of 2092 4688 bedfgbbhcd.exe 96 PID 4688 wrote to memory of 2092 4688 bedfgbbhcd.exe 96 PID 4688 wrote to memory of 2092 4688 bedfgbbhcd.exe 96 PID 4688 wrote to memory of 336 4688 bedfgbbhcd.exe 98 PID 4688 wrote to memory of 336 4688 bedfgbbhcd.exe 98 PID 4688 wrote to memory of 336 4688 bedfgbbhcd.exe 98 PID 4688 wrote to memory of 4760 4688 bedfgbbhcd.exe 100 PID 4688 wrote to memory of 4760 4688 bedfgbbhcd.exe 100 PID 4688 wrote to memory of 4760 4688 bedfgbbhcd.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\05526cc5eaf0401d9eb6a42e4c085352.exe"C:\Users\Admin\AppData\Local\Temp\05526cc5eaf0401d9eb6a42e4c085352.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3356 -
C:\Users\Admin\AppData\Local\Temp\bedfgbbhcd.exeC:\Users\Admin\AppData\Local\Temp\bedfgbbhcd.exe 7|8|9|1|9|4|3|4|4|0|7 KEhAQzQvLS4uIChMTTlPQEA6LBwvRz5MTk5JR0ZAOTAZKDxAUktFQTkuMCsyLxcuOkVBOSwgKElKRkNMP1FbRUQ2Ki4wMxcrUEFOVj5LV0xRQzllcHBwMygnanFtKkFBT0smTUdHLDhMTSpFTj9IGCZCQ0VAR0VENnApREc8LzJLNEJKRTw+QEMsQUY/MU8+KBcuOy06LS0wKSoYJkMpOSotHC89LDUkMBcrQTA5LSoZJzs0NCkuHCtQS0g8TEJLW01ORVY6PFE0HyZMT0tAVTxNVzxUQz06HCtQS0g8TEJLW0s9SUU2GSc8VzxbUk5IPRkoPU9EVj9KQEhJRz41Fy4/S1BQW0JLSE9KREk5LRwrVEE6RkJYRlFcUU5MNhknTUw0Lh0rQFMqNhgmUUxKUUVJRVhQPUNCRklCRUlBQD5NSUs0HCxFT19LTkZLSERBOnBudV4ZJ0lES1FPSkVOQFhNSkRJW0E9VVM2KxgmR0BAQlQ5MRkoQUpeO1VLPUlJPFg9RUJJVU1QQUQ2X1ljclwcLEBLV0dFRzhDVkVNOTA2JyssKS0oLi8qLTMxGSdLSERBOi0wMy4vKiozLTIdK0BPUEdERkA7W1FFSUU2LycqLyYuLS0xKiorMig2MTAzJj1N2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81703441391.txt bios get serialnumber3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1836
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81703441391.txt bios get version3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3624
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81703441391.txt bios get version3⤵PID:2092
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81703441391.txt bios get version3⤵PID:336
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81703441391.txt bios get version3⤵PID:4760
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 9683⤵
- Program crash
PID:3212
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4688 -ip 46881⤵PID:2192
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
66B
MD59025468f85256136f923096b01375964
SHA17fcd174999661594fa5f88890ffb195e9858cc52
SHA256d5418014fa8e6e17d8992fd12c0dfecac8a34855603ea58133e87ea09c2130df
SHA51292cac37c332e6e276a963d659986a79a79867df44682bfc2d77ed7784ffa5e2c149e5960a83d03ef4cf171be40a73e93a110aaa53b95152fa9a9da6b41d31e51
-
Filesize
58B
MD5dd876faf0fd44a5fab3e82368e2e8b15
SHA101b04083fa278dda3a81705ca5abcfee487a3c90
SHA2565602490a82bcacec8797d25cbb6f643fc9e69f89a2f0e6ec1e8d1f568e77a6b9
SHA512e03d1def5b7fb0ed01a414cead199229ec0e153ff831d3ff5dd36c320572084c56a5e1369c753f868c855455758c0d308941b6187c348051419bd937d014cb8b
-
Filesize
837KB
MD5962619197b6c072a19613921948ffbf7
SHA15fb4aaf40a33313d2ae40242827af73ea047bcd1
SHA2562e2bf964766f65ae441f7e881b85e2071ffd651d455d2e8dda56e1f944384e6f
SHA5121eae0b79415ae67fbb1809c593b341f3a6e1f5101e49e02d315ce3664bc3053f9a59c64d651ea6d856c891ff77cb69c3ff438f8e6cd78bbcbf8ae533f92edbd1
-
Filesize
163KB
MD52dc35ddcabcb2b24919b9afae4ec3091
SHA19eeed33c3abc656353a7ebd1c66af38cccadd939
SHA2566bbeb39747f1526752980d4dbec2fe2c7347f3cc983a79c92561b92fe472e7a1
SHA5120ccac336924f684da1f73db2dd230a0c932c5b4115ae1fa0e708b9db5e39d2a07dc54dac8d95881a42069cbb2c2886e880cdad715deda83c0de38757a0f6a901
-
Filesize
166KB
MD5325c5aa21295b68547ace59c016c7909
SHA16688685e8705fdac45372911e01a68835802f786
SHA2562c5f4a8e9d8d6296c26625e8f1184452abbf1f6a5808fc4c6809595f72a8594b
SHA5124e5c2646f4541156ee7691e9a4e19c6710c90722f834cea44108f0ce77ba5aae032c0ec2ef6f7a30b8b4cbb2d551e96939473f642aba283db1ac09d59b86711d