Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
163s -
max time network
163s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
25/12/2023, 18:11
Static task
static1
Behavioral task
behavioral1
Sample
33813141d96c8d537b56c00f492b86d8.exe
Resource
win7-20231215-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
33813141d96c8d537b56c00f492b86d8.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
33813141d96c8d537b56c00f492b86d8.exe
-
Size
1.1MB
-
MD5
33813141d96c8d537b56c00f492b86d8
-
SHA1
0d8ebbc0889a6ecf599625bb3636bd9a0ff3e680
-
SHA256
213923d689922f8590cc822d62075841c80dc158b9281f05ec43d9f0de73ad56
-
SHA512
feb394a73836b87d4383a77f7c6a0178e795ecb213b23d33054b13d9e95102520c6c59f7af14e22abd24d46e62badaf9e395616122bf6f04f7eba385465698db
-
SSDEEP
12288:6Miy4IadS4ms5I6e66fEheKh6sfC444vk0kfyAfjfym0ArlDrmcZkQoxKk7HA4uO:6bSaE4mvt/H67AfKAr16CkQ8D7xD
Score
7/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Control Panel\International\Geo\Nation 33813141d96c8d537b56c00f492b86d8.exe -
Executes dropped EXE 2 IoCs
pid Process 692 File.exe 324 ebjcabfbcebda.exe -
Loads dropped DLL 2 IoCs
pid Process 692 File.exe 692 File.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 2788 324 WerFault.exe 99 -
NSIS installer 4 IoCs
resource yara_rule behavioral2/files/0x000600000002322c-23.dat nsis_installer_1 behavioral2/files/0x000600000002322c-23.dat nsis_installer_2 behavioral2/files/0x000600000002322c-33.dat nsis_installer_1 behavioral2/files/0x000600000002322c-33.dat nsis_installer_2 -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\91C6D6EE3E8AC86384E548C299295C756C817B81 33813141d96c8d537b56c00f492b86d8.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\91C6D6EE3E8AC86384E548C299295C756C817B81\Blob = 0400000001000000100000008ccadc0b22cef5be72ac411a11a8d8120f000000010000001400000085fef11b4f47fe3952f98301c9f98976fefee0ce7f000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030109000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030153000000010000002500000030233021060b6086480186f8450107300130123010060a2b0601040182373c0101030200c06200000001000000200000008d722f81a9c113c0791df136a2966db26c950a971db46b4199f4ea54b78bfb9f1400000001000000140000007b5b45cfafcecb7afd31921a6ab6f346eb5748501d00000001000000100000005b3b67000eeb80022e42605b6b3b72400b000000010000000e00000074006800610077007400650000007e000000010000000800000000c0032f2df8d60168000000010000000000000003000000010000001400000091c6d6ee3e8ac86384e548c299295c756c817b81190000000100000010000000dc73f9b71e16d51d26527d32b11a6a3d2000000001000000240400003082042030820308a0030201020210344ed55720d5edec49f42fce37db2b6d300d06092a864886f70d01010505003081a9310b300906035504061302555331153013060355040a130c7468617774652c20496e632e31283026060355040b131f43657274696669636174696f6e205365727669636573204469766973696f6e31383036060355040b132f2863292032303036207468617774652c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79311f301d06035504031316746861777465205072696d61727920526f6f74204341301e170d3036313131373030303030305a170d3336303731363233353935395a3081a9310b300906035504061302555331153013060355040a130c7468617774652c20496e632e31283026060355040b131f43657274696669636174696f6e205365727669636573204469766973696f6e31383036060355040b132f2863292032303036207468617774652c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79311f301d06035504031316746861777465205072696d61727920526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100aca0f0fb8059d49cc7a4cf9da159730910450c0d2c6e68f16c5b4868495937fc0b3319c2777fcc102d95341ce6eb4d09a71cd2b8c9973602b789d4245f06c0cc4494948d02626feb5add118d289a5c8490107a0dbd74662f6a38a0e2d55444eb1