Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
31/12/2023, 06:43
Static task
static1
Behavioral task
behavioral1
Sample
2c0fc7570fab97c9725894c8e45167a3.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2c0fc7570fab97c9725894c8e45167a3.exe
Resource
win10v2004-20231215-en
General
-
Target
2c0fc7570fab97c9725894c8e45167a3.exe
-
Size
265KB
-
MD5
2c0fc7570fab97c9725894c8e45167a3
-
SHA1
bc8f4036ac058973fac88279079f03d2c4aa66be
-
SHA256
33ed82e6b9624768b9026fb3028e4675478ca16087c65de96ac73f2499a2c010
-
SHA512
d54ee4c77e078915fe7ec59a698daa6984971d76329f29437d6ca5770571b07bbeef3ae5d49ee4cee2f67e469c471f48f659fff6993059fd671a41e61b6fd780
-
SSDEEP
3072:55kvidC2VRT3U64T6k6NwJslkkW4Gviuy/LH+SlckLU0wS+dIzd8Fmr:zkqkoSzJ2XCviuy/NckLU0Vd8Fmr
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2772 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 2716 wigap.exe -
Loads dropped DLL 4 IoCs
pid Process 2772 cmd.exe 2772 cmd.exe 2716 wigap.exe 2716 wigap.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Kills process with taskkill 1 IoCs
pid Process 2688 taskkill.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2564 PING.EXE -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2716 wigap.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2716 wigap.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2688 taskkill.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 2716 wigap.exe 2716 wigap.exe 2716 wigap.exe -
Suspicious use of SendNotifyMessage 3 IoCs
pid Process 2716 wigap.exe 2716 wigap.exe 2716 wigap.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 2220 wrote to memory of 2772 2220 2c0fc7570fab97c9725894c8e45167a3.exe 28 PID 2220 wrote to memory of 2772 2220 2c0fc7570fab97c9725894c8e45167a3.exe 28 PID 2220 wrote to memory of 2772 2220 2c0fc7570fab97c9725894c8e45167a3.exe 28 PID 2220 wrote to memory of 2772 2220 2c0fc7570fab97c9725894c8e45167a3.exe 28 PID 2772 wrote to memory of 2688 2772 cmd.exe 30 PID 2772 wrote to memory of 2688 2772 cmd.exe 30 PID 2772 wrote to memory of 2688 2772 cmd.exe 30 PID 2772 wrote to memory of 2688 2772 cmd.exe 30 PID 2772 wrote to memory of 2564 2772 cmd.exe 32 PID 2772 wrote to memory of 2564 2772 cmd.exe 32 PID 2772 wrote to memory of 2564 2772 cmd.exe 32 PID 2772 wrote to memory of 2564 2772 cmd.exe 32 PID 2772 wrote to memory of 2716 2772 cmd.exe 33 PID 2772 wrote to memory of 2716 2772 cmd.exe 33 PID 2772 wrote to memory of 2716 2772 cmd.exe 33 PID 2772 wrote to memory of 2716 2772 cmd.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\2c0fc7570fab97c9725894c8e45167a3.exe"C:\Users\Admin\AppData\Local\Temp\2c0fc7570fab97c9725894c8e45167a3.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /f /pid 2220 & ping -n 3 127.1 & del /f /q "C:\Users\Admin\AppData\Local\Temp\2c0fc7570fab97c9725894c8e45167a3.exe" & start C:\Users\Admin\AppData\Local\wigap.exe -f2⤵
- Deletes itself
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /pid 22203⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2688
-
-
C:\Windows\SysWOW64\PING.EXEping -n 3 127.13⤵
- Runs ping.exe
PID:2564
-
-
C:\Users\Admin\AppData\Local\wigap.exeC:\Users\Admin\AppData\Local\wigap.exe -f3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2716
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
265KB
MD52c0fc7570fab97c9725894c8e45167a3
SHA1bc8f4036ac058973fac88279079f03d2c4aa66be
SHA25633ed82e6b9624768b9026fb3028e4675478ca16087c65de96ac73f2499a2c010
SHA512d54ee4c77e078915fe7ec59a698daa6984971d76329f29437d6ca5770571b07bbeef3ae5d49ee4cee2f67e469c471f48f659fff6993059fd671a41e61b6fd780