Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25/12/2023, 08:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1264851a7dfc2ac1c4a21132646a279b.exe
Resource
win7-20231215-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
1264851a7dfc2ac1c4a21132646a279b.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
1264851a7dfc2ac1c4a21132646a279b.exe
-
Size
975KB
-
MD5
1264851a7dfc2ac1c4a21132646a279b
-
SHA1
679a364d6366bd86d12fc3ca252595c13d10694e
-
SHA256
11ba4bb45bf8b6ca4f1e4d3fc6740912385ef3ca587b5e482e720cc7bf7a94bc
-
SHA512
d14bd7ca1c6e09d936567d543ab4c54c6c28b889cc210b5144e596f7b7397b6fa127485b4062cdd791d3003e8b46904c1288d26a371f99be2bdb829863f12d67
-
SSDEEP
24576:loheA/Lz7PFVke3dv6FfajLAf0DmKbfKy5mZr:uheA/LPPFVk0vy6EcDLyyEZr
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2304 f.exe -
Loads dropped DLL 9 IoCs
pid Process 2036 1264851a7dfc2ac1c4a21132646a279b.exe 2036 1264851a7dfc2ac1c4a21132646a279b.exe 2876 WerFault.exe 2876 WerFault.exe 2876 WerFault.exe 2876 WerFault.exe 2876 WerFault.exe 2876 WerFault.exe 2876 WerFault.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 2876 2304 WerFault.exe 29 -
Modifies registry class 34 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}\TypeLib f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0\HELPDIR f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\ProxyStubClsid32 f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534} f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\TypeLib\Version = "1.0" f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}\TypeLib\ = "{03771AEF-400D-4A13-B712-25878EC4A3F5}" f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\TypeLib f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}\Version\ = "1.0" f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5} f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp" f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\ = "IBrowserExternals" f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\TypeLib\Version = "1.0" f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\ProxyStubClsid32 f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0\0\win32 f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\TypeLib\ = "{03771AEF-400D-4A13-B712-25878EC4A3F5}" f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}\ = "CBrowserExternal Class" f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}\Programmable f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\f.exe\"" f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}\Version f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0 f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0\0 f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\TypeLib\ = "{03771AEF-400D-4A13-B712-25878EC4A3F5}" f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982} f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}\LocalServer32 f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0\ = "SmartInstallerLib" f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0\FLAGS\ = "0" f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534} f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0\FLAGS f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\f.exe" f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\ = "IBrowserExternals" f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}\LocalServer32\ServerExecutable = "C:\\Users\\Admin\\AppData\\Local\\Temp\\f.exe" f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\TypeLib f.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2712 wmic.exe Token: SeSecurityPrivilege 2712 wmic.exe Token: SeTakeOwnershipPrivilege 2712 wmic.exe Token: SeLoadDriverPrivilege 2712 wmic.exe Token: SeSystemProfilePrivilege 2712 wmic.exe Token: SeSystemtimePrivilege 2712 wmic.exe Token: SeProfSingleProcessPrivilege 2712 wmic.exe Token: SeIncBasePriorityPrivilege 2712 wmic.exe Token: SeCreatePagefilePrivilege 2712 wmic.exe Token: SeBackupPrivilege 2712 wmic.exe Token: SeRestorePrivilege 2712 wmic.exe Token: SeShutdownPrivilege 2712 wmic.exe Token: SeDebugPrivilege 2712 wmic.exe Token: SeSystemEnvironmentPrivilege 2712 wmic.exe Token: SeRemoteShutdownPrivilege 2712 wmic.exe Token: SeUndockPrivilege 2712 wmic.exe Token: SeManageVolumePrivilege 2712 wmic.exe Token: 33 2712 wmic.exe Token: 34 2712 wmic.exe Token: 35 2712 wmic.exe Token: SeIncreaseQuotaPrivilege 2712 wmic.exe Token: SeSecurityPrivilege 2712 wmic.exe Token: SeTakeOwnershipPrivilege 2712 wmic.exe Token: SeLoadDriverPrivilege 2712 wmic.exe Token: SeSystemProfilePrivilege 2712 wmic.exe Token: SeSystemtimePrivilege 2712 