Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    151s
  • max time network
    160s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220113
  • submitted
    15/02/2022, 16:02

General

  • Target

    0333988d52da8b27e865657ffa2c4cb8e96b43fce7d6d7b72458a0b176713924.exe

  • Size

    5.2MB

  • MD5

    9e341e85dcaa0a31a88ad14feaeed888

  • SHA1

    0ba9508166b2f8127451e07a1ceffd9ec63fd640

  • SHA256

    0333988d52da8b27e865657ffa2c4cb8e96b43fce7d6d7b72458a0b176713924

  • SHA512

    cc2b7efe29bafae98b174129c3bd6da61f4f9051247ad9dd09b86843e7e6502958e1d1d70da332e5e63e73bff7e97514dd9f303de6baf3233662508ed1595db5

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 1 IoCs
  • Checks for any installed AV software in registry 1 TTPs 8 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Windows directory 8 IoCs
  • Modifies system certificate store 2 TTPs 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 11 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0333988d52da8b27e865657ffa2c4cb8e96b43fce7d6d7b72458a0b176713924.exe
    "C:\Users\Admin\AppData\Local\Temp\0333988d52da8b27e865657ffa2c4cb8e96b43fce7d6d7b72458a0b176713924.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4456
    • C:\Users\Admin\AppData\Local\Temp\7zS8618B14D\GenericSetup.exe
      .\GenericSetup.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks for any installed AV software in registry
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4892
      • C:\Users\Admin\AppData\Local\Temp\GenericSetup.exe_1644941072\Carrier.exe
        C:\Users\Admin\AppData\Local\Temp\GenericSetup.exe_1644941072\Carrier.exe
        3⤵
        • Executes dropped EXE
        PID:1808
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
    1⤵
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:1976
  • C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
    C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
    1⤵
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:3548

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1976-138-0x0000020A67A20000-0x0000020A67A30000-memory.dmp

    Filesize

    64KB

  • memory/1976-139-0x0000020A6A0D0000-0x0000020A6A0D4000-memory.dmp

    Filesize

    16KB

  • memory/1976-137-0x0000020A67350000-0x0000020A67360000-memory.dmp

    Filesize

    64KB

  • memory/4892-133-0x00000000009D0000-0x0000000001400000-memory.dmp

    Filesize

    10.2MB

  • memory/4892-136-0x00000000069F0000-0x0000000006A56000-memory.dmp

    Filesize

    408KB

  • memory/4892-140-0x00000000091C0000-0x0000000009764000-memory.dmp

    Filesize

    5.6MB

  • memory/4892-135-0x0000000005E50000-0x0000000005E51000-memory.dmp

    Filesize

    4KB

  • memory/4892-142-0x0000000008E80000-0x0000000008F12000-memory.dmp

    Filesize

    584KB

  • memory/4892-134-0x00000000748EE000-0x00000000748EF000-memory.dmp

    Filesize

    4KB