Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    93s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/10/2022, 00:03

General

  • Target

    db5cf9d0b882c6a918d4e2f290a48e241a75d376a1e53c894383d1eb33ad2995.exe

  • Size

    192KB

  • MD5

    7565c3c29e79a24dd0e6f5894ecb9450

  • SHA1

    ab1156f2af054838e14f42839e25d0e619ba796a

  • SHA256

    db5cf9d0b882c6a918d4e2f290a48e241a75d376a1e53c894383d1eb33ad2995

  • SHA512

    e623dee382057752bd401aa64b5efaeb807f82db8a4913f4df3e8b919faf98513d744a689a256c867ae1f16d87999300d6c40e0a7e026388b4b9e2477b58d5dd

  • SSDEEP

    3072:oi+bQQgdYR4sOcBRdQZd5g18xJ5kOpaPM9erTRcm4esUV:Sb/gdY7HCKKJNaEoPKmJ

Score
8/10
upx

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • UPX packed file 10 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 3 IoCs
  • Program crash 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\db5cf9d0b882c6a918d4e2f290a48e241a75d376a1e53c894383d1eb33ad2995.exe
    "C:\Users\Admin\AppData\Local\Temp\db5cf9d0b882c6a918d4e2f290a48e241a75d376a1e53c894383d1eb33ad2995.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2376
    • C:\Users\Admin\AppData\Local\Temp\db5cf9d0b882c6a918d4e2f290a48e241a75d376a1e53c894383d1eb33ad2995mgr.exe
      C:\Users\Admin\AppData\Local\Temp\db5cf9d0b882c6a918d4e2f290a48e241a75d376a1e53c894383d1eb33ad2995mgr.exe
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • Suspicious use of UnmapMainImage
      • Suspicious use of WriteProcessMemory
      PID:3304
      • C:\Program Files (x86)\Microsoft\WaterMark.exe
        "C:\Program Files (x86)\Microsoft\WaterMark.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of UnmapMainImage
        • Suspicious use of WriteProcessMemory
        PID:4100
        • C:\Windows\SysWOW64\svchost.exe
          C:\Windows\system32\svchost.exe
          4⤵
            PID:5072
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 5072 -s 208
              5⤵
              • Program crash
              PID:4928
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            4⤵
            • Modifies Internet Explorer settings
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:5112
            • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
              "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5112 CREDAT:17410 /prefetch:2
              5⤵
              • Modifies Internet Explorer settings
              • Suspicious use of SetWindowsHookEx
              PID:4576
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            4⤵
            • Modifies Internet Explorer settings
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:5024
            • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
              "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5024 CREDAT:17410 /prefetch:2
              5⤵
              • Modifies Internet Explorer settings
              • Suspicious use of SetWindowsHookEx
              PID:2392
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5072 -ip 5072
      1⤵
        PID:4952

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files (x86)\Microsoft\WaterMark.exe

        Filesize

        120KB

        MD5

        83a5fa4246ce7541bebc5e64bf0b01b6

        SHA1

        bc92ac6ec1aec9702570ef975066278ca3effbb0

        SHA256

        5ad61430a72e3c3492995dc43cd48b0d449513f518bbc02de740b69f43bede2a

        SHA512

        1420a5037f92049b933e01f20227f6b71093da7ed3b99e437759baed937152cb7ab9fc9f1aad1b3946beb97f3e498e38b0b7af3b506140d3c281540c1ee6a2bc

      • C:\Program Files (x86)\Microsoft\WaterMark.exe

        Filesize

        120KB

        MD5

        83a5fa4246ce7541bebc5e64bf0b01b6

        SHA1

        bc92ac6ec1aec9702570ef975066278ca3effbb0

        SHA256

        5ad61430a72e3c3492995dc43cd48b0d449513f518bbc02de740b69f43bede2a

        SHA512

        1420a5037f92049b933e01f20227f6b71093da7ed3b99e437759baed937152cb7ab9fc9f1aad1b3946beb97f3e498e38b0b7af3b506140d3c281540c1ee6a2bc

      • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{2FBC6A8F-4909-11ED-B696-D2A4FF929712}.dat

        Filesize

        5KB

        MD5

        73206dabd54db92f3525103925c470c0

        SHA1

        5021b559d8ad020e256f544154d6bd0e3286a47c

        SHA256

        a63322472ed00bf1ef1eafd69052cf2b4915160eb61cd45ec103f731479cd87b

        SHA512

        195cdf93ea0805619f6b6e48e5c8d28b5bf538ba5e3e447afd89c74dd48fa3268f0eb456d9325725e97397986d4d3028460b89abc56077e0a040d39cf5fbd244

      • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{2FBC919F-4909-11ED-B696-D2A4FF929712}.dat

        Filesize

        3KB

        MD5

        4871d39568ccf9117819300abb33042a

        SHA1

        eb67dfa2377080ba3586307aa37f8fff0f31d620

        SHA256

        1a08170314647d886857807e2f7e50733f19043dd709b16718c323788b0816c2

        SHA512

        c37998227f94645e46cd5cbcca354959659f8d28e6e3f6d8602a166ebd7d602241d2740c335d4203a57a1f37826283fdae0a82fa3e54a8f2e86a225da955d09d

      • C:\Users\Admin\AppData\Local\Temp\db5cf9d0b882c6a918d4e2f290a48e241a75d376a1e53c894383d1eb33ad2995mgr.exe

        Filesize

        120KB

        MD5

        83a5fa4246ce7541bebc5e64bf0b01b6

        SHA1

        bc92ac6ec1aec9702570ef975066278ca3effbb0

        SHA256

        5ad61430a72e3c3492995dc43cd48b0d449513f518bbc02de740b69f43bede2a

        SHA512

        1420a5037f92049b933e01f20227f6b71093da7ed3b99e437759baed937152cb7ab9fc9f1aad1b3946beb97f3e498e38b0b7af3b506140d3c281540c1ee6a2bc

      • C:\Users\Admin\AppData\Local\Temp\db5cf9d0b882c6a918d4e2f290a48e241a75d376a1e53c894383d1eb33ad2995mgr.exe

        Filesize

        120KB

        MD5

        83a5fa4246ce7541bebc5e64bf0b01b6

        SHA1

        bc92ac6ec1aec9702570ef975066278ca3effbb0

        SHA256

        5ad61430a72e3c3492995dc43cd48b0d449513f518bbc02de740b69f43bede2a

        SHA512

        1420a5037f92049b933e01f20227f6b71093da7ed3b99e437759baed937152cb7ab9fc9f1aad1b3946beb97f3e498e38b0b7af3b506140d3c281540c1ee6a2bc

      • memory/2376-136-0x0000000000400000-0x0000000000433000-memory.dmp

        Filesize

        204KB

      • memory/2376-132-0x0000000000400000-0x0000000000433000-memory.dmp

        Filesize

        204KB

      • memory/3304-143-0x0000000000400000-0x0000000000421000-memory.dmp

        Filesize

        132KB

      • memory/3304-140-0x0000000000400000-0x0000000000421000-memory.dmp

        Filesize

        132KB

      • memory/3304-139-0x0000000000400000-0x0000000000421000-memory.dmp

        Filesize

        132KB

      • memory/4100-151-0x0000000000400000-0x000000000043D000-memory.dmp

        Filesize

        244KB

      • memory/4100-152-0x0000000000400000-0x000000000043D000-memory.dmp

        Filesize

        244KB

      • memory/4100-153-0x0000000000400000-0x000000000043D000-memory.dmp

        Filesize

        244KB

      • memory/4100-156-0x0000000000400000-0x000000000043D000-memory.dmp

        Filesize

        244KB

      • memory/4100-157-0x0000000000400000-0x000000000043D000-memory.dmp

        Filesize

        244KB

      • memory/4100-158-0x0000000000400000-0x000000000043D000-memory.dmp

        Filesize

        244KB

      • memory/4100-159-0x0000000000400000-0x0000000000421000-memory.dmp

        Filesize

        132KB