wmic.exe Token: SeProfSingleProcessPrivilege 2712 wmic.exe Token: SeIncBasePriorityPrivilege 2712 wmic.exe Token: SeCreatePagefilePrivilege 2712 wmic.exe Token: SeBackupPrivilege 2712 wmic.exe Token: SeRestorePrivilege 2712 wmic.exe Token: SeShutdownPrivilege 2712 wmic.exe Token: SeDebugPrivilege 2712 wmic.exe Token: SeSystemEnvironmentPrivilege 2712 wmic.exe Token: SeRemoteShutdownPrivilege 2712 wmic.exe Token: SeUndockPrivilege 2712 wmic.exe Token: SeManageVolumePrivilege 2712 wmic.exe Token: 33 2712 wmic.exe Token: 34 2712 wmic.exe Token: 35 2712 wmic.exe Token: SeIncreaseQuotaPrivilege 2608 wmic.exe Token: SeSecurityPrivilege 2608 wmic.exe Token: SeTakeOwnershipPrivilege 2608 wmic.exe Token: SeLoadDriverPrivilege 2608 wmic.exe Token: SeSystemProfilePrivilege 2608 wmic.exe Token: SeSystemtimePrivilege 2608 wmic.exe Token: SeProfSingleProcessPrivilege 2608 wmic.exe Token: SeIncBasePriorityPrivilege 2608 wmic.exe Token: SeCreatePagefilePrivilege 2608 wmic.exe Token: SeBackupPrivilege 2608 wmic.exe Token: SeRestorePrivilege 2608 wmic.exe Token: SeShutdownPrivilege 2608 wmic.exe Token: SeDebugPrivilege 2608 wmic.exe Token: SeSystemEnvironmentPrivilege 2608 wmic.exe Token: SeRemoteShutdownPrivilege 2608 wmic.exe Token: SeUndockPrivilege 2608 wmic.exe Token: SeManageVolumePrivilege 2608 wmic.exe Token: 33 2608 wmic.exe Token: 34 2608 wmic.exe Token: 35 2608 wmic.exe Token: SeIncreaseQuotaPrivilege 2608 wmic.exe Token: SeSecurityPrivilege 2608 wmic.exe Token: SeTakeOwnershipPrivilege 2608 wmic.exe Token: SeLoadDriverPrivilege 2608 wmic.exe -
Suspicious use of WriteProcessMemory 31 IoCs
description pid Process procid_target PID 2036 wrote to memory of 2304 2036 1264851a7dfc2ac1c4a21132646a279b.exe 29 PID 2036 wrote to memory of 2304 2036 1264851a7dfc2ac1c4a21132646a279b.exe 29 PID 2036 wrote to memory of 2304 2036 1264851a7dfc2ac1c4a21132646a279b.exe 29 PID 2036 wrote to memory of 2304 2036 1264851a7dfc2ac1c4a21132646a279b.exe 29 PID 2036 wrote to memory of 2304 2036 1264851a7dfc2ac1c4a21132646a279b.exe 29 PID 2036 wrote to memory of 2304 2036 1264851a7dfc2ac1c4a21132646a279b.exe 29 PID 2036 wrote to memory of 2304 2036 1264851a7dfc2ac1c4a21132646a279b.exe 29 PID 2304 wrote to memory of 2712 2304 f.exe 28 PID 2304 wrote to memory of 2712 2304 f.exe 28 PID 2304 wrote to memory of 2712 2304 f.exe 28 PID 2304 wrote to memory of 2712 2304 f.exe 28 PID 2304 wrote to memory of 2608 2304 f.exe 33 PID 2304 wrote to memory of 2608 2304 f.exe 33 PID 2304 wrote to memory of 2608 2304 f.exe 33 PID 2304 wrote to memory of 2608 2304 f.exe 33 PID 2304 wrote to memory of 2684 2304 f.exe 35 PID 2304 wrote to memory of 2684 2304 f.exe 35 PID 2304 wrote to memory of 2684 2304 f.exe 35 PID 2304 wrote to memory of 2684 2304 f.exe 35 PID 2304 wrote to memory of 1152 2304 f.exe 39 PID 2304 wrote to memory of 1152 2304 f.exe 39 PID 2304 wrote to memory of 1152 2304 f.exe 39 PID 2304 wrote to memory of 1152 2304 f.exe 39 PID 2304 wrote to memory of 2540 2304 f.exe 37 PID 2304 wrote to memory of 2540 2304 f.exe 37 PID 2304 wrote to memory of 2540 2304 f.exe 37 PID 2304 wrote to memory of 2540 2304 f.exe 37 PID 2304 wrote to memory of 2876 2304 f.exe 40 PID 2304 wrote to memory of 2876 2304 f.exe 40 PID 2304 wrote to memory of 2876 2304 f.exe 40 PID 2304 wrote to memory of 2876 2304 f.exe 40
Processes
-
C:\Users\Admin\AppData\Local\Temp\1264851a7dfc2ac1c4a21132646a279b.exe"C:\Users\Admin\AppData\Local\Temp\1264851a7dfc2ac1c4a21132646a279b.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\f.exeC:\Users\Admin\AppData\Local\Temp\f.exe /PID=3005 /SUBPID=0 /DISTID=1775 /NETWORKID=0 /CID=0 /PRODUCT_ID=1694 /SERVER_URL=http://installer.apps-track.com /CLICKID=a045507d1dda655e7a4bc4d4a3e2af02 /D1=24131 /D2=-1 /D3=-1 /D4=-1 /D5=-1 /PRODUCT_NAME= /PRODUCT_EULA= /PRODUCT_PRIVACY= /EXE_URL= /EXE_CMDLINE= /HOST_BROWSER=2 /IS_RUNTIME=true /THANKYOU_URL= /RETURNING_USER_DAYS=2 /VM=22⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\obhhelper.txt bios get version3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2608
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\obhhelper.txt bios get version3⤵PID:2684
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\obhhelper.txt bios get version3⤵PID:2540
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\obhhelper.txt bios get version3⤵PID:1152
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2304 -s 3723⤵
- Loads dropped DLL
- Program crash
PID:2876
-
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\obhhelper.txt bios get serialnumber1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2712