Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
16/01/2024, 23:27
Static task
static1
Behavioral task
behavioral1
Sample
612573b52e295ad8712af2a901d7f43c.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
612573b52e295ad8712af2a901d7f43c.exe
Resource
win10v2004-20231215-en
General
-
Target
612573b52e295ad8712af2a901d7f43c.exe
-
Size
60KB
-
MD5
612573b52e295ad8712af2a901d7f43c
-
SHA1
0a82efa1a4bd688bbb813018befd9312e962e455
-
SHA256
d92f59c8bcd52ff02fd0f769cb91193b1af3fc101ef6b036337446a5174ee7b7
-
SHA512
674563ab5b9914878fe6a724b07a69dd83d0c6a6070bf2b59430b0d3d4439e9930e583bb7424223bfeac73b1558cfbe806c3aa7e784e2120b0948b768d6afe4f
-
SSDEEP
768:NOucKn7n1JMDNANIUHvLDwUzc80gmq3oP/oDT:NO2MDNAPPr/0O8/oP
Malware Config
Signatures
-
Nitro
A ransomware that demands Discord nitro gift codes to decrypt files.
-
Renames multiple (94) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NR = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\612573b52e295ad8712af2a901d7f43c.exe\"" 612573b52e295ad8712af2a901d7f43c.exe -
Drops desktop.ini file(s) 5 IoCs
description ioc Process File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini 612573b52e295ad8712af2a901d7f43c.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini 612573b52e295ad8712af2a901d7f43c.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 612573b52e295ad8712af2a901d7f43c.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 612573b52e295ad8712af2a901d7f43c.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 612573b52e295ad8712af2a901d7f43c.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 9 api.ipify.org 10 api.ipify.org -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Roaming\\wallpaper.png" 612573b52e295ad8712af2a901d7f43c.exe -
Program crash 2 IoCs
pid pid_target Process procid_target 1500 4484 WerFault.exe 84 4768 4484 WerFault.exe 84 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4484 612573b52e295ad8712af2a901d7f43c.exe 4484 612573b52e295ad8712af2a901d7f43c.exe -
Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeDebugPrivilege 4484 612573b52e295ad8712af2a901d7f43c.exe Token: SeIncreaseQuotaPrivilege 2428 WMIC.exe Token: SeSecurityPrivilege 2428 WMIC.exe Token: SeTakeOwnershipPrivilege 2428 WMIC.exe Token: SeLoadDriverPrivilege 2428 WMIC.exe Token: SeSystemProfilePrivilege 2428 WMIC.exe Token: SeSystemtimePrivilege 2428 WMIC.exe Token: SeProfSingleProcessPrivilege 2428 WMIC.exe Token: SeIncBasePriorityPrivilege 2428 WMIC.exe Token: SeCreatePagefilePrivilege 2428 WMIC.exe Token: SeBackupPrivilege 2428 WMIC.exe Token: SeRestorePrivilege 2428 WMIC.exe Token: SeShutdownPrivilege 2428 WMIC.exe Token: SeDebugPrivilege 2428 WMIC.exe Token: SeSystemEnvironmentPrivilege 2428 WMIC.exe Token: SeRemoteShutdownPrivilege 2428 WMIC.exe Token: SeUndockPrivilege 2428 WMIC.exe Token: SeManageVolumePrivilege 2428 WMIC.exe Token: 33 2428 WMIC.exe Token: 34 2428 WMIC.exe Token: 35 2428 WMIC.exe Token: 36 2428 WMIC.exe Token: SeIncreaseQuotaPrivilege 2428 WMIC.exe Token: SeSecurityPrivilege 2428 WMIC.exe Token: SeTakeOwnershipPrivilege 2428 WMIC.exe Token: SeLoadDriverPrivilege 2428 WMIC.exe Token: SeSystemProfilePrivilege 2428 WMIC.exe Token: SeSystemtimePrivilege 2428 WMIC.exe Token: SeProfSingleProcessPrivilege 2428 WMIC.exe Token: SeIncBasePriorityPrivilege 2428 WMIC.exe Token: SeCreatePagefilePrivilege 2428 WMIC.exe Token: SeBackupPrivilege 2428 WMIC.exe Token: SeRestorePrivilege 2428 WMIC.exe Token: SeShutdownPrivilege 2428 WMIC.exe Token: SeDebugPrivilege 2428 WMIC.exe Token: SeSystemEnvironmentPrivilege 2428 WMIC.exe Token: SeRemoteShutdownPrivilege 2428 WMIC.exe Token: SeUndockPrivilege 2428 WMIC.exe Token: SeManageVolumePrivilege 2428 WMIC.exe Token: 33 2428 WMIC.exe Token: 34 2428 WMIC.exe Token: 35 2428 WMIC.exe Token: 36 2428 WMIC.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4484 wrote to memory of 3748 4484 612573b52e295ad8712af2a901d7f43c.exe 87 PID 4484 wrote to memory of 3748 4484 612573b52e295ad8712af2a901d7f43c.exe 87 PID 4484 wrote to memory of 3748 4484 612573b52e295ad8712af2a901d7f43c.exe 87 PID 3748 wrote to memory of 2428 3748 cmd.exe 90 PID 3748 wrote to memory of 2428 3748 cmd.exe 90 PID 3748 wrote to memory of 2428 3748 cmd.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\612573b52e295ad8712af2a901d7f43c.exe"C:\Users\Admin\AppData\Local\Temp\612573b52e295ad8712af2a901d7f43c.exe"1⤵
- Adds Run key to start application
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3748 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic csproduct get uuid3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2428
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4484 -s 21962⤵
- Program crash
PID:1500
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4484 -s 21962⤵
- Program crash
PID:4768
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4484 -ip 44841⤵PID:1540
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4484 -ip 44841⤵PID:5076