Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/09/2022, 10:56

General

  • Target

    7c2e0deaee30925a058c9355219e503d9adc854151953b88713f4f358237542c.exe

  • Size

    3.0MB

  • MD5

    e58770d95db5c185a79ecaab0df2b9e2

  • SHA1

    d354c5549d9374067b37895fa887a5d1a0996528

  • SHA256

    7c2e0deaee30925a058c9355219e503d9adc854151953b88713f4f358237542c

  • SHA512

    cbdb3d36cfe09361c2dbc7ed1d9a688333a3d384bafe53c22cb922657739f1f652d47524d6f0544e201e2ee1ac70afff6a93a0539363a86abea38bbdec2385ef

  • SSDEEP

    49152:LKy5kwQuHxC5u2dRiJ2hOKLTtcFJCTzO5E3YSKsczmTG2SEIMK7KM5CQ:LKy57/xCIOY2cKLSmTzO5e/YbG5

Score
8/10
upx

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • UPX packed file 12 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious use of SetThreadContext 5 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Gathers network information 2 TTPs 3 IoCs

    Uses commandline utility to view network configuration.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7c2e0deaee30925a058c9355219e503d9adc854151953b88713f4f358237542c.exe
    "C:\Users\Admin\AppData\Local\Temp\7c2e0deaee30925a058c9355219e503d9adc854151953b88713f4f358237542c.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:3188
    • C:\Windows\system32\schtasks.exe
      schtasks /create /sc minute /mo 1 /tn OneDrive /rl HIGHEST /tr C:\Users\Admin\AppData\Local\OneDrive\OneDrive.exe
      2⤵
      • Creates scheduled task(s)
      PID:4268
    • C:\Windows\System32\svchost.exe
      C:\Windows\System32\svchost.exe 3188
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4744
      • C:\Windows\system32\netstat.exe
        netstat.exe -a -n -o
        3⤵
        • Gathers network information
        • Suspicious use of AdjustPrivilegeToken
        PID:4188
    • C:\Windows\System32\svchost.exe
      C:\Windows\System32\svchost.exe YmMxcTVjZHZ1N3RlN2xmaDBkOWR4ZndoYTdmNXBzaHl2ZnB0NXVhaGVkLDQ0RHM4ZmJDM0hXUUNjd1FvdGdyTkRVV25tRGl4cFFQRzdZTGg1aDJyelNNUXJ4Q1JYZVNqUXZIOExSUE5HU3lxdlhjS2VFazN1bVo3VDJ3ekZBZ292RjE1VWNrQnhnLDB4MDNlQmFCNjg0ZDNmYjI0QmVERmMzMWREYTRGNTVjQzAyMkU1NzEwMSxYbURTUU1tVjV2eGo4Y3U4eFNraFVjZldmRndtc0FZdDNpLHIzeUExd2VvUlc1THdNY0xoelBvdG1xU3huMjRFNzZXdWgsRFNSRDd6WEtOVXJZZmtpUERTdTFYRFdyZ2dkRTlTTGNRVyxMVVE5SmVHMkpOOUQ1VHRLdnlQRFZ6cWpTUjV4V0h4a3VRLFRQc0xGMmVUVHExMTJVS2Vvb0xWNHFBZzN0b3lDNWg2VE0sR0FZSjZOVkxKM1ZZRVRGVU5JNkxBRDVFREVQRTVEUFhaV1dRUEZWNFlIRkdIU0YzNkc0TENSUE4sQVZENjlIZHF1WEJ1RWpma0FEV0JDcXM1bmVWQ2VXQjMxZyxxcHQ5bXNqaDN0N3VjOTJwbmx3a3NtOWRkbjJrcWhtNmc1ZjQzbWUyZHAsYWRkcjFxeWYyc244dWF6N2o0NDB2ZXM5NmFkZHB1ZWFtOGY5cjlndTh2NDVsc2p4bGw3cWo0cHgwZTY5YTl0MjdlbnF0NDY2NnJlbm1rd2oyeDIzY3dldGZscHlkbGx1cWtwOWszbix0MVNrUzJrS0dvSnRqcHFhUGVWQlltc2JHcXMyR1ZkMWRzbSxHUEpkSk5GS0RORjFKcnZORG5tUXRqNHA1cVJpNWRmWmo1LDEyaEc4S2V3VmtoS1JIZUhmWVFlZEpMSHViWWliTGNBa1h1bjc1ckY0Yld5OVJrUA==