d079f07ba6feee9fd4e0b29f53e84a001f19cabf81c7e89a4e8a1d871650da3517beebcd222600db95b9ddfbafc515b0baf98b2e92ee904e86287de2bc8d74ec14c641eddcf8758ba4a4fca68071d1c9d4ac6d52f91cc7c71721cc5c067eb32fdc9925c94da85c09bbf537d2b09f48c9d911f976a52cbde0936a477d87b875044d53e6e2969fb3949261e09a5807b402debe82785c9fe61fd7ee67c971dd59d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604147b5b45cfafcecb7afd31921a6ab6f346eb574850300d06092a864886f70d010105050003820101007911c04bb391b6fcf0e967d40d6e45be55e893d2ce033fedda25b01d57cb1e3a76a04cec5076e864720ca4a9f1b88bd6d68784bb32e54111c077d9b3609deb1bd5d16e4444a9a601ec55621d77b85c8e48497c9c3b5711acad73378e2f785c906847d96060e6fc073d222017c4f716e9c4d872f9c8737cdf162f15a93efd6a27b6a1eb5aba981fd5e34d640a9d13c861baf5391c87bab8bd7b227ff6feac4079e5ac106f3d8f1b79768bc437b3211884e53600eb632099b9e9fe3304bb41c8c102f94463209e81ce42d3d63f2c76d3639c59dd8fa6e10ea02e41f72e9547cfbcfd33f3f60b617e7e912b8147c22730eea7105d378f5c392be404f07b8d568c68 33813141d96c8d537b56c00f492b86d8.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\91C6D6EE3E8AC86384E548C299295C756C817B81\Blob = 5c000000010000000400000000080000190000000100000010000000dc73f9b71e16d51d26527d32b11a6a3d03000000010000001400000091c6d6ee3e8ac86384e548c299295c756c817b816800000001000000000000007e000000010000000800000000c0032f2df8d6010b000000010000000e00000074006800610077007400650000001d00000001000000100000005b3b67000eeb80022e42605b6b3b72401400000001000000140000007b5b45cfafcecb7afd31921a6ab6f346eb5748506200000001000000200000008d722f81a9c113c0791df136a2966db26c950a971db46b4199f4ea54b78bfb9f53000000010000002500000030233021060b6086480186f8450107300130123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703017f000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703010f000000010000001400000085fef11b4f47fe3952f98301c9f98976fefee0ce0400000001000000100000008ccadc0b22cef5be72ac411a11a8d8122000000001000000240400003082042030820308a0030201020210344ed55720d5edec49f42fce37db2b6d300d06092a864886f70d01010505003081a9310b300906035504061302555331153013060355040a130c7468617774652c20496e632e31283026060355040b131f43657274696669636174696f6e205365727669636573204469766973696f6e31383036060355040b132f2863292032303036207468617774652c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79311f301d06035504031316746861777465205072696d61727920526f6f74204341301e170d3036313131373030303030305a170d3336303731363233353935395a3081a9310b300906035504061302555331153013060355040a130c7468617774652c20496e632e31283026060355040b131f43657274696669636174696f6e205365727669636573204469766973696f6e31383036060355040b132f2863292032303036207468617774652c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79311f301d06035504031316746861777465205072696d61727920526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100aca0f0fb8059d49cc7a4cf9da159730910450c0d2c6e68f16c5b4868495937fc0b3319c2777fcc102d95341ce6eb4d09a71cd2b8c9973602b789d4245f06c0cc4494948d02626feb5add118d289a5c8490107a0dbd74662f6a38a0e2d55444eb1d079f07ba6feee9fd4e0b29f53e84a001f19cabf81c7e89a4e8a1d871650da3517beebcd222600db95b9ddfbafc515b0baf98b2e92ee904e86287de2bc8d74ec14c641eddcf8758ba4a4fca68071d1c9d4ac6d52f91cc7c71721cc5c067eb32fdc9925c94da85c09bbf537d2b09f48c9d911f976a52cbde0936a477d87b875044d53e6e2969fb3949261e09a5807b402debe82785c9fe61fd7ee67c971dd59d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604147b5b45cfafcecb7afd31921a6ab6f346eb574850300d06092a864886f70d010105050003820101007911c04bb391b6fcf0e967d40d6e45be55e893d2ce033fedda25b01d57cb1e3a76a04cec5076e864720ca4a9f1b88bd6d68784bb32e54111c077d9b3609deb1bd5d16e4444a9a601ec55621d77b85c8e48497c9c3b5711acad73378e2f785c906847d96060e6fc073d222017c4f716e9c4d872f9c8737cdf162f15a93efd6a27b6a1eb5aba981fd5e34d640a9d13c861baf5391c87bab8bd7b227ff6feac4079e5ac106f3d8f1b79768bc437b3211884e53600eb632099b9e9fe3304bb41c8c102f94463209e81ce42d3d63f2c76d3639c59dd8fa6e10ea02e41f72e9547cfbcfd33f3f60b617e7e912b8147c22730eea7105d378f5c392be404f07b8d568c68 33813141d96c8d537b56c00f492b86d8.