Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    122s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    24/12/2023, 20:18

General

  • Target

    106184ffaa10a175498cb643031b9219.exe

  • Size

    581KB

  • MD5

    106184ffaa10a175498cb643031b9219

  • SHA1

    90427987ed6c0f65555118f40d88ff67ed20d0d2

  • SHA256

    6f58bfe1384bd00b751dc149e6481ac8d25c0ba8e7802cfe4ffd0e04a21d91d1

  • SHA512

    5943c25763d13667def495a495b2d8212a5c20ff146def7ba7fc0f957ff626b0cd17ab774825c4a1d28cfde55a0693f80d1cb144284bc545102aca054c3ef74e

  • SSDEEP

    12288:gZYN1dQYFlzCY0sBTy3DUgu0CFWI2bXrsiL7yunEZL7TI6VNt:goplzZ0oeDwXWrDrsiLYZL5N

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 11 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\106184ffaa10a175498cb643031b9219.exe
    "C:\Users\Admin\AppData\Local\Temp\106184ffaa10a175498cb643031b9219.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2668
    • C:\Users\Admin\AppData\Local\Temp\1431788551.exe
      C:\Users\Admin\AppData\Local\Temp\1431788551.exe 3^4^5^7^5^2^1^1^8^4^5 LExEPTgxLzEqHCpQUT1JREI8LxgrSUJQUkhNSUhDNSwbLEBETE9HQzwqMy00LhsoPkdDPCgcKk1OSj1QQVNeQUA4LjI0LRstUkRKUkBPW1BLRztnc2xsNSwrbmtxLENES0coUUtLJjxOTy1BSkFMHCo8R0dCSkFAOHRJPTwtTDdGOjBELiwzMkZFR0gpPz0+SRsoPy88MCksMzEcKj0tOywwGCs/MDkoKhstQzM1KSwdKz8uOCswHydMTUxAUDxPXU9RQVI8QFU4GSpOUU48UT5RW0BORz88HydMTUxAUDxPXU1ARUE4HStAUUBdVFFEORssQVM+WkFMQ0RFSUI5GyhDTVJTVz5NTFNOPk07Lx8nUEM+SkZSSlNeVEpIOB0rUUY4MB8uPE8sOhwqS1BMU0hFQVpUQUc8SktESEU9QkJRTUU4Hi5IS1tNUkpPQkhDPHNqcWAdK00+T1NRTUFKQlxRTj5NXUNAUU84LxwqQURCRFc1LRssRU5YP1dNQEVFPlxBSTxNV09TPUA4Y11nbGAeLkNHU0lJSzw9WkdPPC4yKS4sLSczLDEvMRwqUUVIPjgvMzIpMzQvNSsrGy1DTk9KR0w9P1hPR0xENTEqLjIqKysvNCksNiwyNisrJU5MHydRPDpJanNkamtgHS5hMiorJCNVaG1ca3JwJ0lNJjQtMB0vXShQbWJfY21zHS5hNCorHi5gKnFuIS5eLSwnKycqa2FnYChDYFxmbR8uTU5HOmRvbWsjMmAdLmEiLmFgYHIwLSgtLC5gYGxkZW0tYWphbCEtX01zbVNhaWBBa3JnZ21gY0VdaV5jYGtaYmRvZGt0Ii5hKi8xMDYxLjQtLyArYWJudmZoal5gaFppX2ZkaiEtYy0vLCw1ODExLC4iL2ExNDQ0MjEuMS0tMVEsdnRSYk1tTVNqMkhnbnBDTz1jS2RkLEpDYnBFQk4sRnNAMEp4SmtLUDRiUT5lMks7MGlLZS9mVHd2MEI/bmVVTmgySHlEZFRkdCxFcnJoVnlFL0dRPWJRaEBsWD9wVF4tMzJeajhyWkNqZVVCR2lWVnNnVGVTcU1zLD9KVG91TS1BcEpOZXBMclY+T1FFQ0hCLzVHQV5lVmdpb19DL3A=
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:2824
      • C:\Windows\SysWOW64\Wbem\wmic.exe
        wmic /output:C:\Users\Admin\AppData\Local\Temp\81703515466.txt bios get serialnumber
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2736
      • C:\Windows\SysWOW64\Wbem\wmic.exe
        wmic /output:C:\Users\Admin\AppData\Local\Temp\81703515466.txt bios get version
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2960
      • C:\Windows\SysWOW64\Wbem\wmic.exe
        wmic /output:C:\Users\Admin\AppData\Local\Temp\81703515466.txt bios get version
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2584
      • C:\Windows\SysWOW64\Wbem\wmic.exe
        wmic /output:C:\Users\Admin\AppData\Local\Temp\81703515466.txt bios get version
        3⤵
          PID:2664
        • C:\Windows\SysWOW64\Wbem\wmic.exe
          wmic /output:C:\Users\Admin\AppData\Local\Temp\81703515466.txt bios get version
          3⤵
            PID:756
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2824 -s 372
            3⤵
            • Loads dropped DLL
            • Program crash
            PID:2932

