Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
24/12/2023, 21:08
Static task
static1
Behavioral task
behavioral1
Sample
1263aeb7669544ba5c597427740fd55a.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
1263aeb7669544ba5c597427740fd55a.exe
Resource
win10v2004-20231222-en
General
-
Target
1263aeb7669544ba5c597427740fd55a.exe
-
Size
644KB
-
MD5
1263aeb7669544ba5c597427740fd55a
-
SHA1
5d046d9ba0f861fd9f968b2fff565497bd8c453a
-
SHA256
c17663b78f0beb44ce1d50d5385eb6d00712c8abce78942e0cfc4db77df4420f
-
SHA512
9b758e116b8b63b2595310bbfbd1af9a9b3600a8fa586cc256d8f12f68bd0cb29bad2f995b02b876fe1a1a154b4d3808fe45613c247f7442f7643746a80ed6dc
-
SSDEEP
12288:FPyQb80zXZWoqVAZ5qLAZvI5oazdlYGvK7y/nRleafc8vy4h3:FPN80zLfzq025oazw/7cn2386+
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1400 bedfhaijcd.exe -
Loads dropped DLL 2 IoCs
pid Process 1076 1263aeb7669544ba5c597427740fd55a.exe 1076 1263aeb7669544ba5c597427740fd55a.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 2092 1400 WerFault.exe 87 -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 4756 wmic.exe Token: SeSecurityPrivilege 4756 wmic.exe Token: SeTakeOwnershipPrivilege 4756 wmic.exe Token: SeLoadDriverPrivilege 4756 wmic.exe Token: SeSystemProfilePrivilege 4756 wmic.exe Token: SeSystemtimePrivilege 4756 wmic.exe Token: SeProfSingleProcessPrivilege 4756 wmic.exe Token: SeIncBasePriorityPrivilege 4756 wmic.exe Token: SeCreatePagefilePrivilege 4756 wmic.exe Token: SeBackupPrivilege 4756 wmic.exe Token: SeRestorePrivilege 4756 wmic.exe Token: SeShutdownPrivilege 4756 wmic.exe Token: SeDebugPrivilege 4756 wmic.exe Token: SeSystemEnvironmentPrivilege 4756 wmic.exe Token: SeRemoteShutdownPrivilege 4756 wmic.exe Token: SeUndockPrivilege 4756 wmic.exe Token: SeManageVolumePrivilege 4756 wmic.exe Token: 33 4756 wmic.exe Token: 34 4756 wmic.exe Token: 35 4756 wmic.exe Token: 36 4756 wmic.exe Token: SeIncreaseQuotaPrivilege 4756 wmic.exe Token: SeSecurityPrivilege 4756 wmic.exe Token: SeTakeOwnershipPrivilege 4756 wmic.exe Token: SeLoadDriverPrivilege 4756 wmic.exe Token: SeSystemProfilePrivilege 4756 wmic.exe Token: SeSystemtimePrivilege 4756 wmic.exe Token: SeProfSingleProcessPrivilege 4756 wmic.exe Token: SeIncBasePriorityPrivilege 4756 wmic.exe Token: SeCreatePagefilePrivilege 4756 wmic.exe Token: SeBackupPrivilege 4756 wmic.exe Token: SeRestorePrivilege 4756 wmic.exe Token: SeShutdownPrivilege 4756 wmic.exe Token: SeDebugPrivilege 4756 wmic.exe Token: SeSystemEnvironmentPrivilege 4756 wmic.exe Token: SeRemoteShutdownPrivilege 4756 wmic.exe Token: SeUndockPrivilege 4756 wmic.exe Token: SeManageVolumePrivilege 4756 wmic.exe Token: 33 4756 wmic.exe Token: 34 4756 wmic.exe Token: 35 4756 wmic.exe Token: 36 4756 wmic.exe Token: SeIncreaseQuotaPrivilege 3112 wmic.exe Token: SeSecurityPrivilege 3112 wmic.exe Token: SeTakeOwnershipPrivilege 3112 wmic.exe Token: SeLoadDriverPrivilege 3112 wmic.exe Token: SeSystemProfilePrivilege 3112 wmic.exe Token: SeSystemtimePrivilege 3112 wmic.exe Token: SeProfSingleProcessPrivilege 3112 wmic.exe Token: SeIncBasePriorityPrivilege 3112 wmic.exe Token: SeCreatePagefilePrivilege 3112 wmic.exe Token: SeBackupPrivilege 3112 wmic.exe Token: SeRestorePrivilege 3112 wmic.exe Token: SeShutdownPrivilege 3112 wmic.exe Token: SeDebugPrivilege 3112 wmic.exe Token: SeSystemEnvironmentPrivilege 3112 wmic.exe Token: SeRemoteShutdownPrivilege 3112 wmic.exe Token: SeUndockPrivilege 3112 wmic.exe Token: SeManageVolumePrivilege 3112 wmic.exe Token: 33 3112 wmic.exe Token: 34 3112 wmic.exe Token: 35 3112 wmic.exe Token: 36 3112 wmic.exe Token: SeIncreaseQuotaPrivilege 3112 wmic.