Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    151s
  • max time network
    124s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/10/2022, 00:54

General

  • Target

    9d2d6ef6df099886cd84fd93c8435fec9d6fa2f7defa268c628e242607a5359c.exe

  • Size

    268KB

  • MD5

    67d9f43089bc69eb3e03986fda89d1d3

  • SHA1

    609ba5b9364e46da45a6e99c867d40fcdde91437

  • SHA256

    9d2d6ef6df099886cd84fd93c8435fec9d6fa2f7defa268c628e242607a5359c

  • SHA512

    a0e923f0a90b290857424278ea0d6ea8b7aeb7333d57fb2d0d9932b9a33b8b92665d199f2e5c3bcbefb1ad1faefb7553d5c119481cf3cc955776ea9892c8fad5

  • SSDEEP

    3072:xfMMrxVbx6nbisl39zCWbxcKojHpReFAlqDZO42ivVWCHvRZLk2om+X0s5q6:5EisVpCWbxipRa4q44mm5z+X0kq

Malware Config

Signatures

  • Stops running service(s) 3 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9d2d6ef6df099886cd84fd93c8435fec9d6fa2f7defa268c628e242607a5359c.exe
    "C:\Users\Admin\AppData\Local\Temp\9d2d6ef6df099886cd84fd93c8435fec9d6fa2f7defa268c628e242607a5359c.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4744
    • C:\Windows\SysWOW64\sc.exe
      sc stop sharedaccess
      2⤵
      • Launches sc.exe
      PID:1260

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4744-133-0x0000000000400000-0x0000000000443000-memory.dmp

    Filesize

    268KB

  • memory/4744-134-0x0000000000400000-0x0000000000443000-memory.dmp

    Filesize

    268KB

  • memory/4744-132-0x0000000000400000-0x0000000000443000-memory.dmp

    Filesize

    268KB