Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    152s
  • max time network
    181s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/10/2022, 00:21

General

  • Target

    12f0731f3e455cf84877e05ccbc8eb5ea5a5e58433a5e50aaa20936476f0e066.exe

  • Size

    647KB

  • MD5

    6964ee62d4beebd5da6f288350db6b10

  • SHA1

    91f59ee4f3589c4579cbf53bd5e62e583b8e265d

  • SHA256

    12f0731f3e455cf84877e05ccbc8eb5ea5a5e58433a5e50aaa20936476f0e066

  • SHA512

    1033c4a13e11ba0bd6b16e4187bd709620ab161f44b35bbc322c61d8b63d3ad35af3c85d3738fd120f125fd3aac1e873e71ff1d6af6e3d3f2ba7f68786ab8fd9

  • SSDEEP

    6144:HyH7xOc6H5c6HcT66vlmQ6C/uT4HJJJJJJDa8Fc3pGNWXcIPNaAar8Qa:Ha/a5b4Zov

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\12f0731f3e455cf84877e05ccbc8eb5ea5a5e58433a5e50aaa20936476f0e066.exe
    "C:\Users\Admin\AppData\Local\Temp\12f0731f3e455cf84877e05ccbc8eb5ea5a5e58433a5e50aaa20936476f0e066.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:1676
    • C:\Windows\svchost.exe
      "C:\Windows\svchost.exe" "C:\Users\Admin\AppData\Local\Temp\12f0731f3e455cf84877e05ccbc8eb5ea5a5e58433a5e50aaa20936476f0e066.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:840
      • C:\Users\Admin\AppData\Local\Temp\12f0731f3e455cf84877e05ccbc8eb5ea5a5e58433a5e50aaa20936476f0e066.exe
        "C:\Users\Admin\AppData\Local\Temp\12f0731f3e455cf84877e05ccbc8eb5ea5a5e58433a5e50aaa20936476f0e066.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:4664
  • C:\Windows\svchost.exe
    C:\Windows\svchost.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Program Files directory
    PID:1528
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x528 0x51c
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:4884

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\12f0731f3e455cf84877e05ccbc8eb5ea5a5e58433a5e50aaa20936476f0e066.exe

    Filesize

    612KB

    MD5

    97ea456e257b71cec2b36000d66a2cdc

    SHA1

    3aedb25f95ddcf9c9697c2221f03a77e6bac512f

    SHA256

    a95dd946acbe215a4bd9e214e42829a515283da5c85884f00a2004b4ee903bbf

    SHA512

    4b0f2a5a36adb39f0646fd52d7ac53c1fb3528fe9a3fbd226353ec6d81eefddefa92d0914b4c42797caae67c8c6ae41b08800975b39f6a5e4608fe77dab2d296

  • C:\Users\Admin\AppData\Local\Temp\12f0731f3e455cf84877e05ccbc8eb5ea5a5e58433a5e50aaa20936476f0e066.exe

    Filesize

    612KB

    MD5

    97ea456e257b71cec2b36000d66a2cdc

    SHA1

    3aedb25f95ddcf9c9697c2221f03a77e6bac512f

    SHA256

    a95dd946acbe215a4bd9e214e42829a515283da5c85884f00a2004b4ee903bbf

    SHA512

    4b0f2a5a36adb39f0646fd52d7ac53c1fb3528fe9a3fbd226353ec6d81eefddefa92d0914b4c42797caae67c8c6ae41b08800975b39f6a5e4608fe77dab2d296

  • C:\Users\Admin\AppData\Local\Temp\bassmod.dll

    Filesize

    9KB

    MD5

    780d14604d49e3c634200c523def8351

    SHA1

    e208ef6f421d2260070a9222f1f918f1de0a8eeb

    SHA256

    844eb66a10b848d3a71a8c63c35f0a01550a46d2ff8503e2ca8947978b03b4d2

    SHA512

    a49c030f11da8f0cdc4205c86bec00653ec2f8899983cad9d7195fd23255439291aaec5a7e128e1a103efd93b8566e86f15af89eba4efebf9debce14a7a5564b

  • C:\Windows\svchost.exe

    Filesize

    35KB

    MD5

    a2dcf14a9e2b1003b484fa7b3203f168

    SHA1

    8da3c84acbeaa3dc76a2ceff518460ae37a12089

    SHA256

    5980affb855b100280a2d82a0bc56feb6c5121e3ec0d15869def2c37c6390c5d

    SHA512

    8ffbb737a4a6b8ca2a27b0ec47c53e1aed90d626725e91f4d97228deeb03aff3b60be4ef004b83d2368ec54da448d32befb5655613cabfb7a752cfcdd9e2855a

  • C:\Windows\svchost.exe

    Filesize

    35KB

    MD5

    a2dcf14a9e2b1003b484fa7b3203f168

    SHA1

    8da3c84acbeaa3dc76a2ceff518460ae37a12089

    SHA256

    5980affb855b100280a2d82a0bc56feb6c5121e3ec0d15869def2c37c6390c5d

    SHA512

    8ffbb737a4a6b8ca2a27b0ec47c53e1aed90d626725e91f4d97228deeb03aff3b60be4ef004b83d2368ec54da448d32befb5655613cabfb7a752cfcdd9e2855a

  • C:\Windows\svchost.exe

    Filesize

    35KB

    MD5

    a2dcf14a9e2b1003b484fa7b3203f168

    SHA1

    8da3c84acbeaa3dc76a2ceff518460ae37a12089

    SHA256

    5980affb855b100280a2d82a0bc56feb6c5121e3ec0d15869def2c37c6390c5d

    SHA512

    8ffbb737a4a6b8ca2a27b0ec47c53e1aed90d626725e91f4d97228deeb03aff3b60be4ef004b83d2368ec54da448d32befb5655613cabfb7a752cfcdd9e2855a

  • memory/4664-138-0x0000000000400000-0x00000000004B0000-memory.dmp

    Filesize

    704KB

  • memory/4664-141-0x0000000000400000-0x00000000004B0000-memory.dmp

    Filesize

    704KB