Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    20s
  • max time network
    40s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    30/12/2023, 09:14

General

  • Target

    1439376092c634d9eb140b6bdd5d5da2.exe

  • Size

    588KB

  • MD5

    1439376092c634d9eb140b6bdd5d5da2

  • SHA1

    a70dce90a364a5cc931ab52eadd112de70aec928

  • SHA256

    23c4635ac2f3218402a7cb75be9d9e1b59df8ca75894875947995f674a44c2ba

  • SHA512

    8733f733904609690b0ff10d1c00dcb91b6bdbb4d7005f7bee15ac7897501d0fab82b7a027f237568a39b61b23dee376347343955a5be32cbc42a74596d1b6d3

  • SSDEEP

    12288:BIhD71J+nLzq5LLvza9WKL6WrqdIJ6XZcnYl2Hovz6tuBth:BIhDH+nLGZvAlcIJRYGorwu

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 10 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 31 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1439376092c634d9eb140b6bdd5d5da2.exe
    "C:\Users\Admin\AppData\Local\Temp\1439376092c634d9eb140b6bdd5d5da2.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2316
    • C:\Users\Admin\AppData\Local\Temp\bdbcabfcecah.exe
      C:\Users\Admin\AppData\Local\Temp\bdbcabfcecah.exe 9-4-0-8-1-2-4-4-0-2-9 JkxJPDwxLC4yHiZKUUJISEI5LCAtRTxQV0dRSUVAPS4XJkBJS1NHQDkyLikwMyAnQkdAOTAeJkdOTzxUQVBbSUI0KDI5LB8tT0FSVDxJW1VKSztkcHRuMSYrc11xdCpwaGMkWGxwJWNfcF0uZ2VdayAnQkpFP0tHOzRzN0ZNM0RANj84P05BPVBGLEVNMEg5LFEYLkItOTM0LCsxMhguQi45LS8XJkAzNSwvHCtEMjQkLSAnQzM5KTEeJkdOTzxUQVBbUFBATT1DUTweK0xSTTtMP1RXRFNIPT0eJkdOTzxUQVBbTj9EPDkgJ0RWQVtVUEM0HC89V0NbP01CQ0BKRTUfLURLU1JWOU5PT1JDTjkyHiZLREFGSldLUV9TSUM5ICdVSzkuIC07Si09GC5QUUpUR0Q8W1c9S0FLSUVHRDhDRU1RSjkcL0dKVk5VRlNHSUE9cmlsYSAnUUNQUVJMQEVDX01SQ05bRD9QSjkyGC5GRUBFVjQoHC9BUl1AVU4/REA/Xz1NQU5VUFI8OzlmWWtxYRwvQkZOSkxHQEJbRVA7KC40LjEzLDQzLjUtFytUQUxDOS00MCkuLTUxMS8cK0RNTkVITzlDXVBFTUM0KCszKS4wLC01KCkxMTIyLy8mTE0=
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:2724
      • C:\Windows\SysWOW64\Wbem\wmic.exe
        wmic /output:C:\Users\Admin\AppData\Local\Temp\81704130191.txt bios get serialnumber
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2932
      • C:\Windows\SysWOW64\Wbem\wmic.exe
        wmic /output:C:\Users\Admin\AppData\Local\Temp\81704130191.txt bios get version
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2624
      • C:\Windows\SysWOW64\Wbem\wmic.exe
        wmic /output:C:\Users\Admin\AppData\Local\Temp\81704130191.txt bios get version
        3⤵
          PID:2880
        • C:\Windows\SysWOW64\Wbem\wmic.exe
          wmic /output:C:\Users\Admin\AppData\Local\Temp\81704130191.txt bios get version
          3⤵
            PID:320
          • C:\Windows\SysWOW64\Wbem\wmic.exe
            wmic /output:C:\Users\Admin\AppData\Local\Temp\81704130191.txt bios get version
            3⤵
              PID:1700
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 2724 -s 372
              3⤵
              • Loads dropped DLL
              • Program crash
              PID:852

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\81704130191.txt

          Filesize

          66B

          MD5

          9025468f85256136f923096b01375964

          SHA1

          7fcd174999661594fa5f88890ffb195e9858cc52

          SHA256

          d5418014fa8e6e17d8992fd12c0dfecac8a34855603ea58133e87ea09c2130df

          SHA512

          92cac37c332e6e276a963d659986a79a79867df44682bfc2d77ed7784ffa5e2c149e5960a83d03ef4cf171be40a73e93a110aaa53b95152fa9a9da6b41d31e51

        • C:\Users\Admin\AppData\Local\Temp\81704130191.txt

          Filesize

          2B

          MD5

          f3b25701fe362ec84616a93a45ce9998

          SHA1

          d62636d8caec13f04e28442a0a6fa1afeb024bbb

          SHA256

          b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

          SHA512

          98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

        • C:\Users\Admin\AppData\Local\Temp\81704130191.txt

          Filesize

          58B

          MD5

          dd876faf0fd44a5fab3e82368e2e8b15

          SHA1

          01b04083fa278dda3a81705ca5abcfee487a3c90

          SHA256

          5602490a82bcacec8797d25cbb6f643fc9e69f89a2f0e6ec1e8d1f568e77a6b9

          SHA512

          e03d1def5b7fb0ed01a414cead199229ec0e153ff831d3ff5dd36c320572084c56a5e1369c753f868c855455758c0d308941b6187c348051419bd937d014cb8b