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1140 33813141d96c8d537b56c00f492b86d8.exe 1140 33813141d96c8d537b56c00f492b86d8.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1140 33813141d96c8d537b56c00f492b86d8.exe Token: SeIncreaseQuotaPrivilege 3048 wmic.exe Token: SeSecurityPrivilege 3048 wmic.exe Token: SeTakeOwnershipPrivilege 3048 wmic.exe Token: SeLoadDriverPrivilege 3048 wmic.exe Token: SeSystemProfilePrivilege 3048 wmic.exe Token: SeSystemtimePrivilege 3048 wmic.exe Token: SeProfSingleProcessPrivilege 3048 wmic.exe Token: SeIncBasePriorityPrivilege 3048 wmic.exe Token: SeCreatePagefilePrivilege 3048 wmic.exe Token: SeBackupPrivilege 3048 wmic.exe Token: SeRestorePrivilege 3048 wmic.exe Token: SeShutdownPrivilege 3048 wmic.exe Token: SeDebugPrivilege 3048 wmic.exe Token: SeSystemEnvironmentPrivilege 3048 wmic.exe Token: SeRemoteShutdownPrivilege 3048 wmic.exe Token: SeUndockPrivilege 3048 wmic.exe Token: SeManageVolumePrivilege 3048 wmic.exe Token: 33 3048 wmic.exe Token: 34 3048 wmic.exe Token: 35 3048 wmic.exe Token: 36 3048 wmic.exe Token: SeIncreaseQuotaPrivilege 3048 wmic.exe Token: SeSecurityPrivilege 3048 wmic.exe Token: SeTakeOwnershipPrivilege 3048 wmic.exe Token: SeLoadDriverPrivilege 3048 wmic.exe Token: SeSystemProfilePrivilege 3048 wmic.exe Token: SeSystemtimePrivilege 3048 wmic.exe Token: SeProfSingleProcessPrivilege 3048 wmic.exe Token: SeIncBasePriorityPrivilege 3048 wmic.exe Token: SeCreatePagefilePrivilege 3048 wmic.exe Token: SeBackupPrivilege 3048 wmic.exe Token: SeRestorePrivilege 3048 wmic.exe Token: SeShutdownPrivilege 3048 wmic.exe Token: SeDebugPrivilege 3048 wmic.exe Token: SeSystemEnvironmentPrivilege 3048 wmic.exe Token: SeRemoteShutdownPrivilege 3048 wmic.exe Token: SeUndockPrivilege 3048 wmic.exe Token: SeManageVolumePrivilege 3048 wmic.exe Token: 33 3048 wmic.exe Token: 34 3048 wmic.exe Token: 35 3048 wmic.exe Token: 36 3048 wmic.exe Token: SeIncreaseQuotaPrivilege 2100 wmic.exe Token: SeSecurityPrivilege 2100 wmic.exe Token: SeTakeOwnershipPrivilege 2100 wmic.exe Token: SeLoadDriverPrivilege 2100 wmic.exe Token: SeSystemProfilePrivilege 2100 wmic.exe Token: SeSystemtimePrivilege 2100 wmic.exe Token: SeProfSingleProcessPrivilege 2100 wmic.exe Token: SeIncBasePriorityPrivilege 2100 wmic.exe Token: SeCreatePagefilePrivilege 2100 wmic.exe Token: SeBackupPrivilege 2100 wmic.exe Token: SeRestorePrivilege 2100 wmic.exe Token: SeShutdownPrivilege 2100 wmic.exe Token: SeDebugPrivilege 2100 wmic.exe Token: SeSystemEnvironmentPrivilege 2100 wmic.exe Token: SeRemoteShutdownPrivilege 2100 wmic.exe Token: SeUndockPrivilege 2100 wmic.exe Token: SeManageVolumePrivilege 2100 wmic.exe Token: 33 2100 wmic.exe Token: 34 2100 wmic.exe Token: 35 2100 wmic.exe Token: 36 2100 wmic.