Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    151s
  • max time network
    161s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    13/07/2024, 23:09

General

  • Target

    Dead By Daylight.exe

  • Size

    139.5MB

  • MD5

    ff7d06a374ffb2bc464f630d478afea1

  • SHA1

    ad885e52648932c7cc3ec3ab326e9ab2e7f1bc63

  • SHA256

    3041cce487877fedecf1d5a74ae0d7c1f86639d2697d6471071adda3783ed377

  • SHA512

    757fcbae74427551981333e709cef14dd17acf342b7897ef3a64844cb2afabeeedb1d82c5befc508a46a4fa2f0764347ec3dc01a2ad81e24506bf8ee2941b181

  • SSDEEP

    786432:314w5ThzHwQBgmoLWv+K18nCzKdo5DTdvfMQr6SSmPuvh8tSIW68:314kpHwQjCWv+K18CedmVvEQEpcJW

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Collects information from the system 1 TTPs 1 IoCs

    Uses WMIC.exe to find detailed system information.

  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Enumerates processes with tasklist 1 TTPs 2 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Dead By Daylight.exe
    "C:\Users\Admin\AppData\Local\Temp\Dead By Daylight.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1512
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "tasklist"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2952
      • C:\Windows\system32\tasklist.exe
        tasklist
        3⤵
        • Enumerates processes with tasklist
        • Suspicious use of AdjustPrivilegeToken
        PID:2800
    • C:\Users\Admin\AppData\Local\Temp\Dead By Daylight.exe
      "C:\Users\Admin\AppData\Local\Temp\Dead By Daylight.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\script" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=964 --field-trial-handle=1132,17106366604729532912,13815522264818183549,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
      2⤵
        PID:2884
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "wmic process where processid=NaN get ExecutablePath"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:3056
        • C:\Windows\System32\Wbem\WMIC.exe
          wmic process where processid=NaN get ExecutablePath
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:2736
      • C:\Users\Admin\AppData\Local\Temp\Dead By Daylight.exe
        "C:\Users\Admin\AppData\Local\Temp\Dead By Daylight.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\script" --mojo-platform-channel-handle=1020 --field-trial-handle=1132,17106366604729532912,13815522264818183549,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:2764
      • C:\Users\Admin\AppData\Local\Temp\Dead By Daylight.exe
        "C:\Users\Admin\AppData\Local\Temp\Dead By Daylight.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\script" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1424 --field-trial-handle=1132,17106366604729532912,13815522264818183549,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
        2⤵
          PID:2332
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "tasklist"
          2⤵
            PID:2200
            • C:\Windows\system32\tasklist.exe
              tasklist
              3⤵
              • Enumerates processes with tasklist
              • Suspicious use of AdjustPrivilegeToken
              PID:2208
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /d /s /c "net session"
            2⤵
              PID:2244
              • C:\Windows\system32\net.exe
                net session
                3⤵
                  PID:400
                  • C:\Windows\system32\net1.exe
                    C:\Windows\system32\net1 session
                    4⤵
                      PID:2428
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /d /s /c "C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\bind\main.exe"
                  2⤵
                    PID:1912
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /d /s /c "wmic logicaldisk get size"
                    2⤵
                      PID:2424
                      • C:\Windows\System32\Wbem\WMIC.exe
                        wmic logicaldisk get size
                        3⤵
                        • Collects information from the system
                        • Suspicious use of AdjustPrivilegeToken
                        PID:1696
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /d /s /c "wmic computersystem get totalphysicalmemory | more +1"
                      2⤵
                        PID:1368
                        • C:\Windows\System32\Wbem\WMIC.exe
                          wmic computersystem get totalphysicalmemory
                          3⤵
                            PID:940
                          • C:\Windows\system32\more.com
                            more +1
                            3⤵
                              PID:2432
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /d /s /c "wmic csproduct get uuid"
                            2⤵
                              PID:656
                              • C:\Windows\System32\Wbem\WMIC.exe
                                wmic csproduct get uuid
                                3⤵
                                  PID:784
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /d /s /c "echo %NUMBER_OF_PROCESSORS%"
                                2⤵
                                  PID:608
                                • C:\Windows\system32\cmd.exe
                                  C:\Windows\system32\cmd.exe /d /s /c "wmic OS get caption, osarchitecture | more +1"
                                  2⤵
                                    PID:1280
                                    • C:\Windows\System32\Wbem\WMIC.exe
                                      wmic OS get caption, osarchitecture
                                      3⤵
                                        PID:2604
                                      • C:\Windows\system32\more.com
                                        more +1
                                        3⤵
                                          PID:1828
                                      • C:\Windows\system32\cmd.exe
                                        C:\Windows\system32\cmd.exe /d /s /c "wmic cpu get name | more +1"
                                        2⤵
                                          PID:756
                                          • C:\Windows\System32\Wbem\WMIC.exe
                                            wmic cpu get name
                                            3⤵
                                              PID:2592
                                            • C:\Windows\system32\more.com
                                              more +1
                                              3⤵
                                                PID:2012
                                            • C:\Windows\system32\cmd.exe
                                              C:\Windows\system32\cmd.exe /d /s /c "wmic PATH Win32_VideoController get name | more +1"
                                              2⤵
                                                PID:2632
                                                • C:\Windows\System32\Wbem\WMIC.exe
                                                  wmic PATH Win32_VideoController get name
                                                  3⤵
                                                  • Detects videocard installed
                                                  PID:1588
                                                • C:\Windows\system32\more.com
                                                  more +1
                                                  3⤵
                                                    PID:672
                                                • C:\Windows\system32\cmd.exe
                                                  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
                                                  2⤵
                                                    PID:2644
                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
                                                      3⤵
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      PID:1768

