Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    154s
  • max time network
    160s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/09/2022, 23:10

General

  • Target

    02c95176b841c1af8b690b58b7e576f6295abcd3a89b26a9a1f5eb202c3875be.exe

  • Size

    97KB

  • MD5

    9596768bf9540ff74f3a084d7261cc35

  • SHA1

    33baecf71903c1dc0b8ad4ccab2aac2bf429f2eb

  • SHA256

    02c95176b841c1af8b690b58b7e576f6295abcd3a89b26a9a1f5eb202c3875be

  • SHA512

    d17a25ed08370e411ebe28aae851f0ca4026b018f1b3ab9c7fe30b1a75361f94d7aa1cb67f4644466dbe38761b1598176a88defb51d370742440b2efb1ac26af

  • SSDEEP

    1536:y0j+84T8bivhkKCoVRpfujc/YwmXKeXWhAaG8xDMmWoQUnUoTRLTTHqd:y0v4Yb2eruGgAaeXWhTj+fAW

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • UPX packed file 10 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 8 IoCs
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\02c95176b841c1af8b690b58b7e576f6295abcd3a89b26a9a1f5eb202c3875be.exe
    "C:\Users\Admin\AppData\Local\Temp\02c95176b841c1af8b690b58b7e576f6295abcd3a89b26a9a1f5eb202c3875be.exe"
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3372
    • C:\Users\Admin\AppData\Local\Temp\02c95176b841c1af8b690b58b7e576f6295abcd3a89b26a9a1f5eb202c3875be.tmp
      C:\Users\Admin\AppData\Local\Temp\02c95176b841c1af8b690b58b7e576f6295abcd3a89b26a9a1f5eb202c3875be.tmp
      2⤵
      • Executes dropped EXE
      PID:2276
    • C:\Users\Admin\AppData\Local\Temp\02c95176b841c1af8b690b58b7e576f6295abcd3a89b26a9a1f5eb202c3875be.mm
      C:\Users\Admin\AppData\Local\Temp\02c95176b841c1af8b690b58b7e576f6295abcd3a89b26a9a1f5eb202c3875be.mm /zhj
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • Suspicious use of WriteProcessMemory
      PID:4936
      • C:\Windows\YZH.exe
        C:\Windows\YZH.exe /zhj
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: GetForegroundWindowSpam
        PID:2040

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\02c95176b841c1af8b690b58b7e576f6295abcd3a89b26a9a1f5eb202c3875be.mm

    Filesize

    83KB

    MD5

    c10d2e39742ad14c6190d98221c6959e

    SHA1

    a3dbb605306102ff960f03ffe4103ee6c7e291f6

    SHA256

    fd30724bfcc121377c75d8b954b29a94c4dca65681c3956697cabce4f001e793

    SHA512

    58a8287660c78c6a5af8d05914d1cdc48f0df79f16fdcfad3e30d195669486c17607b7e44292896c5adfbebc7fa1d5918668ce2d765db92c77c06a2be2244efe

  • C:\Users\Admin\AppData\Local\Temp\02c95176b841c1af8b690b58b7e576f6295abcd3a89b26a9a1f5eb202c3875be.mm

    Filesize

    83KB

    MD5

    c10d2e39742ad14c6190d98221c6959e

    SHA1

    a3dbb605306102ff960f03ffe4103ee6c7e291f6

    SHA256

    fd30724bfcc121377c75d8b954b29a94c4dca65681c3956697cabce4f001e793

    SHA512

    58a8287660c78c6a5af8d05914d1cdc48f0df79f16fdcfad3e30d195669486c17607b7e44292896c5adfbebc7fa1d5918668ce2d765db92c77c06a2be2244efe

  • C:\Users\Admin\AppData\Local\Temp\02c95176b841c1af8b690b58b7e576f6295abcd3a89b26a9a1f5eb202c3875be.tmp

    Filesize

    14KB

    MD5

    b7a2fbbeb343cc841bb2a0e846455769

    SHA1

    591e1dc5e6f73212072db6873ce764a76056e2a7

    SHA256

    cd5b74669487ecaaf84d55a506aeb007d9be8b69fc392bf4cc752fc257ea6319

    SHA512

    69478ff8818bfd5df7b62094d49b23110c04bc6e4581c22f04b1fe4177b40cd8b61e9b67350080c6a4642afe7681155f4426546af27b7a66f94abc92e8c8d225

  • C:\Users\Admin\AppData\Local\Temp\02c95176b841c1af8b690b58b7e576f6295abcd3a89b26a9a1f5eb202c3875be.tmp

    Filesize

    14KB

    MD5

    b7a2fbbeb343cc841bb2a0e846455769

    SHA1

    591e1dc5e6f73212072db6873ce764a76056e2a7

    SHA256

    cd5b74669487ecaaf84d55a506aeb007d9be8b69fc392bf4cc752fc257ea6319

    SHA512

    69478ff8818bfd5df7b62094d49b23110c04bc6e4581c22f04b1fe4177b40cd8b61e9b67350080c6a4642afe7681155f4426546af27b7a66f94abc92e8c8d225

  • C:\Windows\YZH.exe

    Filesize

    83KB

    MD5

    c10d2e39742ad14c6190d98221c6959e

    SHA1

    a3dbb605306102ff960f03ffe4103ee6c7e291f6

    SHA256

    fd30724bfcc121377c75d8b954b29a94c4dca65681c3956697cabce4f001e793

    SHA512

    58a8287660c78c6a5af8d05914d1cdc48f0df79f16fdcfad3e30d195669486c17607b7e44292896c5adfbebc7fa1d5918668ce2d765db92c77c06a2be2244efe

  • C:\Windows\YZH.exe

    Filesize

    83KB

    MD5

    c10d2e39742ad14c6190d98221c6959e

    SHA1

    a3dbb605306102ff960f03ffe4103ee6c7e291f6

    SHA256

    fd30724bfcc121377c75d8b954b29a94c4dca65681c3956697cabce4f001e793

    SHA512

    58a8287660c78c6a5af8d05914d1cdc48f0df79f16fdcfad3e30d195669486c17607b7e44292896c5adfbebc7fa1d5918668ce2d765db92c77c06a2be2244efe

  • memory/2040-143-0x0000000000400000-0x000000000043F000-memory.dmp

    Filesize

    252KB

  • memory/2040-146-0x0000000000400000-0x000000000043F000-memory.dmp

    Filesize

    252KB

  • memory/3372-132-0x0000000000400000-0x000000000043F000-memory.dmp

    Filesize

    252KB

  • memory/3372-145-0x0000000000400000-0x000000000043F000-memory.dmp

    Filesize

    252KB

  • memory/4936-142-0x0000000000400000-0x000000000043F000-memory.dmp

    Filesize

    252KB

  • memory/4936-144-0x0000000000400000-0x000000000043F000-memory.dmp

    Filesize

    252KB