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 1140 wrote to memory of 692 1140 33813141d96c8d537b56c00f492b86d8.exe 98 PID 1140 wrote to memory of 692 1140 33813141d96c8d537b56c00f492b86d8.exe 98 PID 1140 wrote to memory of 692 1140 33813141d96c8d537b56c00f492b86d8.exe 98 PID 692 wrote to memory of 324 692 File.exe 99 PID 692 wrote to memory of 324 692 File.exe 99 PID 692 wrote to memory of 324 692 File.exe 99 PID 324 wrote to memory of 3048 324 ebjcabfbcebda.exe 100 PID 324 wrote to memory of 3048 324 ebjcabfbcebda.exe 100 PID 324 wrote to memory of 3048 324 ebjcabfbcebda.exe 100 PID 324 wrote to memory of 2100 324 ebjcabfbcebda.exe 103 PID 324 wrote to memory of 2100 324 ebjcabfbcebda.exe 103 PID 324 wrote to memory of 2100 324 ebjcabfbcebda.exe 103 PID 324 wrote to memory of 3824 324 ebjcabfbcebda.exe 105 PID 324 wrote to memory of 3824 324 ebjcabfbcebda.exe 105 PID 324 wrote to memory of 3824 324 ebjcabfbcebda.exe 105 PID 324 wrote to memory of 312 324 ebjcabfbcebda.exe 107 PID 324 wrote to memory of 312 324 ebjcabfbcebda.exe 107 PID 324 wrote to memory of 312 324 ebjcabfbcebda.exe 107 PID 324 wrote to memory of 384 324 ebjcabfbcebda.exe 110 PID 324 wrote to memory of 384 324 ebjcabfbcebda.exe 110 PID 324 wrote to memory of 384 324 ebjcabfbcebda.exe 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\33813141d96c8d537b56c00f492b86d8.exe"C:\Users\Admin\AppData\Local\Temp\33813141d96c8d537b56c00f492b86d8.exe"1⤵
- Checks computer location settings
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1140 -
C:\Users\Admin\AppData\Local\Temp\File.exe"C:\Users\Admin\AppData\Local\Temp\File.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:692 -
C:\Users\Admin\AppData\Local\Temp\ebjcabfbcebda.exeC:\Users\Admin\AppData\Local\Temp\ebjcabfbcebda.exe 6,9,6,2,1,8,2,0,6,7,7 KUdDQjwqMTMaKExPOUpHQzUuIClHPk5OSVBKQUI9KxkoPkBNUkg8OzIxLSotFylBSDw7MBooSUxGPlNCTF1JPjYqMDAuHi5LQ1JQPktZTExKPGBydGozKClqbHQtPENTRSZNSUcnP09ILElIP0gaJj1KSDtJST42KSsoMzU2LTQ3KisrLSgqLjUxLzczGSg+KDcjMygjNCo8RUM8SFIsPEAtQz0eLicfMi8YLUQsNiYrFylCMjUrMRooPS40Jy8fJ0I1NyYqGiZKUE48U0NOWElMQFA/QlE7IClJS0k7T0FTV0NVRjo2GiZKUE48U0NOWEc7RD87HydDWD9YTkxDNx4uPVZFWTxGPkNDTEQ1Hi9CSExOVjxQTk9RRUw2KxomTkZARklZSU5YT0lGOx8nVE03KxkpO00vPBgtUk9HTUNEP11WPUpDSUY+Q0Q7RURNUEw3GShDSllQVEZSSUc+Nm5pb2MfJ1BFTk5LSEBIRV5NUUVMWD07UE07MRgtSEM9PlI0Kx4uQVFfPlJHO0RDQV49TENMUklOPD47ZVlqc18ZKD5GUUxLRz9EWUJJNygzNi0pMTcoKykoLRotU0FLRTcqLSwwLjQ4LzQ1Gig9SU5ISk45Ql9OQkY/NC4tMDEtMioqLiQtNDM1Mi41JElGGiZPPzxFbXpjZWVbHCxkNCYuKyJQYmhbaXVyI0xUJS8nKyAlP29oamVRXltFYG4jMV4zMzEnLDAiIklHTEtMHytcJWNjaWQjRWVdZGgjIj1mcWdrZR8rXy4pKC4tKjExKycyKiJNX2VZcGkfK18vKjEsMi4eL09LRTdfbnJvHTFhHytfHylgZWRscC4qKisqXihnbV5tJSxfS29lTmdsXUJvcWdlaVheS2BmX2dfa1heXGpqbnEjMmAqLSwwLjQ4LzQ2HytfKyssNzMuNzcwLx4sXSsyMTEyNjMwLzAcLWQ0Ly4yMCsqLi8wM1hkMzBIPGgzWXRpcERRNGJRTSpuR1JIb0p4L2ZIPW5wTVNBZWI+cG1CYy5xTjoyMEZhMXNDdDdESS5CRE1MKzpKQXNBT0IqbkRzOG5LQkpiYWdhX1MpSGROO2l4RnNGK0VkQ3RFUXNuRHNHbUVnMylMU2VxRz09Y1cxKW1PdD5iXWRIcE47cQ==3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:324 -
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81703604547.txt bios get serialnumber4⤵
- Suspicious use of AdjustPrivilegeToken
PID:3048
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81703604547.txt bios get version4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2100
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81703604547.txt bios get version4⤵PID:3824
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81703604547.txt bios get version4⤵PID:312
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81703604547.txt bios get version4⤵PID:384
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 324 -s 9564⤵
- Program crash
PID:2788
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 324 -ip 3241⤵PID:1088
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
92KB
MD5bac600218861e8da0ceaa34cd4b62f8e
SHA167eb0013849ec5ed02b768d2fc3e0004df03487e
SHA2566e0ba4d98d1e7f1233f07152183c3ca31086ef0259c2fd1e021857145aed2694
SHA51247c69eb4ef18e40914c8e08bcee714f1f5e40fded9c51a6f6ce05c3198f6665b86da18cb6e288cf84c76711dd7e880d4d8c55e931ae15629ae94001b603b0818