                                                Network

                                                MITRE ATT&CK Enterprise v15

                                                Replay Monitor

                                                Loading Replay Monitor...

                                                Downloads

                                                • \Users\Admin\AppData\Local\Temp\72760f69-b6c8-400a-87d2-d0704bfdc47c.tmp.node

                                                  Filesize

                                                  1.8MB

                                                  MD5

                                                  3072b68e3c226aff39e6782d025f25a8

                                                  SHA1

                                                  cf559196d74fa490ac8ce192db222c9f5c5a006a

                                                  SHA256

                                                  7fb52b781709b065c240b6b81394be6e72e53fe11d7c8e0f7b49dd417eb78a01

                                                  SHA512

                                                  61ebc72c20195e99244d95af1ab44fa06201a1aee2b5da04490fdc4312e8324a40b0e15a7b42fab5179753d767c1d08ae1a7a56ac71a6e100e63f83db849ee61

                                                • \Users\Admin\AppData\Local\Temp\f6cc9bd8-05e0-4a0e-8bd3-643bb3e85ed3.tmp.node

                                                  Filesize

                                                  643KB

                                                  MD5

                                                  7bb446b26e6da42fa1bf16e4aec09a5d

                                                  SHA1

                                                  508aabc385972640a47b22ee81eb075b824a04b5

                                                  SHA256

                                                  90be01ac92e77ed27c88b8b3a4472f24ffdb11bdce4141ffa8ec556600874049

                                                  SHA512

                                                  d0bcfd7bd071348e8350e8251003386abd40a15a6b4c21003cf76f084e88b9ab4df8776e0401cebebd8f29790e538266c2ee4c2258fd2ef99d358d3e9007c1ca

                                                • memory/1768-111-0x000000001B2F0000-0x000000001B5D2000-memory.dmp

                                                  Filesize

                                                  2.9MB

                                                • memory/1768-112-0x00000000022A0000-0x00000000022A8000-memory.dmp

                                                  Filesize

                                                  32KB

                                                • memory/2884-41-0x0000000077A10000-0x0000000077A11000-memory.dmp

                                                  Filesize

                                                  4KB

                                                • memory/2884-9-0x0000000000060000-0x0000000000061000-memory.dmp

                                                  Filesize

                                                  4KB