Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
134s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
28/01/2024, 21:59
Static task
static1
Behavioral task
behavioral1
Sample
7e1cba21f7a7b01fbcef46990c41884d.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
7e1cba21f7a7b01fbcef46990c41884d.exe
Resource
win10v2004-20231215-en
General
-
Target
7e1cba21f7a7b01fbcef46990c41884d.exe
-
Size
60KB
-
MD5
7e1cba21f7a7b01fbcef46990c41884d
-
SHA1
a384951086aa20d842b85f3225b27775333e01d5
-
SHA256
33b7ab781db25b68797335f9248fad623fdc24267b71749ab2bfca02dd6a29aa
-
SHA512
8caf1b89425bb0a5f8462d0e892a760b24e2ce7bf59cdfa08798faabbd0201aea96352715acf8fba6bbfb02c0b9bbb383c64c3a6f60a7c2cda593aca67291f8a
-
SSDEEP
1536:HN8yaTT80wUq63kXSWLu5Oo9RIpzWk1oPz:uya/VkXSWUXoWk1oP
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 5040 sript.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\sript.exe 7e1cba21f7a7b01fbcef46990c41884d.exe File opened for modification C:\Windows\SysWOW64\sript.exe 7e1cba21f7a7b01fbcef46990c41884d.exe -
Kills process with taskkill 4 IoCs
pid Process 2132 taskkill.exe 3580 taskkill.exe 3824 taskkill.exe 3496 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 2136 7e1cba21f7a7b01fbcef46990c41884d.exe 2136 7e1cba21f7a7b01fbcef46990c41884d.exe 2136 7e1cba21f7a7b01fbcef46990c41884d.exe 2136 7e1cba21f7a7b01fbcef46990c41884d.exe 5040 sript.exe 5040 sript.exe 5040 sript.exe 5040 sript.exe 5040 sript.exe 5040 sript.exe 5040 sript.exe 5040 sript.exe 5040 sript.exe 5040 sript.exe 5040 sript.exe 5040 sript.exe 5040 sript.exe 5040 sript.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2136 7e1cba21f7a7b01fbcef46990c41884d.exe Token: SeDebugPrivilege 2132 taskkill.exe Token: SeDebugPrivilege 3824 taskkill.exe Token: SeDebugPrivilege 3580 taskkill.exe Token: SeDebugPrivilege 3496 taskkill.exe -
Suspicious use of WriteProcessMemory 27 IoCs
description pid Process procid_target PID 2136 wrote to memory of 2916 2136 7e1cba21f7a7b01fbcef46990c41884d.exe 84 PID 2136 wrote to memory of 2916 2136 7e1cba21f7a7b01fbcef46990c41884d.exe 84 PID 2136 wrote to memory of 2916 2136 7e1cba21f7a7b01fbcef46990c41884d.exe 84 PID 2136 wrote to memory of 4644 2136 7e1cba21f7a7b01fbcef46990c41884d.exe 85 PID 2136 wrote to memory of 4644 2136 7e1cba21f7a7b01fbcef46990c41884d.exe 85 PID 2136 wrote to memory of 4644 2136 7e1cba21f7a7b01fbcef46990c41884d.exe 85 PID 5040 wrote to memory of 4312 5040 sript.exe 89 PID 5040 wrote to memory of 4312 5040 sript.exe 89 PID 5040 wrote to memory of 4312 5040 sript.exe 89 PID 5040 wrote to memory of 2016 5040 sript.exe 90 PID 5040 wrote to memory of 2016 5040 sript.exe 90 PID 5040 wrote to memory of 2016 5040 sript.exe 90 PID 2136 wrote to memory of 4524 2136 7e1cba21f7a7b01fbcef46990c41884d.exe 93 PID 2136 wrote to memory of 4524 2136 7e1cba21f7a7b01fbcef46990c41884d.exe 93 PID 2136 wrote to memory of 4524 2136 7e1cba21f7a7b01fbcef46990c41884d.exe 93 PID 2916 wrote to memory of 2132 2916 cmd.exe 94 PID 2916 wrote to memory of 2132 2916 cmd.exe 94 PID 2916 wrote to memory of 2132 2916 cmd.exe 94 PID 4644 wrote to memory of 3580 4644 cmd.exe 95 PID 4644 wrote to memory of 3580 4644 cmd.exe 95 PID 4644 wrote to memory of 3580 4644 cmd.exe 95 PID 4312 wrote to memory of 3824 4312 cmd.exe 96 PID 4312 wrote to memory of 3824 4312 cmd.exe 96 PID 4312 wrote to memory of 3824 4312 cmd.exe 96 PID 2016 wrote to memory of 3496 2016 cmd.exe 97 PID 2016 wrote to memory of 3496 2016 cmd.exe 97 PID 2016 wrote to memory of 3496 2016 cmd.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\7e1cba21f7a7b01fbcef46990c41884d.exe"C:\Users\Admin\AppData\Local\Temp\7e1cba21f7a7b01fbcef46990c41884d.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im rfwstub.exe2⤵
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im rfwstub.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2132
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im rfwproxy.exe2⤵
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im rfwproxy.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3580
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\7E1CBA~1.EXE > nul2⤵PID:4524
-
-
C:\Windows\SysWOW64\sript.exeC:\Windows\SysWOW64\sript.exe1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im rfwstub.exe2⤵
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im rfwstub.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3824
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im rfwproxy.exe2⤵
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im rfwproxy.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3496
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60KB
MD57e1cba21f7a7b01fbcef46990c41884d
SHA1a384951086aa20d842b85f3225b27775333e01d5
SHA25633b7ab781db25b68797335f9248fad623fdc24267b71749ab2bfca02dd6a29aa
SHA5128caf1b89425bb0a5f8462d0e892a760b24e2ce7bf59cdfa08798faabbd0201aea96352715acf8fba6bbfb02c0b9bbb383c64c3a6f60a7c2cda593aca67291f8a