Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/12/2023, 08:50

General

  • Target

    131f035b4cbb42fc062567f831a90c08.exe

  • Size

    677KB

  • MD5

    131f035b4cbb42fc062567f831a90c08

  • SHA1

    5cfa103dadf4c032ee742f198da0533589192b88

  • SHA256

    74b47c5a88ee2144a368e0103ff934ecd3b8a804c9ac979d578d3ce151d40642

  • SHA512

    b234c7b0ae1206839be7afd87c79b82325a7b54a770a25fea219dde0d67b5c452cc5ef3a32152dd1377d3c88183ae1788b8ca1e7b89a0e53b7b57a5563efba1e

  • SSDEEP

    12288:sMiTU0FxrFZYzMwnCVtJw5D6cFrbItNyc+vIkhXtxuuUMi1cwoGRL:sV40oYlw5knYIOtxuuIoGN

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\131f035b4cbb42fc062567f831a90c08.exe
    "C:\Users\Admin\AppData\Local\Temp\131f035b4cbb42fc062567f831a90c08.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:4004
    • C:\Users\Admin\AppData\Local\Temp\1432069282.exe
      C:\Users\Admin\AppData\Local\Temp\1432069282.exe 9/7/7/7/1/0/5/1/8/3/1 JklCPTwzKzEqHS5KTjtJSEQ4LxgsTTxNUEhRS0RDNS0fJj1CTFNJPzwqLTEwMBkoQkk/PCgdLkdLSD1UQ09eQUE8KC8yLR8vTkRKU0RJWE5LSz1jc2xtOSYobGt1Lj9ES0gsS0hJJkBQSy1BS0VGGSg8S0k+SkFBPG4/QkRFQjQwKjNNQSorQEhHSC8rLkouPhkoQzE4Mi4yMywrGShDMjgsKR0uOyw2JjAgKkMsOiwoGSg9ND0oMBgsT0lIPU5CVFpPSkZVODxSNh8vS1FHQVQ6TVg+VEw8PBgsT0lIPU5CVFpNOUpENBkoPldFWlRKSTwXKD5RRF8+TDxJSEU+NhkuSEpSTFxBSUhQTERSODIYLFM/OkdEWE9QXk1PSzQZKE9MPS0fJ0FSKDYZKFFVSVNBSkRWUD5FQk9IREFKQD4+TktLPRsuQVBeSU5HTUhNQDxsb3RcGShLRFRQUUZGTT5YTkxEUlpDOVZSNCsZKEdJP0RQOjAXKEJMXkRUTTlKSDpYPkdCUlRPTEJDNF9aZXJlGy48TFZFRUg6Q19ETzUuNi0nKjI0Liw0LSswLyoZKFNJSEQ1LjMqKykwNDEyNxgsQ0ZQR0VOQT9eTEZMPDYuKDA5KjEoLjQhKikzMjk1MjAnT0QZKE5APUpvXW9gHCtfMi04KyogVGhlXWhwcitJUyMzLSgeLFsqRV9obGZuZSQ9a2h2YHFIXmJiIiRJcWVuc2ciMV0rJyoxLi43MChVXGtsYm5uIDFeLjElKi8ZLlVNSzVlc2tpHixgJS1lHS9lXl5tKi0wLDApYWRqYmBnLWlpZWciMV1LbmdTaWhkPGx2ZWVoWmNNXG1ZZGRpWF1eb2xqeB0vZSgtLCsvNzAwMC4kKV9daHZuZ25ZYWxYZ1pgZHIgMV4uMyorKTA0MTMwHTBlJysxLzU1LzMtLzdRK0dsSnpENVpBamxFYmh4SkF2K0lCam5HTUhrVUMoc0thRm5CVm8wSnFPYkRNbGtMQzN1RVAzX1JiaDhLdGpfVWgrLkRMdmtTQ0k0SUpsYFF5RTBKOzVkUWZdZFcyY2JZVEQrXE8qL2MtZl9VVltlUStZblNDKS5PYkc/SlM0LEs8PnRLZGBpS0VBREktamlGTGVLTk8vX1YwLGtaY2Z3
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:3096
      • C:\Windows\SysWOW64\Wbem\wmic.exe
        wmic /output:C:\Users\Admin\AppData\Local\Temp\81703543077.txt bios get serialnumber
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2172
      • C:\Windows\SysWOW64\Wbem\wmic.exe
        wmic /output:C:\Users\Admin\AppData\Local\Temp\81703543077.txt bios get version
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4372
      • C:\Windows\SysWOW64\Wbem\wmic.exe
        wmic /output:C:\Users\Admin\AppData\Local\Temp\81703543077.txt bios get version
        3⤵
          PID:4644
        • C:\Windows\SysWOW64\Wbem\wmic.exe
          wmic /output:C:\Users\Admin\AppData\Local\Temp\81703543077.txt bios get version
          3⤵
            PID:928
          • C:\Windows\SysWOW64\Wbem\wmic.exe
            wmic /output:C:\Users\Admin\AppData\Local\Temp\81703543077.txt bios get version
            3⤵
              PID:1348
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 3096 -s 916
              3⤵
              • Program crash
              PID:4472
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3096 -ip 3096
          1⤵
            PID:952