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 1076 wrote to memory of 1400 1076 1263aeb7669544ba5c597427740fd55a.exe 87 PID 1076 wrote to memory of 1400 1076 1263aeb7669544ba5c597427740fd55a.exe 87 PID 1076 wrote to memory of 1400 1076 1263aeb7669544ba5c597427740fd55a.exe 87 PID 1400 wrote to memory of 4756 1400 bedfhaijcd.exe 89 PID 1400 wrote to memory of 4756 1400 bedfhaijcd.exe 89 PID 1400 wrote to memory of 4756 1400 bedfhaijcd.exe 89 PID 1400 wrote to memory of 3112 1400 bedfhaijcd.exe 95 PID 1400 wrote to memory of 3112 1400 bedfhaijcd.exe 95 PID 1400 wrote to memory of 3112 1400 bedfhaijcd.exe 95 PID 1400 wrote to memory of 4636 1400 bedfhaijcd.exe 96 PID 1400 wrote to memory of 4636 1400 bedfhaijcd.exe 96 PID 1400 wrote to memory of 4636 1400 bedfhaijcd.exe 96 PID 1400 wrote to memory of 3144 1400 bedfhaijcd.exe 98 PID 1400 wrote to memory of 3144 1400 bedfhaijcd.exe 98 PID 1400 wrote to memory of 3144 1400 bedfhaijcd.exe 98 PID 1400 wrote to memory of 2208 1400 bedfhaijcd.exe 100 PID 1400 wrote to memory of 2208 1400 bedfhaijcd.exe 100 PID 1400 wrote to memory of 2208 1400 bedfhaijcd.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\1263aeb7669544ba5c597427740fd55a.exe"C:\Users\Admin\AppData\Local\Temp\1263aeb7669544ba5c597427740fd55a.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\bedfhaijcd.exeC:\Users\Admin\AppData\Local\Temp\bedfhaijcd.exe 9,9,1,1,6,5,8,4,3,2,0 JkdIQzcxKzQdLVNMOU9IPjgoHCxMRUtOTlFFRDw5Lh4vO0BSU0M/NTExMiAmOkhDNysYK01QTztMQlNZRDw5MTQxFyZSRExRPU5cU1JDNGdzbmsyKyxxcm0lQ0RNRiVQTE4tOEdPLUNJPksdLUNDQEJKQz81HCxCMTQrMTAuLSk0HS1EKTQwNCowGCtBMT0kKB8uPi81KS4eLzssPCwrGydMT01ETDpTXkpNQVI+QVk0Fy5PTEo8UUBSXzxMS0A3GydMT01ETDpTXkg8RUE6V29sa3RhXyAqLHNnZFxmJDEqX2dza2pvWFtkcR8tKGxvbSUpJ3UfKUBQQVxTUkM0Hy4/Uz1bQEtEQ0BNRDcbJ0RMUVRWOVFOUU49TjouICZLR0BIRlFLUl1VSUM8HylRRTkvHi87SjA8GipKUUtSSUQ8XlY/RztLSkNJRDhGRE9NRDkdLUlKVlFUSE9BSUI7dGlsZB8pTT1QUlBOQEVGXk9OPU5cQkFQSjwxGipARUFDWDQoHy5DTldAVkxBREBCXj9JO05WTlQ8OzxlW2drYR0tREZOTUtJPDxbRk49KCc2LSsyMCouNzUlKTI4GipMRUpDPSgrMjQxLC8yMzQgJjtOVkhHRz1BXVRAREQ8MSopKy8uMSwhMTksMjIwMyhBRA==2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81703526437.txt bios get serialnumber3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4756
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81703526437.txt bios get version3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3112
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81703526437.txt bios get version3⤵PID:4636
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81703526437.txt bios get version3⤵PID:3144
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81703526437.txt bios get version3⤵PID:2208
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1400 -s 8643⤵
- Program crash
PID:2092
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1400 -ip 14001⤵PID:3512
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
66B
MD59025468f85256136f923096b01375964
SHA17fcd174999661594fa5f88890ffb195e9858cc52
SHA256d5418014fa8e6e17d8992fd12c0dfecac8a34855603ea58133e87ea09c2130df
SHA51292cac37c332e6e276a963d659986a79a79867df44682bfc2d77ed7784ffa5e2c149e5960a83d03ef4cf171be40a73e93a110aaa53b95152fa9a9da6b41d31e51
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
Filesize
58B
MD5dd876faf0fd44a5fab3e82368e2e8b15
SHA101b04083fa278dda3a81705ca5abcfee487a3c90
SHA2565602490a82bcacec8797d25cbb6f643fc9e69f89a2f0e6ec1e8d1f568e77a6b9
SHA512e03d1def5b7fb0ed01a414cead199229ec0e153ff831d3ff5dd36c320572084c56a5e1369c753f868c855455758c0d308941b6187c348051419bd937d014cb8b
-
Filesize
765KB
MD5e82290bcfe26d591c695ba0a97363ea1
SHA171373fe76f71bd683ac5b8e504e4930daec14a77
SHA256cfaa48253219cd7628b8632d8c6c9e03ff37bb776d86c75dbb9afb6f2ef580b7
SHA5127ce35e4086ad81f5b44c9a092ff6ff8fa06765c6fd81afca88bb669bba54b78cdbd2537cce0376592bda1a8bc5f0b4b58a756d1681a928442713f9945d1505ee
-
Filesize
163KB
MD52dc35ddcabcb2b24919b9afae4ec3091
SHA19eeed33c3abc656353a7ebd1c66af38cccadd939
SHA2566bbeb39747f1526752980d4dbec2fe2c7347f3cc983a79c92561b92fe472e7a1
SHA5120ccac336924f684da1f73db2dd230a0c932c5b4115ae1fa0e708b9db5e39d2a07dc54dac8d95881a42069cbb2c2886e880cdad715deda83c0de38757a0f6a901
-
Filesize
166KB
MD5ab2a34b351e64147a9e4e158d1641bcb
SHA12705c0b99f98e910ff6efe8b0dd9679fbeb46387
SHA2566b4e91c163fb195a85c915ff0effd2083983e86a73551f580bf1f602fa9f9826
SHA51219c790e834f217fdfc9733610fe8e6fbc5f912510158646fe37031354149336bfb176feb1ea72a6b0dfd0869ea75d0e47388007ac5c044899cbcb599d1c1441e