Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
20s -
max time network
40s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
30/12/2023, 09:14
Static task
static1
Behavioral task
behavioral1
Sample
1439376092c634d9eb140b6bdd5d5da2.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
1439376092c634d9eb140b6bdd5d5da2.exe
Resource
win10v2004-20231215-en
General
-
Target
1439376092c634d9eb140b6bdd5d5da2.exe
-
Size
588KB
-
MD5
1439376092c634d9eb140b6bdd5d5da2
-
SHA1
a70dce90a364a5cc931ab52eadd112de70aec928
-
SHA256
23c4635ac2f3218402a7cb75be9d9e1b59df8ca75894875947995f674a44c2ba
-
SHA512
8733f733904609690b0ff10d1c00dcb91b6bdbb4d7005f7bee15ac7897501d0fab82b7a027f237568a39b61b23dee376347343955a5be32cbc42a74596d1b6d3
-
SSDEEP
12288:BIhD71J+nLzq5LLvza9WKL6WrqdIJ6XZcnYl2Hovz6tuBth:BIhDH+nLGZvAlcIJRYGorwu
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2724 bdbcabfcecah.exe -
Loads dropped DLL 10 IoCs
pid Process 2316 1439376092c634d9eb140b6bdd5d5da2.exe 2316 1439376092c634d9eb140b6bdd5d5da2.exe 2316 1439376092c634d9eb140b6bdd5d5da2.exe 852 WerFault.exe 852 WerFault.exe 852 WerFault.exe 852 WerFault.exe 852 WerFault.exe 852 WerFault.exe 852 WerFault.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 852 2724 WerFault.exe 29 -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2932 wmic.exe Token: SeSecurityPrivilege 2932 wmic.exe Token: SeTakeOwnershipPrivilege 2932 wmic.exe Token: SeLoadDriverPrivilege 2932 wmic.exe Token: SeSystemProfilePrivilege 2932 wmic.exe Token: SeSystemtimePrivilege 2932 wmic.exe Token: SeProfSingleProcessPrivilege 2932 wmic.exe Token: SeIncBasePriorityPrivilege 2932 wmic.exe Token: SeCreatePagefilePrivilege 2932 wmic.exe Token: SeBackupPrivilege 2932 wmic.exe Token: SeRestorePrivilege 2932 wmic.exe Token: SeShutdownPrivilege 2932 wmic.exe Token: SeDebugPrivilege 2932 wmic.exe Token: SeSystemEnvironmentPrivilege 2932 wmic.exe Token: SeRemoteShutdownPrivilege 2932 wmic.exe Token: SeUndockPrivilege 2932 wmic.exe Token: SeManageVolumePrivilege 2932 wmic.exe Token: 33 2932 wmic.exe Token: 34 2932 wmic.exe Token: 35 2932 wmic.exe Token: SeIncreaseQuotaPrivilege 2932 wmic.exe Token: SeSecurityPrivilege 2932 wmic.exe Token: SeTakeOwnershipPrivilege 2932 wmic.exe Token: SeLoadDriverPrivilege 2932 wmic.exe Token: SeSystemProfilePrivilege 2932 wmic.exe Token: SeSystemtimePrivilege 2932 wmic.exe Token: SeProfSingleProcessPrivilege 2932 wmic.exe Token: SeIncBasePriorityPrivilege 2932 wmic.exe Token: SeCreatePagefilePrivilege 2932 wmic.exe Token: SeBackupPrivilege 2932 wmic.exe Token: SeRestorePrivilege 2932 wmic.exe Token: SeShutdownPrivilege 2932 wmic.exe Token: SeDebugPrivilege 2932 wmic.exe Token: SeSystemEnvironmentPrivilege 2932 wmic.exe Token: SeRemoteShutdownPrivilege 2932 wmic.exe Token: SeUndockPrivilege 2932 wmic.exe Token: SeManageVolumePrivilege 2932 wmic.exe Token: 33 2932 wmic.exe Token: 34 2932 wmic.exe Token: 35 2932 wmic.exe Token: SeIncreaseQuotaPrivilege 2624 wmic.exe Token: SeSecurityPrivilege 2624 wmic.exe Token: SeTakeOwnershipPrivilege 2624 wmic.exe Token: SeLoadDriverPrivilege 2624 wmic.exe Token: SeSystemProfilePrivilege 2624 wmic.exe Token: SeSystemtimePrivilege 2624 wmic.exe Token: SeProfSingleProcessPrivilege 2624 wmic.exe Token: SeIncBasePriorityPrivilege 2624 wmic.exe Token: SeCreatePagefilePrivilege 2624 wmic.exe Token: SeBackupPrivilege 2624 wmic.exe Token: SeRestorePrivilege 2624 wmic.exe Token: SeShutdownPrivilege 2624 wmic.exe Token: SeDebugPrivilege 2624 wmic.exe Token: SeSystemEnvironmentPrivilege 2624 wmic.exe Token: SeRemoteShutdownPrivilege 2624 wmic.exe Token: SeUndockPrivilege 2624 wmic.exe Token: SeManageVolumePrivilege 2624 wmic.exe Token: 33 2624 wmic.exe Token: 34 2624 wmic.exe Token: 35 2624 wmic.exe Token: SeIncreaseQuotaPrivilege 2624 wmic.exe Token: SeSecurityPrivilege 2624 wmic.exe Token: SeTakeOwnershipPrivilege 2624 wmic.exe Token: SeLoadDriverPrivilege 2624 wmic.exe -
Suspicious use of WriteProcessMemory 31 IoCs
description pid Process procid_target PID 2316 wrote to memory of 2724 2316 1439376092c634d9eb140b6bdd5d5da2.exe 29 PID 2316 wrote to memory of 2724 2316 1439376092c634d9eb140b6bdd5d5da2.exe 29 PID 2316 wrote to memory of 2724 2316 1439376092c634d9eb140b6bdd5d5da2.exe 29 PID 2316 wrote to memory of 2724 2316 1439376092c634d9eb140b6bdd5d5da2.exe 29 PID 2316 wrote to memory of 2724 2316 1439376092c634d9eb140b6bdd5d5da2.exe 29 PID 2316 wrote to memory of 2724 2316 1439376092c634d9eb140b6bdd5d5da2.exe 29 PID 2316 wrote to memory of 2724 2316 1439376092c634d9eb140b6bdd5d5da2.exe 29 PID 2724 wrote to memory of 2932 2724 bdbcabfcecah.exe 30 PID 2724 wrote to memory of 2932 2724 bdbcabfcecah.exe 30 PID 2724 wrote to memory of 2932 2724 bdbcabfcecah.exe 30 PID 2724 wrote to memory of 2932 2724 bdbcabfcecah.exe 30 PID 2724 wrote to memory of 2624 2724 bdbcabfcecah.exe 33 PID 2724 wrote to memory of 2624 2724 bdbcabfcecah.exe 33 PID 2724 wrote to memory of 2624 2724 bdbcabfcecah.exe 33 PID 2724 wrote to memory of 2624 2724 bdbcabfcecah.exe 33 PID 2724 wrote to memory of 2880 2724 bdbcabfcecah.exe 35 PID 2724 wrote to memory of 2880 2724 bdbcabfcecah.exe 35 PID 2724 wrote to memory of 2880 2724 bdbcabfcecah.exe 35 PID 2724 wrote to memory of 2880 2724 bdbcabfcecah.exe 35 PID 2724 wrote to memory of 320 2724 bdbcabfcecah.exe 37 PID 2724 wrote to memory of 320 2724 bdbcabfcecah.exe 