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\1432069282.exe

            Filesize

            1021KB

            MD5

            1694becfd0e46f7f04f607f0ce364d1c

            SHA1

            cdde5a9ca3510f49549858d7a6b94766e0095bb7

            SHA256

            e4cc1342b0a515f757f10e11377d647de35318d0ebf1e438b7a627c1a155421f

            SHA512

            f0621e587ff4420be3a34bc5013c61ae202cb9f341d26fa25c3283a933892575e48d7747fdaaa397822e0091ce45de14c5c4d163a780fb16e5ea6aa189ccf382

          • C:\Users\Admin\AppData\Local\Temp\81703543077.txt

            Filesize

            66B

            MD5

            9025468f85256136f923096b01375964

            SHA1

            7fcd174999661594fa5f88890ffb195e9858cc52

            SHA256

            d5418014fa8e6e17d8992fd12c0dfecac8a34855603ea58133e87ea09c2130df

            SHA512

            92cac37c332e6e276a963d659986a79a79867df44682bfc2d77ed7784ffa5e2c149e5960a83d03ef4cf171be40a73e93a110aaa53b95152fa9a9da6b41d31e51

          • C:\Users\Admin\AppData\Local\Temp\81703543077.txt

            Filesize

            2B

            MD5

            f3b25701fe362ec84616a93a45ce9998

            SHA1

            d62636d8caec13f04e28442a0a6fa1afeb024bbb

            SHA256

            b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

            SHA512

            98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

          • C:\Users\Admin\AppData\Local\Temp\81703543077.txt

            Filesize

            58B

            MD5

            dd876faf0fd44a5fab3e82368e2e8b15

            SHA1

            01b04083fa278dda3a81705ca5abcfee487a3c90

            SHA256

            5602490a82bcacec8797d25cbb6f643fc9e69f89a2f0e6ec1e8d1f568e77a6b9

            SHA512

            e03d1def5b7fb0ed01a414cead199229ec0e153ff831d3ff5dd36c320572084c56a5e1369c753f868c855455758c0d308941b6187c348051419bd937d014cb8b

          • C:\Users\Admin\AppData\Local\Temp\nsi6785.tmp\cyddlai.dll

            Filesize

            158KB

            MD5

            16d002663804917fea207d1ad20511d6

            SHA1

            0addd00d772ba2f24bf8e8bf7e38f47c70194249

            SHA256

            46f8924dfb2e47973810b8f13d1d46c1a82f3849d16e08f56ec540fe0bdb2a5b

            SHA512

            24d1765dfa2c23599f85aada762e7827e298037a024bf48ad5151b4debe97b7d4621834460464dadf6824ddee8077476000e3cdc1fbe7074030afd0d731c5d76

          • C:\Users\Admin\AppData\Local\Temp\nsi6785.tmp\nsisunz.dll

            Filesize

            40KB

            MD5

            5f13dbc378792f23e598079fc1e4422b

            SHA1

            5813c05802f15930aa860b8363af2b58426c8adf

            SHA256

            6e87ecb7f62039fbb6e7676422d1a5e75a32b90dde6865dcb68ee658ba8df61d

            SHA512

            9270635a5294482f49e0292e26d45dd103b85fe27dc163d44531b095c5f9dbde6b904adaf1a888ba3c112a094380394713c796f5195b2566a20f00b42b6578e5