        • \Users\Admin\AppData\Local\Temp\bdbcabfcecah.exe

          Filesize

          822KB

          MD5

          20b487505c25c014a07a642b46cbf0d1

          SHA1

          5f404f20da8ecea1134269fce743642065d98377

          SHA256

          c9e0e813c015324f84841e002d5a8a1c0e6127fa5aa0ace6f591001030e4f1f4

          SHA512

          8b39482617f9a785eaabe6e87f8c0a15738a36d6d9cbe6716933bab55e7fdf7bfc46a8c1e32c3cae20d9317516fed931a8a81ca3f866145e30ce49c2a44fa4b5

        • \Users\Admin\AppData\Local\Temp\bdbcabfcecah.exe

          Filesize

          400KB

          MD5

          04fdd4829d970b9f69081f63573624cb

          SHA1

          c84f84776b5e9f68168a89856f661c6445598800

          SHA256

          78d279a247dbf415ad057830e66669e8cf798a5b64c7ed7a626540f33da82b72

          SHA512

          d80c51a7d652875460656e137d1b9921223f6fb1c18c9cff7fe0751917ee7c9276f68406065276de8436bf9afa87e36a8a88f8e711de841f6d3a79b1351fa161

        • \Users\Admin\AppData\Local\Temp\bdbcabfcecah.exe

          Filesize

          740KB

          MD5

          59fdc7ed72b66e177101f431868e1bce

          SHA1

          157defc497cf7cc7df04348cb899feb56b5265b3

          SHA256

          534e51ef4277e8b8d132018a02cf2dff759045727bb0c7c118cf12f2b8dbad1e

          SHA512

          f6ff124dc5fe361e93e0dde49578b4f6396fa694155adfa05e79adb68128463831bc8046b565a45fb77d72aab7154a178c97f29d6e4c8b0f0b80ed222b54bd46

        • \Users\Admin\AppData\Local\Temp\bdbcabfcecah.exe

          Filesize

          781KB

          MD5

          b68ebc821f864275148ae4f47380918e

          SHA1

          3cff845011945c5522a0258575c8aed4f0497b16

          SHA256

          41a56283107b0f886e70c551a318f685ecdcf74d188f2a0baea9d84853a75f49

          SHA512

          5560a23a4246d39af3421fa6e7e841fa95e9a6c8934bf8e870a2dc41d9bec4d309631c004ad533325296b8b5a5802a9237674ba531812de129ccb70eb8251d40

        • \Users\Admin\AppData\Local\Temp\bdbcabfcecah.exe

          Filesize

          783KB

          MD5

          e417c4a76475af6f75233293a0a320af

          SHA1

          41775e85b90d9a79ffb8fd6d7ff9020368ad1bfd

          SHA256

          750702db1883d80ea06b2200267763425002095feb10ca9c008d3f0792ee89fe

          SHA512

          80f562b1e902847d922874b76f4b4118e7b8c46da672c360694732f7f79847ba09dff6fedfd8fd81a2d415af48549ec6488f531d1dc234ae7c76bd8ab309791e

        • \Users\Admin\AppData\Local\Temp\bdbcabfcecah.exe

          Filesize

          290KB

          MD5

          17a3a5dd877d8e0f63d8311754a294bf

          SHA1

          9add144c794d0dc42f8aa35e07ab3c7ee5dc6537

          SHA256

          d4b00bbca97799e70dc7f94dd8d3e12896f072e808cdc2f7da08de4d08c23661

          SHA512

          fb71977b5f7e3b6c6ecdcabda901df812d2ec8344cfa551f0fd6483eabb6e5cadfd58be1abce1bbaee770da7e6d4e3889fad231bf5b35471119bc3c586c3bcd5

        • \Users\Admin\AppData\Local\Temp\nsdD5D6.tmp\nsisunz.dll

          Filesize

          40KB

          MD5

          5f13dbc378792f23e598079fc1e4422b

          SHA1

          5813c05802f15930aa860b8363af2b58426c8adf

          SHA256

          6e87ecb7f62039fbb6e7676422d1a5e75a32b90dde6865dcb68ee658ba8df61d

          SHA512

          9270635a5294482f49e0292e26d45dd103b85fe27dc163d44531b095c5f9dbde6b904adaf1a888ba3c112a094380394713c796f5195b2566a20f00b42b6578e5

        • \Users\Admin\AppData\Local\Temp\nsdD5D6.tmp\ob01.dll

          Filesize

          121KB

          MD5

          6ed2f00aec610b16f715dd15876e9af2

          SHA1

          707359b17a4ec8d3dd010646ca0666f84ed4e23e

          SHA256

          3a0a90303add21f5df32d0fcceaf96837fc29bc4f15e410862172bf300edea97

          SHA512

          332f49a49e9d789d8af5fdae952a16cb7db69ec8b3679245297726fff2fdfc1f070524b070fa041311ad8b152558d3f4bd0d5b6fc445dfcddb5a76a894551581