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\81703515466.txt

        Filesize

        66B

        MD5

        9025468f85256136f923096b01375964

        SHA1

        7fcd174999661594fa5f88890ffb195e9858cc52

        SHA256

        d5418014fa8e6e17d8992fd12c0dfecac8a34855603ea58133e87ea09c2130df

        SHA512

        92cac37c332e6e276a963d659986a79a79867df44682bfc2d77ed7784ffa5e2c149e5960a83d03ef4cf171be40a73e93a110aaa53b95152fa9a9da6b41d31e51

      • \Users\Admin\AppData\Local\Temp\1431788551.exe

        Filesize

        788KB

        MD5

        34999992f71f7b404a67bcc00ba29a41

        SHA1

        5c786fa73c3f627b3661a97b9fd46d50ffd6a0bd

        SHA256

        65b7d7fa04ed6401ad3e051575baf3ce489f3f66c8e954b4c08dc59fdbd7b77e

        SHA512

        60602f4862743558886cea5b8b732e67b9a78c3076f090e209bcbcf3fd97ae8ae9747fbbd8487f9750ad1de6d50491ca5ce9b16cf38ef845a9a7ed720464ad13

      • \Users\Admin\AppData\Local\Temp\1431788551.exe

        Filesize

        745KB

        MD5

        973a822c82fccb500d79c557f5f1b657

        SHA1

        3d829eab8189917c12e69447eb05bd4621086773

        SHA256

        98ae8bccc0109a2630c664ffb4674e99118579226eeefffa84cb01d9f67eb387

        SHA512

        fd266bbe1c0a174effd7924eb4ba23cec5c6ccf83eb188dfceefe615540891d1d42082f56e0a4d3c5b7a97b60db4e4d230fc6ba0d036fba89d7dbe4ad1f72f0a

      • \Users\Admin\AppData\Local\Temp\1431788551.exe

        Filesize

        637KB

        MD5

        d3eb92c56edf7ca8ff9b9ec3928808ef

        SHA1

        6eea06316837fd2d3f196159991baf50052e5436

        SHA256

        b9bb0a96bff763f450b001554c9b340514d79a86b310dbbeb6fd15ea828a9ece

        SHA512

        170c7302554c0ec66d7e73f041c02a3f5221407bd63fab99f07cf410eccac9dcf55db873b26569693f17b7acb108f43280e143c81abb1caebca713a12284efde

      • \Users\Admin\AppData\Local\Temp\1431788551.exe

        Filesize

        624KB

        MD5

        5bfa17a214dd60c2de25d83eb49a7b0c

        SHA1

        5d9fc511297580acc73eb7358b572143716159fd

        SHA256

        c0fa551ce81207b4373f7ac1f7741d26d1c07501ce69b5ab0c752c818fa4bdf4

        SHA512

        2bad046d6eb3792734588f90d58d501d19de08a065061d889d7de4c1cf2066480917e326bb0a38ebd6ad06c1d98d90340bd442e3dc77e000b6bd34904012c086