37 PID 2724 wrote to memory of 320 2724 bdbcabfcecah.exe 37 PID 2724 wrote to memory of 320 2724 bdbcabfcecah.exe 37 PID 2724 wrote to memory of 1700 2724 bdbcabfcecah.exe 39 PID 2724 wrote to memory of 1700 2724 bdbcabfcecah.exe 39 PID 2724 wrote to memory of 1700 2724 bdbcabfcecah.exe 39 PID 2724 wrote to memory of 1700 2724 bdbcabfcecah.exe 39 PID 2724 wrote to memory of 852 2724 bdbcabfcecah.exe 41 PID 2724 wrote to memory of 852 2724 bdbcabfcecah.exe 41 PID 2724 wrote to memory of 852 2724 bdbcabfcecah.exe 41 PID 2724 wrote to memory of 852 2724 bdbcabfcecah.exe 41
Processes
-
C:\Users\Admin\AppData\Local\Temp\1439376092c634d9eb140b6bdd5d5da2.exe"C:\Users\Admin\AppData\Local\Temp\1439376092c634d9eb140b6bdd5d5da2.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\bdbcabfcecah.exeC:\Users\Admin\AppData\Local\Temp\bdbcabfcecah.exe 9-4-0-8-1-2-4-4-0-2-9 JkxJPDwxLC4yHiZKUUJISEI5LCAtRTxQV0dRSUVAPS4XJkBJS1NHQDkyLikwMyAnQkdAOTAeJkdOTzxUQVBbSUI0KDI5LB8tT0FSVDxJW1VKSztkcHRuMSYrc11xdCpwaGMkWGxwJWNfcF0uZ2VdayAnQkpFP0tHOzRzN0ZNM0RANj84P05BPVBGLEVNMEg5LFEYLkItOTM0LCsxMhguQi45LS8XJkAzNSwvHCtEMjQkLSAnQzM5KTEeJkdOTzxUQVBbUFBATT1DUTweK0xSTTtMP1RXRFNIPT0eJkdOTzxUQVBbTj9EPDkgJ0RWQVtVUEM0HC89V0NbP01CQ0BKRTUfLURLU1JWOU5PT1JDTjkyHiZLREFGSldLUV9TSUM5ICdVSzkuIC07Si09GC5QUUpUR0Q8W1c9S0FLSUVHRDhDRU1RSjkcL0dKVk5VRlNHSUE9cmlsYSAnUUNQUVJMQEVDX01SQ05bRD9QSjkyGC5GRUBFVjQoHC9BUl1AVU4/REA/Xz1NQU5VUFI8OzlmWWtxYRwvQkZOSkxHQEJbRVA7KC40LjEzLDQzLjUtFytUQUxDOS00MCkuLTUxMS8cK0RNTkVITzlDXVBFTUM0KCszKS4wLC01KCkxMTIyLy8mTE0=2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81704130191.txt bios get serialnumber3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2932
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81704130191.txt bios get version3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2624
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81704130191.txt bios get version3⤵PID:2880
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81704130191.txt bios get version3⤵PID:320
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81704130191.txt bios get version3⤵PID:1700
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2724 -s 3723⤵
- Loads dropped DLL
- Program crash
PID:852
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
66B
MD59025468f85256136f923096b01375964
SHA17fcd174999661594fa5f88890ffb195e9858cc52
SHA256d5418014fa8e6e17d8992fd12c0dfecac8a34855603ea58133e87ea09c2130df
SHA51292cac37c332e6e276a963d659986a79a79867df44682bfc2d77ed7784ffa5e2c149e5960a83d03ef4cf171be40a73e93a110aaa53b95152fa9a9da6b41d31e51
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
Filesize
58B
MD5dd876faf0fd44a5fab3e82368e2e8b15
