Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
04/02/2024, 06:14
Static task
static1
Behavioral task
behavioral1
Sample
8e6c0da213c278e63ae692a8dafe15e9.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
8e6c0da213c278e63ae692a8dafe15e9.exe
Resource
win10v2004-20231215-en
General
-
Target
8e6c0da213c278e63ae692a8dafe15e9.exe
-
Size
60KB
-
MD5
8e6c0da213c278e63ae692a8dafe15e9
-
SHA1
f8e74cbbb667e0d60699e7b19ce4b688a468f082
-
SHA256
602908a365ea6602535c825d2b7423ecb4a4ce5597b3114be289794a7a54d7ca
-
SHA512
09d7d811aa5d1bf9414417bc6cd5e45758ca0e47e172e8b8c65c16e390d6641a5b59dcb01737425ce840075e81da382cea744bcde185070a862164de92fae3f1
-
SSDEEP
768:POucKn7n1JGDNANIUqLyovLDwUzc80gmq3oP/oDas:PO2GDNAPquer/0O8/oF
Malware Config
Signatures
-
Nitro
A ransomware that demands Discord nitro gift codes to decrypt files.
-
Renames multiple (81) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NR = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\8e6c0da213c278e63ae692a8dafe15e9.exe\"" 8e6c0da213c278e63ae692a8dafe15e9.exe -
Drops desktop.ini file(s) 5 IoCs
description ioc Process File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini 8e6c0da213c278e63ae692a8dafe15e9.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 8e6c0da213c278e63ae692a8dafe15e9.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 8e6c0da213c278e63ae692a8dafe15e9.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 8e6c0da213c278e63ae692a8dafe15e9.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini 8e6c0da213c278e63ae692a8dafe15e9.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs
flow ioc 20 discord.com 48 discord.com 13 discord.com 14 discord.com 18 discord.com 19 discord.com -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 6 api.ipify.org 8 api.ipify.org -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Roaming\\wallpaper.png" 8e6c0da213c278e63ae692a8dafe15e9.exe -
Program crash 2 IoCs
pid pid_target Process procid_target 912 4332 WerFault.exe 83 4536 4332 WerFault.exe 83 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4332 8e6c0da213c278e63ae692a8dafe15e9.exe 4332 8e6c0da213c278e63ae692a8dafe15e9.exe -
Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeDebugPrivilege 4332 8e6c0da213c278e63ae692a8dafe15e9.exe Token: SeIncreaseQuotaPrivilege 764 WMIC.exe Token: SeSecurityPrivilege 764 WMIC.exe Token: SeTakeOwnershipPrivilege 764 WMIC.exe Token: SeLoadDriverPrivilege 764 WMIC.exe Token: SeSystemProfilePrivilege 764 WMIC.exe Token: SeSystemtimePrivilege 764 WMIC.exe Token: SeProfSingleProcessPrivilege 764 WMIC.exe Token: SeIncBasePriorityPrivilege 764 WMIC.exe Token: SeCreatePagefilePrivilege 764 WMIC.exe Token: SeBackupPrivilege 764 WMIC.exe Token: SeRestorePrivilege 764 WMIC.exe Token: SeShutdownPrivilege 764 WMIC.exe Token: SeDebugPrivilege 764 WMIC.exe Token: SeSystemEnvironmentPrivilege 764 WMIC.exe Token: SeRemoteShutdownPrivilege 764 WMIC.exe Token: SeUndockPrivilege 764 WMIC.exe Token: SeManageVolumePrivilege 764 WMIC.exe Token: 33 764 WMIC.exe Token: 34 764 WMIC.exe Token: 35 764 WMIC.exe Token: 36 764 WMIC.exe Token: SeIncreaseQuotaPrivilege 764 WMIC.exe Token: SeSecurityPrivilege 764 WMIC.exe Token: SeTakeOwnershipPrivilege 764 WMIC.exe Token: SeLoadDriverPrivilege 764 WMIC.exe Token: SeSystemProfilePrivilege 764 WMIC.exe Token: SeSystemtimePrivilege 764 WMIC.exe Token: SeProfSingleProcessPrivilege 764 WMIC.exe Token: SeIncBasePriorityPrivilege 764 WMIC.exe Token: SeCreatePagefilePrivilege 764 WMIC.exe Token: SeBackupPrivilege 764 WMIC.exe Token: SeRestorePrivilege 764 WMIC.exe Token: SeShutdownPrivilege 764 WMIC.exe Token: SeDebugPrivilege 764 WMIC.exe Token: SeSystemEnvironmentPrivilege 764 WMIC.exe Token: SeRemoteShutdownPrivilege 764 WMIC.exe Token: SeUndockPrivilege 764 WMIC.exe Token: SeManageVolumePrivilege 764 WMIC.exe Token: 33 764 WMIC.exe Token: 34 764 WMIC.exe Token: 35 764 WMIC.exe Token: 36 764 WMIC.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4332 wrote to memory of 4468 4332 8e6c0da213c278e63ae692a8dafe15e9.exe 84 PID 4332 wrote to memory of 4468 4332 8e6c0da213c278e63ae692a8dafe15e9.exe 84 PID 4332 wrote to memory of 4468 4332 8e6c0da213c278e63ae692a8dafe15e9.exe 84 PID 4468 wrote to memory of 764 4468 cmd.exe 86 PID 4468 wrote to memory of 764 4468 cmd.exe 86 PID 4468 wrote to memory of 764 4468 cmd.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\8e6c0da213c278e63ae692a8dafe15e9.exe"C:\Users\Admin\AppData\Local\Temp\8e6c0da213c278e63ae692a8dafe15e9.exe"1⤵
- Adds Run key to start application
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic csproduct get uuid3⤵
- Suspicious use of AdjustPrivilegeToken
PID:764
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4332 -s 21722⤵
- Program crash
PID:912
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4332 -s 21922⤵
- Program crash
PID:4536
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4332 -ip 43321⤵PID:2612
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4332 -ip 43321⤵PID:1700