Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
14/01/2024, 18:17
Behavioral task
behavioral1
Sample
5b85a5b655e5033f20951ad619687486.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
5b85a5b655e5033f20951ad619687486.exe
Resource
win10v2004-20231222-en
General
-
Target
5b85a5b655e5033f20951ad619687486.exe
-
Size
462KB
-
MD5
5b85a5b655e5033f20951ad619687486
-
SHA1
87614ac65b9cc6f76b3229925a4c911cfd72a270
-
SHA256
28563c403ddda0b2cc0ee8d0a186ad8ef008454b0404bda93e49672d49ddd5fd
-
SHA512
fac45fdafbfad1344ef908d6bf3fabc7f0b6b4eabdf2bfadb95d1798ddc7543079c161e6233d880748b4c3bf8cdc5828d2a2e02442c24284cac8a8a7eeaff1bf
-
SSDEEP
12288:lqCZtxipZaBJCTq3dO+tG2UCheQ+oSTj:lqCZHGSCTqa29Ut
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2780 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 2924 vmsgvz.exe -
Loads dropped DLL 2 IoCs
pid Process 2780 cmd.exe 2924 vmsgvz.exe -
resource yara_rule behavioral1/memory/2140-0-0x0000000001000000-0x00000000010E1000-memory.dmp upx behavioral1/files/0x000b000000012243-7.dat upx behavioral1/memory/2780-9-0x0000000002000000-0x00000000020E1000-memory.dmp upx behavioral1/memory/2924-11-0x0000000001000000-0x00000000010E1000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Kills process with taskkill 1 IoCs
pid Process 2988 taskkill.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2788 PING.EXE -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2988 taskkill.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 2140 wrote to memory of 2780 2140 5b85a5b655e5033f20951ad619687486.exe 28 PID 2140 wrote to memory of 2780 2140 5b85a5b655e5033f20951ad619687486.exe 28 PID 2140 wrote to memory of 2780 2140 5b85a5b655e5033f20951ad619687486.exe 28 PID 2140 wrote to memory of 2780 2140 5b85a5b655e5033f20951ad619687486.exe 28 PID 2780 wrote to memory of 2988 2780 cmd.exe 30 PID 2780 wrote to memory of 2988 2780 cmd.exe 30 PID 2780 wrote to memory of 2988 2780 cmd.exe 30 PID 2780 wrote to memory of 2988 2780 cmd.exe 30 PID 2780 wrote to memory of 2788 2780 cmd.exe 32 PID 2780 wrote to memory of 2788 2780 cmd.exe 32 PID 2780 wrote to memory of 2788 2780 cmd.exe 32 PID 2780 wrote to memory of 2788 2780 cmd.exe 32 PID 2780 wrote to memory of 2924 2780 cmd.exe 33 PID 2780 wrote to memory of 2924 2780 cmd.exe 33 PID 2780 wrote to memory of 2924 2780 cmd.exe 33 PID 2780 wrote to memory of 2924 2780 cmd.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\5b85a5b655e5033f20951ad619687486.exe"C:\Users\Admin\AppData\Local\Temp\5b85a5b655e5033f20951ad619687486.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /f /pid 2140 & ping -n 3 127.1 & del /f /q "C:\Users\Admin\AppData\Local\Temp\5b85a5b655e5033f20951ad619687486.exe" & start C:\Users\Admin\AppData\Local\vmsgvz.exe -f2⤵
- Deletes itself
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /pid 21403⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2988
-
-
C:\Windows\SysWOW64\PING.EXEping -n 3 127.13⤵
- Runs ping.exe
PID:2788
-
-
C:\Users\Admin\AppData\Local\vmsgvz.exeC:\Users\Admin\AppData\Local\vmsgvz.exe -f3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2924
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
462KB
MD55b85a5b655e5033f20951ad619687486
SHA187614ac65b9cc6f76b3229925a4c911cfd72a270
SHA25628563c403ddda0b2cc0ee8d0a186ad8ef008454b0404bda93e49672d49ddd5fd
SHA512fac45fdafbfad1344ef908d6bf3fabc7f0b6b4eabdf2bfadb95d1798ddc7543079c161e6233d880748b4c3bf8cdc5828d2a2e02442c24284cac8a8a7eeaff1bf