Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
26/12/2023, 08:46
Static task
static1
Behavioral task
behavioral1
Sample
60eb440b50deecf53d4c1ccd102dbc6d.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
60eb440b50deecf53d4c1ccd102dbc6d.exe
Resource
win10v2004-20231215-en
General
-
Target
60eb440b50deecf53d4c1ccd102dbc6d.exe
-
Size
581KB
-
MD5
60eb440b50deecf53d4c1ccd102dbc6d
-
SHA1
a8c2d11441adf64c807fea44738a332271e7639a
-
SHA256
050235ac7752d4e87878f733ba539e3a64a23ca442653e3e1ca0a5ca8e55b913
-
SHA512
67711f06c393f3d5128dd4319d1846d7e043e49f1e9ec086c11d05cff79694f9e363b5ec7330572cf241cdfb34cc7589dc6023ce1a2c73c0f847d5263e7caa37
-
SSDEEP
12288:wfDJhNH8ZkXWykEr8369tNFMP8NdHXpZ2achJC4+6:wLJbl+36tKPdhJ7b
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2964 1431831751.exe -
Loads dropped DLL 11 IoCs
pid Process 2360 60eb440b50deecf53d4c1ccd102dbc6d.exe 2360 60eb440b50deecf53d4c1ccd102dbc6d.exe 2360 60eb440b50deecf53d4c1ccd102dbc6d.exe 2360 60eb440b50deecf53d4c1ccd102dbc6d.exe 2768 WerFault.exe 2768 WerFault.exe 2768 WerFault.exe 2768 WerFault.exe 2768 WerFault.exe 2768 WerFault.exe 2768 WerFault.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 2768 2964 WerFault.exe 28 -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2952 wmic.exe Token: SeSecurityPrivilege 2952 wmic.exe Token: SeTakeOwnershipPrivilege 2952 wmic.exe Token: SeLoadDriverPrivilege 2952 wmic.exe Token: SeSystemProfilePrivilege 2952 wmic.exe Token: SeSystemtimePrivilege 2952 wmic.exe Token: SeProfSingleProcessPrivilege 2952 wmic.exe Token: SeIncBasePriorityPrivilege 2952 wmic.exe Token: SeCreatePagefilePrivilege 2952 wmic.exe Token: SeBackupPrivilege 2952 wmic.exe Token: SeRestorePrivilege 2952 wmic.exe Token: SeShutdownPrivilege 2952 wmic.exe Token: SeDebugPrivilege 2952 wmic.exe Token: SeSystemEnvironmentPrivilege 2952 wmic.exe Token: SeRemoteShutdownPrivilege 2952 wmic.exe Token: SeUndockPrivilege 2952 wmic.exe Token: SeManageVolumePrivilege 2952 wmic.exe Token: 33 2952 wmic.exe Token: 34 2952 wmic.exe Token: 35 2952 wmic.exe Token: SeIncreaseQuotaPrivilege 2952 wmic.exe Token: SeSecurityPrivilege 2952 wmic.exe Token: SeTakeOwnershipPrivilege 2952 wmic.exe Token: SeLoadDriverPrivilege 2952 wmic.exe Token: SeSystemProfilePrivilege 2952 wmic.exe Token: SeSystemtimePrivilege 2952 wmic.exe Token: SeProfSingleProcessPrivilege 2952 wmic.exe Token: SeIncBasePriorityPrivilege 2952 wmic.exe Token: SeCreatePagefilePrivilege 2952 wmic.exe Token: SeBackupPrivilege 2952 wmic.exe Token: SeRestorePrivilege 2952 wmic.exe Token: SeShutdownPrivilege 2952 wmic.exe Token: SeDebugPrivilege 2952 wmic.exe Token: SeSystemEnvironmentPrivilege 2952 wmic.exe Token: SeRemoteShutdownPrivilege 2952 wmic.exe Token: SeUndockPrivilege 2952 wmic.exe Token: SeManageVolumePrivilege 2952 wmic.exe Token: 33 2952 wmic.exe Token: 34 2952 wmic.exe Token: 35 2952 wmic.exe Token: SeIncreaseQuotaPrivilege 2832 wmic.exe Token: SeSecurityPrivilege 2832 wmic.exe Token: SeTakeOwnershipPrivilege 2832 wmic.exe Token: SeLoadDriverPrivilege 2832 wmic.exe Token: SeSystemProfilePrivilege 2832 wmic.exe Token: SeSystemtimePrivilege 2832 wmic.exe Token: SeProfSingleProcessPrivilege 2832 wmic.exe Token: