Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220112 -
submitted
20/02/2022, 19:38
Static task
static1
General
-
Target
MachineMania.exe
-
Size
15.6MB
-
MD5
725918a6ae94e864908946ebb5e98dee
-
SHA1
110a68b4baf98f0860652af2a0829163306d8f12
-
SHA256
34d3f59105130891d45ede6b0ec0d370b16f858408e944258d337177a98be143
-
SHA512
8337d3b674428bad022951e7c19fd19c0ca174485cbc9766ca1c410aa7b25d7382d0bbd28591205d24bd06ec16eb50e42bbafbe2fbb0b071515374911615fe8d
Malware Config
Signatures
-
Loads dropped DLL 43 IoCs
pid Process 3252 MachineMania.exe 3252 MachineMania.exe 3252 MachineMania.exe 3252 MachineMania.exe 3252 MachineMania.exe 3252 MachineMania.exe 3252 MachineMania.exe 3252 MachineMania.exe 3252 MachineMania.exe 3252 MachineMania.exe 3252 MachineMania.exe 3252 MachineMania.exe 3252 MachineMania.exe 3252 MachineMania.exe 3252 MachineMania.exe 3252 MachineMania.exe 3252 MachineMania.exe 3252 MachineMania.exe 3252 MachineMania.exe 3252 MachineMania.exe 3252 MachineMania.exe 3252 MachineMania.exe 3252 MachineMania.exe 3252 MachineMania.exe 3252 MachineMania.exe 3252 MachineMania.exe 3252 MachineMania.exe 3252 MachineMania.exe 3252 MachineMania.exe 3252 MachineMania.exe 3252 MachineMania.exe 3252 MachineMania.exe 3252 MachineMania.exe 3252 MachineMania.exe 3252 MachineMania.exe 3252 MachineMania.exe 3252 MachineMania.exe 3252 MachineMania.exe 3252 MachineMania.exe 3252 MachineMania.exe 3252 MachineMania.exe 3252 MachineMania.exe 3252 MachineMania.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 3252 MachineMania.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\State\keyValueLKG.dat svchost.exe File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 MusNotifyIcon.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz MusNotifyIcon.exe -
Modifies data under HKEY_USERS 51 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\InternetConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkUsageBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadPendingCount = "0" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Settings svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyInternetBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkCnt = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\GroupConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadPendingCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4100" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthlyUploadRestriction = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrCnt = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\FrDownloadRatePct = "90" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PeerInfoCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\BkDownloadRatePct = "45" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "12.498600" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\KVFileExpirationTime = "132900359859044345" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\Geo_EndpointFullUri = "https://geo.prod.do.dsp.mp.microsoft.com/geo" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LinkLocalConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadCount = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "6.510676" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "0.032808" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthID = "2" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\GeoVersion_EndpointFullUri = "https://geover.prod.do.dsp.mp.microsoft.com/geoversion" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CDNConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadRatePct = "100" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DODownloadMode = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCacheHostBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadCount = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "10.697131" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "3964" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyLanBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLanBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLinkLocalBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyInternetBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCdnBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyGroupBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CacheSizeBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LANConnectionCount = "0" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DownloadMode_BackCompat = "1" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkUsageBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4308" svchost.