Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
26/12/2023, 17:01
Behavioral task
behavioral1
Sample
7eaf913bed26f384d6ce46b787fdb57e.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
7eaf913bed26f384d6ce46b787fdb57e.exe
Resource
win10v2004-20231215-en
General
-
Target
7eaf913bed26f384d6ce46b787fdb57e.exe
-
Size
21KB
-
MD5
7eaf913bed26f384d6ce46b787fdb57e
-
SHA1
4c02e3cca813e3d49de26da4ff25f5d64aece2ff
-
SHA256
e732f04156824837dd34109312fa53860b2500b5200b28b4078f07f5e0dedf6d
-
SHA512
5632d679108700c710c994b69fa1a0fb155d3ab11be6281282129b06919f6c25f510c4d68fe5a8458adf07549834dee738dd010bc5e38ad69c9b69fe57d50dbf
-
SSDEEP
384:DIiV728hUQ7Y2P/cVEccDdye7kjlWLe7grPiA8jyrMPhTjanbBoZmXdaNJawcudy:DRGuY2P0Vo6r7SiAwyrMRjbkwnbcuyDY
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Control Panel\International\Geo\Nation 7eaf913bed26f384d6ce46b787fdb57e.exe -
resource yara_rule behavioral2/memory/3396-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/memory/3396-5-0x0000000000400000-0x0000000000410000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Kills process with taskkill 27 IoCs
pid Process 3372 taskkill.exe 800 taskkill.exe 3412 taskkill.exe 4536 taskkill.exe 5108 taskkill.exe 2292 taskkill.exe 5076 taskkill.exe 2164 taskkill.exe 3444 taskkill.exe 4856 taskkill.exe 1616 taskkill.exe 4936 taskkill.exe 4020 taskkill.exe 4772 taskkill.exe 3732 taskkill.exe 2944 taskkill.exe 1096 taskkill.exe 2776 taskkill.exe 5080 taskkill.exe 2464 taskkill.exe 852 taskkill.exe 3212 taskkill.exe 2400 taskkill.exe 1932 taskkill.exe 3628 taskkill.exe 4864 taskkill.exe 2712 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 27 IoCs
description pid Process Token: SeDebugPrivilege 2292 taskkill.exe Token: SeDebugPrivilege 4864 taskkill.exe Token: SeDebugPrivilege 5076 taskkill.exe Token: SeDebugPrivilege 2164 taskkill.exe Token: SeDebugPrivilege 3444 taskkill.exe Token: SeDebugPrivilege 800 taskkill.exe Token: SeDebugPrivilege 1096 taskkill.exe Token: SeDebugPrivilege 3732 taskkill.exe Token: SeDebugPrivilege 852 taskkill.exe Token: SeDebugPrivilege 2944 taskkill.exe Token: SeDebugPrivilege 2712 taskkill.exe Token: SeDebugPrivilege 1616 taskkill.exe Token: SeDebugPrivilege 3412 taskkill.exe Token: SeDebugPrivilege 4936 taskkill.exe Token: SeDebugPrivilege 4020 taskkill.exe Token: SeDebugPrivilege 2776 taskkill.exe Token: SeDebugPrivilege 3372 taskkill.exe Token: SeDebugPrivilege 4536 taskkill.exe Token: SeDebugPrivilege 5080 taskkill.exe Token: SeDebugPrivilege 5108 taskkill.exe Token: SeDebugPrivilege 3212 taskkill.exe Token: SeDebugPrivilege 1932 taskkill.exe Token: SeDebugPrivilege 2464 taskkill.exe Token: SeDebugPrivilege 4772 taskkill.exe Token: SeDebugPrivilege 2400 taskkill.exe Token: SeDebugPrivilege 4856 taskkill.exe Token: SeDebugPrivilege 3628 taskkill.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3396 wrote to memory of 2540 3396 7eaf913bed26f384d6ce46b787fdb57e.exe 58 PID 3396 wrote to memory of 2540 3396 7eaf913bed26f384d6ce46b787fdb57e.exe 58 PID 3396 wrote to memory of 2540 3396 7eaf913bed26f384d6ce46b787fdb57e.exe 58 PID 2540 wrote to memory of 2292 2540 cmd.exe 63 PID 2540 wrote to memory of 2292 2540 cmd.exe 63 PID 2540 wrote to memory of 2292 2540 cmd.exe 63 PID 2540 wrote to memory of 4864 2540 cmd.exe 95 PID 2540 wrote to memory of 4864 2540 cmd.exe 95 PID 2540 wrote to memory of 4864 2540 cmd.exe 95 PID 2540 wrote to memory of 5076 2540 cmd.exe 96 PID 2540 wrote to memory of 5076 2540 cmd.exe 96 PID 2540 wrote to memory of 5076 2540 cmd.exe 96 PID 2540 wrote to memory of 2164 2540 cmd.exe 97 PID 2540 wrote to memory of 2164 2540 cmd.exe 97 PID 2540 wrote to memory of 2164 2540 cmd.exe 97 PID 2540 wrote to memory of 3444 2540 cmd.exe 98 PID 2540 wrote to memory of 3444 2540 cmd.exe 98 PID 2540 wrote to memory of 3444 2540 cmd.exe 98 PID 2540 wrote to memory of 800 2540 cmd.exe 99 PID 2540 wrote to memory of 800 2540 cmd.exe 99 PID 2540 wrote to memory of 800 2540 cmd.exe 99 PID 2540 wrote to memory of 1096 2540 cmd.exe 100 PID 2540 wrote to memory of 1096 2540 cmd.exe 100 PID 2540 wrote to memory of 1096 2540 cmd.exe 100 PID 2540 wrote to memory of 3732 2540 cmd.exe 101 PID 2540 wrote to memory of 3732 2540 cmd.exe 101 PID 2540 wrote to memory of 3732 2540 cmd.exe 101 PID 2540 wrote to memory of 852 2540 cmd.exe 102 PID 2540 wrote to memory of 852 2540 cmd.exe 102 PID 2540 wrote to memory of 852 2540 cmd.exe 102 PID 2540 wrote to memory of 2944 2540 cmd.exe 103 PID 2540 wrote to memory of 2944 2540 cmd.exe 103 PID 2540 wrote to memory of 2944 2540 cmd.exe 103 PID 2540 wrote to memory of 2712 2540 cmd.exe 104 PID 2540 wrote to memory of 2712 2540 cmd.exe 104 PID 2540 wrote to memory of 2712 2540 cmd.exe 104 PID 2540 wrote to memory of 1616 2540 cmd.exe 105 PID 2540 wrote to memory of 1616 2540 cmd.exe 105 PID 2540 wrote to memory of 1616 2540 cmd.exe 105 PID 2540 wrote to memory of 3412 2540 cmd.exe 106 PID 2540 wrote to memory of 3412 2540 cmd.exe 106 PID 2540 wrote to memory of 3412 2540 cmd.exe 106 PID 2540 wrote to memory of 4936 2540 cmd.exe 107 PID 2540 wrote to memory of 4936 2540 