SHA101b04083fa278dda3a81705ca5abcfee487a3c90
SHA2565602490a82bcacec8797d25cbb6f643fc9e69f89a2f0e6ec1e8d1f568e77a6b9
SHA512e03d1def5b7fb0ed01a414cead199229ec0e153ff831d3ff5dd36c320572084c56a5e1369c753f868c855455758c0d308941b6187c348051419bd937d014cb8b
-
Filesize
822KB
MD520b487505c25c014a07a642b46cbf0d1
SHA15f404f20da8ecea1134269fce743642065d98377
SHA256c9e0e813c015324f84841e002d5a8a1c0e6127fa5aa0ace6f591001030e4f1f4
SHA5128b39482617f9a785eaabe6e87f8c0a15738a36d6d9cbe6716933bab55e7fdf7bfc46a8c1e32c3cae20d9317516fed931a8a81ca3f866145e30ce49c2a44fa4b5
-
Filesize
400KB
MD504fdd4829d970b9f69081f63573624cb
SHA1c84f84776b5e9f68168a89856f661c6445598800
SHA25678d279a247dbf415ad057830e66669e8cf798a5b64c7ed7a626540f33da82b72
SHA512d80c51a7d652875460656e137d1b9921223f6fb1c18c9cff7fe0751917ee7c9276f68406065276de8436bf9afa87e36a8a88f8e711de841f6d3a79b1351fa161
-
Filesize
740KB
MD559fdc7ed72b66e177101f431868e1bce
SHA1157defc497cf7cc7df04348cb899feb56b5265b3
SHA256534e51ef4277e8b8d132018a02cf2dff759045727bb0c7c118cf12f2b8dbad1e
SHA512f6ff124dc5fe361e93e0dde49578b4f6396fa694155adfa05e79adb68128463831bc8046b565a45fb77d72aab7154a178c97f29d6e4c8b0f0b80ed222b54bd46
-
Filesize
781KB
MD5b68ebc821f864275148ae4f47380918e
SHA13cff845011945c5522a0258575c8aed4f0497b16
SHA25641a56283107b0f886e70c551a318f685ecdcf74d188f2a0baea9d84853a75f49
SHA5125560a23a4246d39af3421fa6e7e841fa95e9a6c8934bf8e870a2dc41d9bec4d309631c004ad533325296b8b5a5802a9237674ba531812de129ccb70eb8251d40
-
Filesize
783KB
MD5e417c4a76475af6f75233293a0a320af
SHA141775e85b90d9a79ffb8fd6d7ff9020368ad1bfd
SHA256750702db1883d80ea06b2200267763425002095feb10ca9c008d3f0792ee89fe
SHA51280f562b1e902847d922874b76f4b4118e7b8c46da672c360694732f7f79847ba09dff6fedfd8fd81a2d415af48549ec6488f531d1dc234ae7c76bd8ab309791e
-
Filesize
290KB
MD517a3a5dd877d8e0f63d8311754a294bf
SHA19add144c794d0dc42f8aa35e07ab3c7ee5dc6537
SHA256d4b00bbca97799e70dc7f94dd8d3e12896f072e808cdc2f7da08de4d08c23661
SHA512fb71977b5f7e3b6c6ecdcabda901df812d2ec8344cfa551f0fd6483eabb6e5cadfd58be1abce1bbaee770da7e6d4e3889fad231bf5b35471119bc3c586c3bcd5
-
Filesize
40KB
MD55f13dbc378792f23e598079fc1e4422b
SHA15813c05802f15930aa860b8363af2b58426c8adf
SHA2566e87ecb7f62039fbb6e7676422d1a5e75a32b90dde6865dcb68ee658ba8df61d
SHA5129270635a5294482f49e0292e26d45dd103b85fe27dc163d44531b095c5f9dbde6b904adaf1a888ba3c112a094380394713c796f5195b2566a20f00b42b6578e5
-
Filesize
121KB
MD56ed2f00aec610b16f715dd15876e9af2
SHA1707359b17a4ec8d3dd010646ca0666f84ed4e23e
SHA2563a0a90303add21f5df32d0fcceaf96837fc29bc4f15e410862172bf300edea97
SHA512332f49a49e9d789d8af5fdae952a16cb7db69ec8b3679245297726fff2fdfc1f070524b070fa041311ad8b152558d3f4bd0d5b6fc445dfcddb5a76a894551581