SeIncBasePriorityPrivilege 2832 wmic.exe Token: SeCreatePagefilePrivilege 2832 wmic.exe Token: SeBackupPrivilege 2832 wmic.exe Token: SeRestorePrivilege 2832 wmic.exe Token: SeShutdownPrivilege 2832 wmic.exe Token: SeDebugPrivilege 2832 wmic.exe Token: SeSystemEnvironmentPrivilege 2832 wmic.exe Token: SeRemoteShutdownPrivilege 2832 wmic.exe Token: SeUndockPrivilege 2832 wmic.exe Token: SeManageVolumePrivilege 2832 wmic.exe Token: 33 2832 wmic.exe Token: 34 2832 wmic.exe Token: 35 2832 wmic.exe Token: SeIncreaseQuotaPrivilege 2832 wmic.exe Token: SeSecurityPrivilege 2832 wmic.exe Token: SeTakeOwnershipPrivilege 2832 wmic.exe Token: SeLoadDriverPrivilege 2832 wmic.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2360 wrote to memory of 2964 2360 60eb440b50deecf53d4c1ccd102dbc6d.exe 28 PID 2360 wrote to memory of 2964 2360 60eb440b50deecf53d4c1ccd102dbc6d.exe 28 PID 2360 wrote to memory of 2964 2360 60eb440b50deecf53d4c1ccd102dbc6d.exe 28 PID 2360 wrote to memory of 2964 2360 60eb440b50deecf53d4c1ccd102dbc6d.exe 28 PID 2964 wrote to memory of 2952 2964 1431831751.exe 29 PID 2964 wrote to memory of 2952 2964 1431831751.exe 29 PID 2964 wrote to memory of 2952 2964 1431831751.exe 29 PID 2964 wrote to memory of 2952 2964 1431831751.exe 29 PID 2964 wrote to memory of 2832 2964 1431831751.exe 32 PID 2964 wrote to memory of 2832 2964 1431831751.exe 32 PID 2964 wrote to memory of 2832 2964 1431831751.exe 32 PID 2964 wrote to memory of 2832 2964 1431831751.exe 32 PID 2964 wrote to memory of 3044 2964 1431831751.exe 34 PID 2964 wrote to memory of 3044 2964 1431831751.exe 34 PID 2964 wrote to memory of 3044 2964 1431831751.exe 34 PID 2964 wrote to memory of 3044 2964 1431831751.exe 34 PID 2964 wrote to memory of 672 2964 1431831751.exe 36 PID 2964 wrote to memory of 672 2964 1431831751.exe 36 PID 2964 wrote to memory of 672 2964 1431831751.exe 36 PID 2964 wrote to memory of 672 2964 1431831751.exe 36 PID 2964 wrote to memory of 1284 2964 1431831751.exe 38 PID 2964 wrote to memory of 1284 2964 1431831751.exe 38 PID 2964 wrote to memory of 1284 2964 1431831751.exe 38 PID 2964 wrote to memory of 1284 2964 1431831751.exe 38 PID 2964 wrote to memory of 2768 2964 1431831751.exe 40 PID 2964 wrote to memory of 2768 2964 1431831751.exe 40 PID 2964 wrote to memory of 2768 2964 1431831751.exe 40 PID 2964 wrote to memory of 2768 2964 1431831751.exe 40
Processes
-
C:\Users\Admin\AppData\Local\Temp\60eb440b50deecf53d4c1ccd102dbc6d.exe"C:\Users\Admin\AppData\Local\Temp\60eb440b50deecf53d4c1ccd102dbc6d.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\1431831751.exeC:\Users\Admin\AppData\Local\Temp\1431831751.exe 9#2#2#7#5#3#4#7#8#0#8 Jk5HPTgwLCsqICdKU0BJREE5KRgvRjxSVUhNSEU9NTAYJkJHTE9GQDYqNyouMB4oPkZANiggJ0dQTT1QQFBYQUQ1KDQ3LRssTz5KVj1JXVNLRzpkbWxwMiYtcWtxK0A+S0slS01OJjxNTCdBTj5GHi08R0Y/REFENW5ELyw0L0ovTktNQDJKMkYtMjxLTDE6QR4oPy45KikwKCweLT0tOikqGC88KjsrKhssQC01LSkXLUIuOCotGSdQSkZCUzxPXExLQVY5Olc7GSpNTkg8VTtLXUNORz45GSdQSkZCUzxPXEo6RUU1Fy1DUUBcUUtEPRgmQ1Y+WkBJPURJRjw7HihDTE9NV0JKRlVRPk06LBknVEA4TElSSlJbTkpMNRctVEY4LxwoPFMpNB4tS1BLUEJFRVdOQ0o8SkpBQkVBPzxTUEU4HStCS19KTExSQkhCOW1qdV0XLVA+T1JOR0FOP1ZTUT5NXEA6UVM1KR4tQURBQVE1MRgmR1FYP1ZKOkVJO1ZDTDxNVkxNPUQ1XV9qbGAdKz1HV0ZDTT