cmd.exe 107 PID 2540 wrote to memory of 4936 2540 cmd.exe 107 PID 2540 wrote to memory of 4020 2540 cmd.exe 108 PID 2540 wrote to memory of 4020 2540 cmd.exe 108 PID 2540 wrote to memory of 4020 2540 cmd.exe 108 PID 2540 wrote to memory of 2776 2540 cmd.exe 109 PID 2540 wrote to memory of 2776 2540 cmd.exe 109 PID 2540 wrote to memory of 2776 2540 cmd.exe 109 PID 2540 wrote to memory of 3372 2540 cmd.exe 110 PID 2540 wrote to memory of 3372 2540 cmd.exe 110 PID 2540 wrote to memory of 3372 2540 cmd.exe 110 PID 2540 wrote to memory of 4536 2540 cmd.exe 111 PID 2540 wrote to memory of 4536 2540 cmd.exe 111 PID 2540 wrote to memory of 4536 2540 cmd.exe 111 PID 2540 wrote to memory of 5080 2540 cmd.exe 112 PID 2540 wrote to memory of 5080 2540 cmd.exe 112 PID 2540 wrote to memory of 5080 2540 cmd.exe 112 PID 2540 wrote to memory of 5108 2540 cmd.exe 113 PID 2540 wrote to memory of 5108 2540 cmd.exe 113 PID 2540 wrote to memory of 5108 2540 cmd.exe 113 PID 2540 wrote to memory of 3212 2540 cmd.exe 114
Processes
-
C:\Users\Admin\AppData\Local\Temp\7eaf913bed26f384d6ce46b787fdb57e.exe"C:\Users\Admin\AppData\Local\Temp\7eaf913bed26f384d6ce46b787fdb57e.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3396 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\756E.tmp\BitDefender.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM About.exe /T3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2292
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM bdagent.exe /T3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4864
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM bdfvcl.exe /T3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5076
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM bdfvwiz.exe /T3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2164
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM BDInProcPatch.exe /T3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3444
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM BDMsnScan.exe /T3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:800
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM bdreinit.exe /T3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1096
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM bdsubwiz.exe /T3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3732
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM BDSurvey.exe /T3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:852
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM bdtkexec.exe /T3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2944
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM bdwizreg.exe /T3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2712
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM cleanIELow.exe /T3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1616
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM History.exe /T3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3412
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM IEShow.exe /T3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4936
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM JsRcGen.exe /T3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4020
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM ODSW.exe /T3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2776
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM seccenter.exe /T3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3372
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM signcheck.exe /T3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4536
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM uiscan.exe /T3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5080
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM vsserv.exe /T3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5108
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM wscfxas.exe /T3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3212
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM wscfxav.exe /T3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1932
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM wscfxfw.exe /T3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2464
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM backup.exe /T3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4772
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM burnermgm.exe /T3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2400
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM burniso.exe /T3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4856
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM cdburner.exe /T3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3628
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
915B
MD5ecf69f7a7fb8730a61073a412bb24eef
SHA14ad92db033d0600800fdc2aec2c5416adde68202
SHA25664fbf208d185770aadbd39458260d764ff149686d35df6d85354246ebdc8aeb4
SHA51237890b7f3217f4f0611645252f67a63c6d9c9f112770f0c7b4266397ba4a7d2bdc497e7881a8dddff6c881a0b710c3ff4f9a1d97c03d653cab30de2a986cf563