      2⤵
        PID:620
    • C:\Users\Admin\AppData\Local\OneDrive\OneDrive.exe
      C:\Users\Admin\AppData\Local\OneDrive\OneDrive.exe
      1⤵
      • Executes dropped EXE
      PID:2852
    • C:\Users\Admin\AppData\Local\OneDrive\OneDrive.exe
      C:\Users\Admin\AppData\Local\OneDrive\OneDrive.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:3792
      • C:\Windows\System32\svchost.exe
        C:\Windows\System32\svchost.exe 3792
        2⤵
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:332
        • C:\Windows\system32\netstat.exe
          netstat.exe -a -n -o
          3⤵
          • Gathers network information
          • Suspicious use of AdjustPrivilegeToken
          PID:1892
      • C:\Windows\System32\svchost.exe
        C:\Windows\System32\svchost.exe YmMxcTVjZHZ1N3RlN2xmaDBkOWR4ZndoYTdmNXBzaHl2ZnB0NXVhaGVkLDQ0RHM4ZmJDM0hXUUNjd1FvdGdyTkRVV25tRGl4cFFQRzdZTGg1aDJyelNNUXJ4Q1JYZVNqUXZIOExSUE5HU3lxdlhjS2VFazN1bVo3VDJ3ekZBZ292RjE1VWNrQnhnLDB4MDNlQmFCNjg0ZDNmYjI0QmVERmMzMWREYTRGNTVjQzAyMkU1NzEwMSxYbURTUU1tVjV2eGo4Y3U4eFNraFVjZldmRndtc0FZdDNpLHIzeUExd2VvUlc1THdNY0xoelBvdG1xU3huMjRFNzZXdWgsRFNSRDd6WEtOVXJZZmtpUERTdTFYRFdyZ2dkRTlTTGNRVyxMVVE5SmVHMkpOOUQ1VHRLdnlQRFZ6cWpTUjV4V0h4a3VRLFRQc0xGMmVUVHExMTJVS2Vvb0xWNHFBZzN0b3lDNWg2VE0sR0FZSjZOVkxKM1ZZRVRGVU5JNkxBRDVFREVQRTVEUFhaV1dRUEZWNFlIRkdIU0YzNkc0TENSUE4sQVZENjlIZHF1WEJ1RWpma0FEV0JDcXM1bmVWQ2VXQjMxZyxxcHQ5bXNqaDN0N3VjOTJwbmx3a3NtOWRkbjJrcWhtNmc1ZjQzbWUyZHAsYWRkcjFxeWYyc244dWF6N2o0NDB2ZXM5NmFkZHB1ZWFtOGY5cjlndTh2NDVsc2p4bGw3cWo0cHgwZTY5YTl0MjdlbnF0NDY2NnJlbm1rd2oyeDIzY3dldGZscHlkbGx1cWtwOWszbix0MVNrUzJrS0dvSnRqcHFhUGVWQlltc2JHcXMyR1ZkMWRzbSxHUEpkSk5GS0RORjFKcnZORG5tUXRqNHA1cVJpNWRmWmo1LDEyaEc4S2V3VmtoS1JIZUhmWVFlZEpMSHViWWliTGNBa1h1bjc1ckY0Yld5OVJrUA==
        2⤵
          PID:1528
      • C:\Users\Admin\AppData\Local\OneDrive\OneDrive.exe
        C:\Users\Admin\AppData\Local\OneDrive\OneDrive.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:1484
        • C:\Windows\System32\svchost.exe
          C:\Windows\System32\svchost.exe 1484
          2⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:4760
          • C:\Windows\system32\netstat.exe
            netstat.exe -a -n -o
            3⤵
            • Gathers network information
            • Suspicious use of AdjustPrivilegeToken
            PID:4492