89WkZMNi42JiguMCczKy0wKSAnS0dLPjguMCwpOCwoNDEyGyxASE9OREY/QlhPRkk+NTUnKDUtKysuMSMtOiwuOC8yJT5JGSdVOTRLbXNkaWhaHTJeLCwuJCNUZWdcb29qKUxNJjMqKh0zWiJVTVAxMSEsWitMaWdiXmlxISteNyYnIzFbJm9yHithKSgsLiImaWVkXSs/XGFpaBssUUtEPWBrcm4eLl4hK14lKl1lY20sKywqKTFcXHFnYGkrZWdebx0pZFBuaVFlZl1EZ25samhcYUlaZmFfXHBdXWBtaGhxJSpdLzIsLDUwKi40KBwwZF1qdGplZ2FcZF9sWmJibh4qZikrMS8xLy4yLSglK10xMSw0NDIxKDEqMFhFQ3NPZjptTis4NktMXnNIckZiRmB1dEZlVnNBT2suQ2cuckdlMW5IQyxbV1EtMUg/aGlLPExqV2JmM0diLGRQSi4vRU8+Z1ByRS5CZ2VfU2YsMkRDMFtXMFNrVUNdWlpPTDZhT3N1X2YoZFA+WGZSLW1qUHJwKEh3ZWxIdmxIRlZKOlNpUnNOdkM+SzxRQVNOSC9NPjlkUWMvbFtldHM=2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81704524265.txt bios get serialnumber3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2952
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81704524265.txt bios get version3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2832
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81704524265.txt bios get version3⤵PID:3044
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81704524265.txt bios get version3⤵PID:672
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81704524265.txt bios get version3⤵PID:1284
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2964 -s 3723⤵
- Loads dropped DLL
- Program crash
PID:2768
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
66B
MD59025468f85256136f923096b01375964
SHA17fcd174999661594fa5f88890ffb195e9858cc52
SHA256d5418014fa8e6e17d8992fd12c0dfecac8a34855603ea58133e87ea09c2130df
SHA51292cac37c332e6e276a963d659986a79a79867df44682bfc2d77ed7784ffa5e2c149e5960a83d03ef4cf171be40a73e93a110aaa53b95152fa9a9da6b41d31e51
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
Filesize
58B
MD5dd876faf0fd44a5fab3e82368e2e8b15
SHA101b04083fa278dda3a81705ca5abcfee487a3c90
SHA2565602490a82bcacec8797d25cbb6f643fc9e69f89a2f0e6ec1e8d1f568e77a6b9
SHA512e03d1def5b7fb0ed01a414cead199229ec0e153ff831d3ff5dd36c320572084c56a5e1369c753f868c855455758c0d308941b6187c348051419bd937d014cb8b
-
Filesize
788KB
MD58890fe58240790af20b7006c537a69a2
SHA1aebb9a5cbd652634e017bbe57d1ba032b90f5a5b
SHA256747baf72bd89b1dc09ec74093aad6249b2ee983e56cb730476a107ee5024be27
SHA512ddf24bf4004148b7f90b4659bc2cd59cc97c3fa9b1c75d2bfdb89d0547ecb1b62405d5258f6ea7c4e18c3892cb1cb7c4fb354f34a091325ca9b940d99eafb074
-
Filesize
64KB
MD548e7600dae3816b8366ac14f989c2f33
SHA1da211d318eb7f0e0b5444946c779fec9996782b2
SHA25646cb7c2e46c07c1859193332b837444845d812e8e7756fdb36b8cb69c7e0445d
SHA5122c30d8c12c08147ca468a5125ce6d7f7edaecd22e36a5e25f27b013216478d7d69e34cdec4098e216bf42890686cb8a06130bb01047e82300fa1e4f101dce36c
-
Filesize
153KB
MD59b081b4f84974a46cffcf1ef1a2e85f9
SHA170a1b83bad19d28195f2df22c3d213a04b42fb2b
SHA256303f74df9812b639b66f919804039d1e295ffae8e543fa4349507110ac766752
SHA5124539a458b1d2ba61ffcf71ea59addd13727d26606f73dbfb21053d68d5656010dae5791d486789c14653c6fb953a7dc284c3a80db2b1970a0e7f0778ab77dbbf
-
Filesize
40KB
MD55f13dbc378792f23e598079fc1e4422b
SHA15813c05802f15930aa860b8363af2b58426c8adf
SHA2566e87ecb7f62039fbb6e7676422d1a5e75a32b90dde6865dcb68ee658ba8df61d
SHA5129270635a5294482f49e0292e26d45dd103b85fe27dc163d44531b095c5f9dbde6b904adaf1a888ba3c112a094380394713c796f5195b2566a20f00b42b6578e5