Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
93s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
19/04/2024, 01:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d0ccad2452cc0124d95214f9a9c5e4df9d842f97c6389c6e01baa0916306ad87.exe
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
d0ccad2452cc0124d95214f9a9c5e4df9d842f97c6389c6e01baa0916306ad87.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
d0ccad2452cc0124d95214f9a9c5e4df9d842f97c6389c6e01baa0916306ad87.exe
-
Size
198KB
-
MD5
1aa6f499158d4b7141db67d7038cda8d
-
SHA1
5947aa44d3c8e5d3e31667553dbdc104426b57ee
-
SHA256
d0ccad2452cc0124d95214f9a9c5e4df9d842f97c6389c6e01baa0916306ad87
-
SHA512
7051af4236d7eec714d5874bbf10643a306fef8361df682a642151c87a1fc59a03ede0cbc2b41516d58c294d120188df3e62045717fda6377765ec7c056033cd
-
SSDEEP
3072:cNOEmZoEfUHeZbe3+xW3Yf+83C63QU8rgP6A6NL6AW9SI1eBzKR:c4BZ6S5W3kV3p3QU9iA8LvaSseBO
Score
7/10
Malware Config
Signatures
-
Unexpected DNS network traffic destination 6 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 208.67.222.222 Destination IP 208.67.222.222 Destination IP 208.67.222.222 Destination IP 208.67.222.222 Destination IP 208.67.222.222 Destination IP 208.67.222.222 -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 3928 d0ccad2452cc0124d95214f9a9c5e4df9d842f97c6389c6e01baa0916306ad87.exe -
Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeDebugPrivilege 3928 d0ccad2452cc0124d95214f9a9c5e4df9d842f97c6389c6e01baa0916306ad87.exe Token: SeIncreaseQuotaPrivilege 3884 WMIC.exe Token: SeSecurityPrivilege 3884 WMIC.exe Token: SeTakeOwnershipPrivilege 3884 WMIC.exe Token: SeLoadDriverPrivilege 3884 WMIC.exe Token: SeSystemProfilePrivilege 3884 WMIC.exe Token: SeSystemtimePrivilege 3884 WMIC.exe Token: SeProfSingleProcessPrivilege 3884 WMIC.exe Token: SeIncBasePriorityPrivilege 3884 WMIC.exe Token: SeCreatePagefilePrivilege 3884 WMIC.exe Token: SeBackupPrivilege 3884 WMIC.exe Token: SeRestorePrivilege 3884 WMIC.exe Token: SeShutdownPrivilege 3884 WMIC.exe Token: SeDebugPrivilege 3884 WMIC.exe Token: SeSystemEnvironmentPrivilege 3884 WMIC.exe Token: SeRemoteShutdownPrivilege 3884 WMIC.exe Token: SeUndockPrivilege 3884 WMIC.exe Token: SeManageVolumePrivilege 3884 WMIC.exe Token: 33 3884 WMIC.exe Token: 34 3884 WMIC.exe Token: 35 3884 WMIC.exe Token: 36 3884 WMIC.exe Token: SeIncreaseQuotaPrivilege 3884 WMIC.exe Token: SeSecurityPrivilege 3884 WMIC.exe Token: SeTakeOwnershipPrivilege 3884 WMIC.exe Token: SeLoadDriverPrivilege 3884 WMIC.exe Token: SeSystemProfilePrivilege 3884 WMIC.exe Token: SeSystemtimePrivilege 3884 WMIC.exe Token: SeProfSingleProcessPrivilege 3884 WMIC.exe Token: SeIncBasePriorityPrivilege 3884 WMIC.exe Token: SeCreatePagefilePrivilege 3884 WMIC.exe Token: SeBackupPrivilege 3884 WMIC.exe Token: SeRestorePrivilege 3884 WMIC.exe Token: SeShutdownPrivilege 3884 WMIC.exe Token: SeDebugPrivilege 3884 WMIC.exe Token: SeSystemEnvironmentPrivilege 3884 WMIC.exe Token: SeRemoteShutdownPrivilege 3884 WMIC.exe Token: SeUndockPrivilege 3884 WMIC.exe Token: SeManageVolumePrivilege 3884 WMIC.exe Token: 33 3884 WMIC.exe Token: 34 3884 WMIC.exe Token: 35 3884 WMIC.exe Token: 36 3884 WMIC.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 3928 wrote to memory of 644 3928 d0ccad2452cc0124d95214f9a9c5e4df9d842f97c6389c6e01baa0916306ad87.exe 85 PID 3928 wrote to memory of 644 3928 d0ccad2452cc0124d95214f9a9c5e4df9d842f97c6389c6e01baa0916306ad87.exe 85 PID 644 wrote to memory of 3884 644 cmd.exe 87 PID 644 wrote to memory of 3884 644 cmd.exe 87 PID 3928 wrote to memory of 4708 3928 d0ccad2452cc0124d95214f9a9c5e4df9d842f97c6389c6e01baa0916306ad87.exe 89 PID 3928 wrote to memory of 4708 3928 d0ccad2452cc0124d95214f9a9c5e4df9d842f97c6389c6e01baa0916306ad87.exe 89 PID 4708 wrote to memory of 2140 4708 cmd.exe 92 PID 4708 wrote to memory of 2140 4708 cmd.exe 92 PID 3928 wrote to memory of 1556 3928 d0ccad2452cc0124d95214f9a9c5e4df9d842f97c6389c6e01baa0916306ad87.exe 97 PID 3928 wrote to memory of 1556 3928 d0ccad2452cc0124d95214f9a9c5e4df9d842f97c6389c6e01baa0916306ad87.exe 97 PID 1556 wrote to memory of 4180 1556 cmd.exe 99 PID 1556 wrote to memory of 4180 1556 cmd.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\d0ccad2452cc0124d95214f9a9c5e4df9d842f97c6389c6e01baa0916306ad87.exe"C:\Users\Admin\AppData\Local\Temp\d0ccad2452cc0124d95214f9a9c5e4df9d842f97c6389c6e01baa0916306ad87.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c wmic path win32_computersystemproduct get uuid2⤵
- Suspicious use of WriteProcessMemory
PID:644 -
C:\Windows\System32\Wbem\WMIC.exewmic path win32_computersystemproduct get uuid3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3884
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c nslookup myip.opendns.com. resolver1.opendns.com2⤵
- Suspicious use of WriteProcessMemory
PID:4708 -
C:\Windows\system32\nslookup.exenslookup myip.opendns.com. resolver1.opendns.com3⤵PID:2140
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c nslookup myip.opendns.com. resolver1.opendns.com2⤵
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\Windows\system32\nslookup.exenslookup myip.opendns.com. resolver1.opendns.com3⤵PID:4180
-
-