Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
12/02/2024, 04:41
Behavioral task
behavioral1
Sample
7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe
Resource
win7-20231129-en
windows7-x64
9 signatures
150 seconds
General
-
Target
7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe
-
Size
4.2MB
-
MD5
c9a36a7e0bf431dafe139b1cc18609ed
-
SHA1
4d77f0d31e994d3baeba164238634cadaf95fb77
-
SHA256
7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3
-
SHA512
1cdc8cf07dc0b3d83d5f07e1de8bc60a9b5f0f568087f0cc740cc64492eb609e171c4f93eaad37abd9e4f018ed7983f2cdfe991309f6797572d9ee45fa0b8b96
-
SSDEEP
98304:6PSzwcdHYUcyX4eHU0hU/cSuijBf1ULKPQ1w9VOO6GQgjIkU:WS0cJ59U0hUkx6f1g1w9CGQ2I
Malware Config
Signatures
-
UPX dump on OEP (original entry point) 2 IoCs
resource yara_rule behavioral1/memory/2928-0-0x000000013FFA0000-0x0000000140C18000-memory.dmp UPX behavioral1/memory/2928-10-0x000000013FFA0000-0x0000000140C18000-memory.dmp UPX -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral1/memory/2928-0-0x000000013FFA0000-0x0000000140C18000-memory.dmp upx behavioral1/memory/2928-10-0x000000013FFA0000-0x0000000140C18000-memory.dmp upx -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 2 ipinfo.io -
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 2580 wmic.exe -
GoLang User-Agent 1 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
description flow ioc HTTP User-Agent header 3 Go-http-client/1.1 -
Suspicious behavior: EnumeratesProcesses 30 IoCs
pid Process 2928 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 2928 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 2928 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 2928 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 2928 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 2928 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 2928 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 2928 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 2928 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 2928 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 2928 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 2928 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 2928 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 2928 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 2928 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 2928 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 2928 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 2928 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 2928 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 2928 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 2928 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 2928 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 2928 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 2928 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 2928 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 2928 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 2928 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 2928 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 2928 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 2928 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2928 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe Token: SeIncreaseQuotaPrivilege 3064 wmic.exe Token: SeSecurityPrivilege 3064 wmic.exe Token: SeTakeOwnershipPrivilege 3064 wmic.exe Token: SeLoadDriverPrivilege 3064 wmic.exe Token: SeSystemProfilePrivilege 3064 wmic.exe Token: SeSystemtimePrivilege 3064 wmic.exe Token: SeProfSingleProcessPrivilege 3064 wmic.exe Token: SeIncBasePriorityPrivilege 3064 wmic.exe Token: SeCreatePagefilePrivilege 3064 wmic.exe Token: SeBackupPrivilege 3064 wmic.exe Token: SeRestorePrivilege 3064 wmic.exe Token: SeShutdownPrivilege 3064 wmic.exe Token: SeDebugPrivilege 3064 wmic.exe Token: SeSystemEnvironmentPrivilege 3064 wmic.exe Token: SeRemoteShutdownPrivilege 3064 wmic.exe Token: SeUndockPrivilege 3064 wmic.exe Token: SeManageVolumePrivilege 3064 wmic.exe Token: 33 3064 wmic.exe Token: 34 3064 wmic.exe Token: 35 3064 wmic.exe Token: SeIncreaseQuotaPrivilege 3064 wmic.exe Token: SeSecurityPrivilege 3064 wmic.exe Token: SeTakeOwnershipPrivilege 3064 wmic.exe Token: SeLoadDriverPrivilege 3064 wmic.exe Token: SeSystemProfilePrivilege 3064 wmic.exe Token: SeSystemtimePrivilege 3064 wmic.exe Token: SeProfSingleProcessPrivilege 3064 wmic.exe Token: SeIncBasePriorityPrivilege 3064 wmic.exe Token: SeCreatePagefilePrivilege 3064 wmic.exe Token: SeBackupPrivilege 3064 wmic.exe Token: SeRestorePrivilege 3064 wmic.exe Token: SeShutdownPrivilege 3064 wmic.exe Token: SeDebugPrivilege 3064 wmic.exe Token: SeSystemEnvironmentPrivilege 3064 wmic.exe Token: SeRemoteShutdownPrivilege 3064 wmic.exe Token: SeUndockPrivilege 3064 wmic.exe Token: SeManageVolumePrivilege 3064 wmic.exe Token: 33 3064 wmic.exe Token: 34 3064 wmic.exe Token: 35 3064 wmic.exe Token: SeIncreaseQuotaPrivilege 2580 wmic.exe Token: SeSecurityPrivilege 2580 wmic.exe Token: SeTakeOwnershipPrivilege 2580 wmic.exe Token: SeLoadDriverPrivilege 2580 wmic.exe Token: SeSystemProfilePrivilege 2580 wmic.exe Token: SeSystemtimePrivilege 2580 wmic.exe Token: SeProfSingleProcessPrivilege 2580 wmic.exe Token: SeIncBasePriorityPrivilege 2580 wmic.exe Token: SeCreatePagefilePrivilege 2580 wmic.exe Token: SeBackupPrivilege 2580 wmic.exe Token: SeRestorePrivilege 2580 wmic.exe Token: SeShutdownPrivilege 2580 wmic.exe Token: SeDebugPrivilege 2580 wmic.exe Token: SeSystemEnvironmentPrivilege 2580 wmic.exe Token: SeRemoteShutdownPrivilege 2580 wmic.exe Token: SeUndockPrivilege 2580 wmic.exe Token: SeManageVolumePrivilege 2580 wmic.exe Token: 33 2580 wmic.exe Token: 34 2580 wmic.exe Token: 35 2580 wmic.exe Token: SeIncreaseQuotaPrivilege 2580 wmic.exe Token: SeSecurityPrivilege 2580 wmic.exe Token: SeTakeOwnershipPrivilege 2580 wmic.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2928 wrote to memory of 3064 2928 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 20 PID 2928 wrote to memory of 3064 2928 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 20 PID 2928 wrote to memory of 3064 2928 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 20 PID 2928 wrote to memory of 2580 2928 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 27 PID 2928 wrote to memory of 2580 2928 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 27 PID 2928 wrote to memory of 2580 2928 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe"C:\Users\Admin\AppData\Local\Temp\7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Windows\System32\Wbem\wmic.exewmic cpu get name2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3064
-
-
C:\Windows\System32\Wbem\wmic.exewmic path win32_VideoController get name2⤵
- Detects videocard installed
- Suspicious use of AdjustPrivilegeToken
PID:2580
-