Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
15/03/2024, 13:11
Static task
static1
Behavioral task
behavioral1
Sample
cb7ec9a748a73506d5a8be38c30dfea2.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
cb7ec9a748a73506d5a8be38c30dfea2.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/ZipDLL.dll
Resource
win7-20240220-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/ZipDLL.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/czifqiz.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/czifqiz.dll
Resource
win10v2004-20240226-en
General
-
Target
cb7ec9a748a73506d5a8be38c30dfea2.exe
-
Size
709KB
-
MD5
cb7ec9a748a73506d5a8be38c30dfea2
-
SHA1
481aac7a4f4d58726b07ba9de1c80ceae5337ff4
-
SHA256
15806331386f446a7507203bd9e00e7d74ae339ddf6a6db249833b62a8a10c10
-
SHA512
f026e35eeb059499a3571486e857404d340e65ff832518f957857ea3170066bfaa22bf8a63b1e8475f8d60e029c81ff7bd720f231b5c01634b2e2d12d0019524
-
SSDEEP
12288:0WTX0pTYSMtR7ZSiJf1McX/lQN2Xh1Agt4SiMzkuUAjAD7qmEDNWvAmfc8vy4hqE:0WTEpTYxthZSIf+cX/lQN2CSZzXJEDCw
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 4652 bedgcbgfeb.exe -
Loads dropped DLL 2 IoCs
pid Process 3704 cb7ec9a748a73506d5a8be38c30dfea2.exe 3704 cb7ec9a748a73506d5a8be38c30dfea2.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 5028 4652 WerFault.exe 89 -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 3612 wmic.exe Token: SeSecurityPrivilege 3612 wmic.exe Token: SeTakeOwnershipPrivilege 3612 wmic.exe Token: SeLoadDriverPrivilege 3612 wmic.exe Token: SeSystemProfilePrivilege 3612 wmic.exe Token: SeSystemtimePrivilege 3612 wmic.exe Token: SeProfSingleProcessPrivilege 3612 wmic.exe Token: SeIncBasePriorityPrivilege 3612 wmic.exe Token: SeCreatePagefilePrivilege 3612 wmic.exe Token: SeBackupPrivilege 3612 wmic.exe Token: SeRestorePrivilege 3612 wmic.exe Token: SeShutdownPrivilege 3612 wmic.exe Token: SeDebugPrivilege 3612 wmic.exe Token: SeSystemEnvironmentPrivilege 3612 wmic.exe Token: SeRemoteShutdownPrivilege 3612 wmic.exe Token: SeUndockPrivilege 3612 wmic.exe Token: SeManageVolumePrivilege 3612 wmic.exe Token: 33 3612 wmic.exe Token: 34 3612 wmic.exe Token: 35 3612 wmic.exe Token: 36 3612 wmic.exe Token: SeIncreaseQuotaPrivilege 3612 wmic.exe Token: SeSecurityPrivilege 3612 wmic.exe Token: SeTakeOwnershipPrivilege 3612 wmic.exe Token: SeLoadDriverPrivilege 3612 wmic.exe Token: SeSystemProfilePrivilege 3612 wmic.exe Token: SeSystemtimePrivilege 3612 wmic.exe Token: SeProfSingleProcessPrivilege 3612 wmic.exe Token: SeIncBasePriorityPrivilege 3612 wmic.exe Token: SeCreatePagefilePrivilege 3612 wmic.exe Token: SeBackupPrivilege 3612 wmic.exe Token: SeRestorePrivilege 3612 wmic.exe Token: SeShutdownPrivilege 3612 wmic.exe Token: SeDebugPrivilege 3612 wmic.exe Token: SeSystemEnvironmentPrivilege 3612 wmic.exe Token: SeRemoteShutdownPrivilege 3612 wmic.exe Token: SeUndockPrivilege 3612 wmic.exe Token: SeManageVolumePrivilege 3612 wmic.exe Token: 33 3612 wmic.exe Token: 34 3612 wmic.exe Token: 35 3612 wmic.exe Token: 36 3612 wmic.exe Token: SeIncreaseQuotaPrivilege 780 wmic.exe Token: SeSecurityPrivilege 780 wmic.exe Token: SeTakeOwnershipPrivilege 780 wmic.exe Token: SeLoadDriverPrivilege 780 wmic.exe Token: SeSystemProfilePrivilege 780 wmic.exe Token: SeSystemtimePrivilege 780 wmic.exe Token: SeProfSingleProcessPrivilege 780 wmic.exe Token: SeIncBasePriorityPrivilege 780 wmic.exe Token: SeCreatePagefilePrivilege 780 wmic.exe Token: SeBackupPrivilege 780 wmic.exe Token: SeRestorePrivilege 780 wmic.exe Token: SeShutdownPrivilege 780 wmic.exe Token: SeDebugPrivilege 780 wmic.exe Token: SeSystemEnvironmentPrivilege 780 wmic.exe Token: SeRemoteShutdownPrivilege 780 wmic.exe Token: SeUndockPrivilege 780 wmic.exe Token: SeManageVolumePrivilege 780 wmic.exe Token: 33 780 wmic.exe Token: 34 780 wmic.exe Token: 35 780 wmic.exe Token: 36 780 wmic.exe Token: SeIncreaseQuotaPrivilege 780 wmic.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 3704 wrote to memory of 4652 3704 cb7ec9a748a73506d5a8be38c30dfea2.exe 89 PID 3704 wrote to memory of 4652 3704 cb7ec9a748a73506d5a8be38c30dfea2.exe 89 PID 3704 wrote to memory of 4652 3704 cb7ec9a748a73506d5a8be38c30dfea2.exe 89 PID 4652 wrote to memory of 3612 4652 bedgcbgfeb.exe 90 PID 4652 wrote to memory of 3612 4652 bedgcbgfeb.exe 90 PID 4652 wrote to memory of 3612 4652 bedgcbgfeb.exe 90 PID 4652 wrote to memory of 780 4652 bedgcbgfeb.exe 93 PID 4652 wrote to memory of 780 4652 bedgcbgfeb.exe 93 PID 4652 wrote to memory of 780 4652 bedgcbgfeb.exe 93 PID 4652 wrote to memory of 2244 4652 bedgcbgfeb.exe 95 PID 4652 wrote to memory of 2244 4652 bedgcbgfeb.exe 95 PID 4652 wrote to memory of 2244 4652 bedgcbgfeb.exe 95 PID 4652 wrote to memory of 3684 4652 bedgcbgfeb.exe 97 PID 4652 wrote to memory of 3684 4652 bedgcbgfeb.exe 97 PID 4652 wrote to memory of 3684 4652 bedgcbgfeb.exe 97 PID 4652 wrote to memory of 548 4652 bedgcbgfeb.exe 100 PID 4652 wrote to memory of 548 4652 bedgcbgfeb.exe 100 PID 4652 wrote to memory of 548 4652 bedgcbgfeb.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\cb7ec9a748a73506d5a8be38c30dfea2.exe"C:\Users\Admin\AppData\Local\Temp\cb7ec9a748a73506d5a8be38c30dfea2.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3704 -
C:\Users\Admin\AppData\Local\Temp\bedgcbgfeb.exeC:\Users\Admin\AppData\Local\Temp\bedgcbgfeb.exe 3!0!3!1!5!7!1!6!2!6!5 