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\OneDrive\OneDrive.exe

        Filesize

        3.0MB

        MD5

        e58770d95db5c185a79ecaab0df2b9e2

        SHA1

        d354c5549d9374067b37895fa887a5d1a0996528

        SHA256

        7c2e0deaee30925a058c9355219e503d9adc854151953b88713f4f358237542c

        SHA512

        cbdb3d36cfe09361c2dbc7ed1d9a688333a3d384bafe53c22cb922657739f1f652d47524d6f0544e201e2ee1ac70afff6a93a0539363a86abea38bbdec2385ef

      • C:\Users\Admin\AppData\Local\OneDrive\OneDrive.exe

        Filesize

        3.0MB

        MD5

        e58770d95db5c185a79ecaab0df2b9e2

        SHA1

        d354c5549d9374067b37895fa887a5d1a0996528

        SHA256

        7c2e0deaee30925a058c9355219e503d9adc854151953b88713f4f358237542c

        SHA512

        cbdb3d36cfe09361c2dbc7ed1d9a688333a3d384bafe53c22cb922657739f1f652d47524d6f0544e201e2ee1ac70afff6a93a0539363a86abea38bbdec2385ef

      • C:\Users\Admin\AppData\Local\OneDrive\OneDrive.exe

        Filesize

        3.0MB

        MD5

        e58770d95db5c185a79ecaab0df2b9e2

        SHA1

        d354c5549d9374067b37895fa887a5d1a0996528

        SHA256

        7c2e0deaee30925a058c9355219e503d9adc854151953b88713f4f358237542c

        SHA512

        cbdb3d36cfe09361c2dbc7ed1d9a688333a3d384bafe53c22cb922657739f1f652d47524d6f0544e201e2ee1ac70afff6a93a0539363a86abea38bbdec2385ef

      • C:\Users\Admin\AppData\Local\OneDrive\OneDrive.exe

        Filesize

        3.0MB

        MD5

        e58770d95db5c185a79ecaab0df2b9e2

        SHA1

        d354c5549d9374067b37895fa887a5d1a0996528

        SHA256

        7c2e0deaee30925a058c9355219e503d9adc854151953b88713f4f358237542c

        SHA512

        cbdb3d36cfe09361c2dbc7ed1d9a688333a3d384bafe53c22cb922657739f1f652d47524d6f0544e201e2ee1ac70afff6a93a0539363a86abea38bbdec2385ef

      • memory/620-162-0x00007FF61B5F0000-0x00007FF61B78F000-memory.dmp

        Filesize

        1.6MB

      • memory/620-168-0x00007FF61B5F0000-0x00007FF61B78F000-memory.dmp

        Filesize

        1.6MB

      • memory/620-173-0x00007FF61B5F0000-0x00007FF61B78F000-memory.dmp

        Filesize

        1.6MB

      • memory/1484-239-0x0000000000DA0000-0x0000000001718000-memory.dmp

        Filesize

        9.5MB

      • memory/2852-176-0x0000000000DA0000-0x0000000001718000-memory.dmp

        Filesize

        9.5MB

      • memory/3188-177-0x0000000000500000-0x0000000000E78000-memory.dmp

        Filesize

        9.5MB

      • memory/3188-132-0x0000000000500000-0x0000000000E78000-memory.dmp

        Filesize

        9.5MB

      • memory/3188-161-0x0000000000500000-0x0000000000E78000-memory.dmp

        Filesize

        9.5MB

      • memory/3792-207-0x0000000000DA0000-0x0000000001718000-memory.dmp

        Filesize

        9.5MB

      • memory/3792-179-0x0000000000DA0000-0x0000000001718000-memory.dmp

        Filesize

        9.5MB

      • memory/3792-220-0x0000000000DA0000-0x0000000001718000-memory.dmp

        Filesize

        9.5MB

      • memory/4744-134-0x00007FF61B5F0000-0x00007FF61B97B000-memory.dmp

        Filesize

        3.5MB

      • memory/4744-147-0x00007FF61B5F0000-0x00007FF61B97B000-memory.dmp

        Filesize

        3.5MB

      • memory/4744-159-0x00007FF61B5F0000-0x00007FF61B97B000-memory.dmp

        Filesize

        3.5MB