      • \Users\Admin\AppData\Local\Temp\1431788551.exe

        Filesize

        461KB

        MD5

        3e50ac0afcc5978f61d9c10f25a6a18c

        SHA1

        aded63d2fe46da725becaa380f8c5f29f571cec8

        SHA256

        2567b92a402c2f372cf5a8d926fac1e0bd9ea1239397d79c786db084e0a5302a

        SHA512

        3989cfb9ba9474e57e301acbc999c17fac61286e70f7a979dddba9d93084001811d16dd5dfa65d6a8086cde9ef430e11428a9ba165aec1a7a1e3357fbaf15d63

      • \Users\Admin\AppData\Local\Temp\1431788551.exe

        Filesize

        462KB

        MD5

        df3e1d2a070dc8453c722c9d77e24e25

        SHA1

        21536c2486c2a50f62770418976db80b00ee0f41

        SHA256

        8ce16138839d9dec358b5b2c4e845a6380d2d7c70383ff0f4dd5d0be7ee7a24f

        SHA512

        d188db31b5ea6bf6fb5a3f1d8a9358c358608f0f43f7f8509d495bd959b657dacf89facdccd361cfb4e8cd2c83cb992e4fbb8462ef2f4d398da9f0ff534854d0

      • \Users\Admin\AppData\Local\Temp\1431788551.exe

        Filesize

        457KB

        MD5

        6ab60587f809c1f1304aa5832ee160e4

        SHA1

        613f8c6e3f8a2c32340d02fdbbf6f04487401ea8

        SHA256

        618006968f86f59db53f8d7dd3f22ec99f871c9bf3bda8e239d8b788f3a35a8d

        SHA512

        df5afb843a89b8ddf7130a0eadae6683788c96ace6dbfb59e4e3ca1ca12671fc53a9b56c3d31f456683989b243d43c3f907ff46ae905e393f20697f35fd7be9d

      • \Users\Admin\AppData\Local\Temp\1431788551.exe

        Filesize

        171KB

        MD5

        3e8d2606d0cc23100e75933c8d76b0a3

        SHA1

        f67188931085f5d8ce504ee50669031acb43d80a

        SHA256

        a1e34e5b44c37f8eed6d29511aa360deafccca3778f482ec00a4ad4176509ed4

        SHA512

        a1ab2b89a5c2fc6cd253eedb6227a6835a5119b1303c5f7125fba263fdee5249d00ab01693e5946a471b2085a04bca978c9e541b1c35df143a14131404899541

      • \Users\Admin\AppData\Local\Temp\nsi3083.tmp\ibcdrur.dll

        Filesize

        153KB

        MD5

        cc7702c331fd2b2201d356a02401e5bc

        SHA1

        11cd196fd5b3c11de259da2c8ccc3a5d9161c09a

        SHA256

        3516da154df6fe34fd628e20df3e2a71ffe7d6795cb2f481869ab475f69d9291

        SHA512

        7bdb51b6032d9dbd418b74e48aede845a537ed13ee50f7019289d041b1de72966db88545cfabc48ebef72e7b881faed2cb180544bce43eb6e48ba9fe67a34653

      • \Users\Admin\AppData\Local\Temp\nsi3083.tmp\nsisunz.dll

        Filesize

        40KB

        MD5

        5f13dbc378792f23e598079fc1e4422b

        SHA1

        5813c05802f15930aa860b8363af2b58426c8adf

        SHA256

        6e87ecb7f62039fbb6e7676422d1a5e75a32b90dde6865dcb68ee658ba8df61d

        SHA512

        9270635a5294482f49e0292e26d45dd103b85fe27dc163d44531b095c5f9dbde6b904adaf1a888ba3c112a094380394713c796f5195b2566a20f00b42b6578e5