LFBGQzgwMiowGipQVT9PRD08Kh4pSUJUVE5NREg+OyobLERGUk9CQzcvKzIuMx0uPkJDNy4aKk1STENQPFNZRz44LjY2MxsoUj9QUEBPX1JRRzZnbnJqNSwvcHFxJ0M/UUUoUU9NLDxJTyhHSEFMICxCR0JCRUc+OFRnVlAzKlU/di0vUnp0STNaTC9FLkpSRGdMQywscDBxaERZb2dHQkVTZk1LdWdJVGoyTFNEYGtJTkltUTwxXEEnZz9aRzVvUDVHZnMubjRUSj08SlRRUi50aFRYUUcycXVUPFxqSWIrXlRnVGVMbGVKZTIwOFM/VGI2YkF5TE1jTFReT1BmZHZDUlZCa09zTjFKaWNlamszY1VjN0FTaTtlL008GyxELjwxLTEqHik/Lz0qMBsoQy07JywdL0EzOCYwGi0+MDotLh8qSVFJQk8+UV9NUURPQD1XNxssUE9OP05CTl0/UElBOh8qSVFJQk8+UV9LQEg+PBotP1NCX1JRRzYfKUNSQFxDSkNHQk0/OxoqRU9QU1o7UUlVTUBPPS0fKk1HO0xFVExVXFRNRTwaLVBIOjIdLj9MMDceKU1STlFISD5eUUNGPkxNQkhIOkY/U0xHOiAsSE5YUU9MTkRKRTpzbW5kGi1MQFFVT01ER0ZZU01AT19BQFRMPCweKUNGREJXOCofKUdNWkFZS0BIQkJZQ0g+T1lNU0A9PGBfZm5iICxDSlBNRk07P1xJTTwsKTYoLzEzKzE2NCkqNCweKUs+Uj5LRz5LWUdITlFBSUs4X2BmcV8bLFRGTEA2MC4xMC0vNTI2LRkuPk1RSUlPPkNaTUhHQzcyLDYsMSsqNCQvKzUwMjc0LSNPRw==2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81710508286.txt bios get serialnumber3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3612
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81710508286.txt bios get version3⤵
- Suspicious use of AdjustPrivilegeToken
PID:780
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81710508286.txt bios get version3⤵PID:2244
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81710508286.txt bios get version3⤵PID:3684
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81710508286.txt bios get version3⤵PID:548
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4652 -s 9563⤵
- Program crash
PID:5028
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4652 -ip 46521⤵PID:1468
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
66B
MD59025468f85256136f923096b01375964
SHA17fcd174999661594fa5f88890ffb195e9858cc52
SHA256d5418014fa8e6e17d8992fd12c0dfecac8a34855603ea58133e87ea09c2130df
SHA51292cac37c332e6e276a963d659986a79a79867df44682bfc2d77ed7784ffa5e2c149e5960a83d03ef4cf171be40a73e93a110aaa53b95152fa9a9da6b41d31e51
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
Filesize
58B
MD5dd876faf0fd44a5fab3e82368e2e8b15
SHA101b04083fa278dda3a81705ca5abcfee487a3c90
SHA2565602490a82bcacec8797d25cbb6f643fc9e69f89a2f0e6ec1e8d1f568e77a6b9
SHA512e03d1def5b7fb0ed01a414cead199229ec0e153ff831d3ff5dd36c320572084c56a5e1369c753f868c855455758c0d308941b6187c348051419bd937d014cb8b
-
Filesize
1.1MB
MD5c131a8eb9b1b0805634f791cd27a690a
SHA14ae9dc37a5e8d4b8ee90a3f0fe1e1d5cb961d01c
SHA25635c9ff8e29df959389e0b2d4317fde5142d5e6c471001173902e0289f5d5ee32
SHA512701e9a13076e23d2ec17ea0ce82854013ce56327812dc7882cb05d93e4d6abd002c1d1e67b4f0133d3dd3a844be5e39112a0163d9f36d540603401a5d783835f
-
Filesize
163KB
MD52dc35ddcabcb2b24919b9afae4ec3091
SHA19eeed33c3abc656353a7ebd1c66af38cccadd939
SHA2566bbeb39747f1526752980d4dbec2fe2c7347f3cc983a79c92561b92fe472e7a1
SHA5120ccac336924f684da1f73db2dd230a0c932c5b4115ae1fa0e708b9db5e39d2a07dc54dac8d95881a42069cbb2c2886e880cdad715deda83c0de38757a0f6a901
-
Filesize
161KB
MD5fe65cdd18d4c567b6a3c12214c55f4e7
SHA15312c385a6267b17ae7c314e1fd8863ed94a6744
SHA256e189e3ef2008c32f528f2d6a7c463f6e8de238ad0e550dadde580515f5a56063
SHA512bc826255605c6ec151b36222e5b2c0e1bd06e224e9342e984050f8681cb1ab624f58d86acee424195c1a369e912234eeec2bc9ad4bf04ce815dc4e973023dd76