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeSecurityPrivilege 1860 TiWorker.exe Token: SeRestorePrivilege 1860 TiWorker.exe Token: SeBackupPrivilege 1860 TiWorker.exe Token: SeBackupPrivilege 1860 TiWorker.exe Token: SeRestorePrivilege 1860 TiWorker.exe Token: SeSecurityPrivilege 1860 TiWorker.exe Token: SeBackupPrivilege 1860 TiWorker.exe Token: SeRestorePrivilege 1860 TiWorker.exe Token: SeSecurityPrivilege 1860 TiWorker.exe Token: SeBackupPrivilege 1860 TiWorker.exe Token: SeRestorePrivilege 1860 TiWorker.exe Token: SeSecurityPrivilege 1860 TiWorker.exe Token: SeBackupPrivilege 1860 TiWorker.exe Token: SeRestorePrivilege 1860 TiWorker.exe Token: SeSecurityPrivilege 1860 TiWorker.exe Token: SeBackupPrivilege 1860 TiWorker.exe Token: SeRestorePrivilege 1860 TiWorker.exe Token: SeSecurityPrivilege 1860 TiWorker.exe Token: SeBackupPrivilege 1860 TiWorker.exe Token: SeRestorePrivilege 1860 TiWorker.exe Token: SeSecurityPrivilege 1860 TiWorker.exe Token: SeBackupPrivilege 1860 TiWorker.exe Token: SeRestorePrivilege 1860 TiWorker.exe Token: SeSecurityPrivilege 1860 TiWorker.exe Token: SeBackupPrivilege 1860 TiWorker.exe Token: SeRestorePrivilege 1860 TiWorker.exe Token: SeSecurityPrivilege 1860 TiWorker.exe Token: SeBackupPrivilege 1860 TiWorker.exe Token: SeRestorePrivilege 1860 TiWorker.exe Token: SeSecurityPrivilege 1860 TiWorker.exe Token: SeBackupPrivilege 1860 TiWorker.exe Token: SeRestorePrivilege 1860 TiWorker.exe Token: SeSecurityPrivilege 1860 TiWorker.exe Token: SeBackupPrivilege 1860 TiWorker.exe Token: SeRestorePrivilege 1860 TiWorker.exe Token: SeSecurityPrivilege 1860 TiWorker.exe Token: SeBackupPrivilege 1860 TiWorker.exe Token: SeRestorePrivilege 1860 TiWorker.exe Token: SeSecurityPrivilege 1860 TiWorker.exe Token: SeBackupPrivilege 1860 TiWorker.exe Token: SeRestorePrivilege 1860 TiWorker.exe Token: SeSecurityPrivilege 1860 TiWorker.exe Token: SeBackupPrivilege 1860 TiWorker.exe Token: SeRestorePrivilege 1860 TiWorker.exe Token: SeSecurityPrivilege 1860 TiWorker.exe Token: SeBackupPrivilege 1860 TiWorker.exe Token: SeRestorePrivilege 1860 TiWorker.exe Token: SeSecurityPrivilege 1860 TiWorker.exe Token: SeBackupPrivilege 1860 TiWorker.exe Token: SeRestorePrivilege 1860 TiWorker.exe Token: SeSecurityPrivilege 1860 TiWorker.exe Token: SeBackupPrivilege 1860 TiWorker.exe Token: SeRestorePrivilege 1860 TiWorker.exe Token: SeSecurityPrivilege 1860 TiWorker.exe Token: SeBackupPrivilege 1860 TiWorker.exe Token: SeRestorePrivilege 1860 TiWorker.exe Token: SeSecurityPrivilege 1860 TiWorker.exe Token: SeBackupPrivilege 1860 TiWorker.exe Token: SeRestorePrivilege 1860 TiWorker.exe Token: SeSecurityPrivilege 1860 TiWorker.exe Token: SeBackupPrivilege 1860 TiWorker.exe Token: SeRestorePrivilege 1860 TiWorker.exe Token: SeSecurityPrivilege 1860 TiWorker.exe Token: SeBackupPrivilege 1860 TiWorker.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 360 wrote to memory of 3252 360 MachineMania.exe 62 PID 360 wrote to memory of 3252 360 MachineMania.exe 62 PID 3252 wrote to memory of 4068 3252 MachineMania.exe 67 PID 3252 wrote to memory of 4068 3252 MachineMania.exe 67
Processes
-
C:\Users\Admin\AppData\Local\Temp\MachineMania.exeC:\Users\Admin\AppData\Local\Temp\MachineMania.exe https://webhook.site/db4fb900-9866-4d9e-8bdf-4d3c747dffe31⤵
- Suspicious use of WriteProcessMemory
PID:360 -
C:\Users\Admin\AppData\Local\Temp\MachineMania.exeC:\Users\Admin\AppData\Local\Temp\MachineMania.exe https://webhook.site/db4fb900-9866-4d9e-8bdf-4d3c747dffe32⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:3252 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"3⤵PID:4068
-
-
-
C:\Windows\system32\MusNotifyIcon.exe%systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 131⤵
- Checks processor information in registry
PID:2976
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:3484
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1860