Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    91s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/10/2022, 03:10

General

  • Target

    e76ab3ae061235eba3e7ba023af549fddb0c62778f7eb95f012cd777060fac1d.exe

  • Size

    316KB

  • MD5

    611e17b7bf0f9cde01eebb35acd85540

  • SHA1

    3ed20fd8e363302c34a7765e9366f4d2c563782f

  • SHA256

    e76ab3ae061235eba3e7ba023af549fddb0c62778f7eb95f012cd777060fac1d

  • SHA512

    a70776f400008b4f9ecabb7d43222b5f4092068265dcbf3874265e788248e3b4693d4807d1d489c1fcf7a9cbac5068d26c33620e1bf96ce1c4f4c6d7f9f4ee43

  • SSDEEP

    6144:ur+bUzkuvcBYC47l2xUa0nvmas+8gGxvzbLxS8YXsypuewKmiR:urXkuveY3z+U83tbLpmsgh/R

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 3 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e76ab3ae061235eba3e7ba023af549fddb0c62778f7eb95f012cd777060fac1d.exe
    "C:\Users\Admin\AppData\Local\Temp\e76ab3ae061235eba3e7ba023af549fddb0c62778f7eb95f012cd777060fac1d.exe"
    1⤵
    • Loads dropped DLL
    • Maps connected drives based on registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1776
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\_tinB059.bat"
      2⤵
        PID:3152

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\InstallMate\01ADBEA7\cfg\1.ini

      Filesize

      923B

      MD5

      175262156344a1b93e2a41128c9bf045

      SHA1

      4892e20997290b217021a892bbcc36f139937bd1

      SHA256

      dacb3394adbf87bf1abb6aac6eb400e01492a879b9ebdc831a1a45f226395005

      SHA512

      a0e4c6da6b66bc14a83c3590a4c1e03ad82652ba3c3c3d5f644ec9eb8ab3bde1a4c02d417e6090defd917482d5458e84d074e6de883034340b650630de4d35e3

    • C:\Users\Admin\AppData\Local\Temp\Tsu0D40ABCF.dll

      Filesize

      269KB

      MD5

      af7ce801c8471c5cd19b366333c153c4

      SHA1

      4267749d020a362edbd25434ad65f98b073581f1

      SHA256

      cf7e00ba429bc9f27ccfacc49ae367054f40ada6cede9f513cc29a24e88bf49e

      SHA512

      88655bd940e9b540c4df551fe68135793eceed03f94389b0654637a18b252bf4d3ef73b0c49548b5fa6ba2cf6d9aff79335c4ebcc0b668e008bcc62c40d2a73c

    • C:\Users\Admin\AppData\Local\Temp\_tinB059.bat

      Filesize

      50B

      MD5

      8bcf1d70411b28cf649f9770905fe380

      SHA1

      183bafefa6553693088bed899ca40f790e6f6d7d

      SHA256

      a0b36e558f8a7879acba4154bba61fccb1a8db0b2bb91b4c5102ea3004e3d003

      SHA512

      4698d80bd338ed3c5640377dcd83e2e576d0550066c54b09c495a22052ed20e04eb8ccd49c35f2d58757860ca404026170428566c0ee684f16feaf2a147f94d8

    • C:\Users\Admin\AppData\Local\Temp\{1E969705-610C-4AD0-A83B-292EC575B5F3}\Custom.dll

      Filesize

      91KB

      MD5

      43df2d0ba357b75af604e144e0c13c8f

      SHA1

      3c1c6bfcb5033bb5efe343af5a5e0ec4211cce30

      SHA256

      a2ec8e40cd848dc2a0793af1b29f5c378b9e8c8754c99ddf6d7d47753b2219b8

      SHA512

      8cfa21176d5b66b796c94267987bfec6292efde3ced2e62fcdb42fc0d4567f790dbc3637ca68be33e21c68c41bf825ebb5a9c0fd94c12c420b6dd0c35f76149e

    • C:\Users\Admin\AppData\Local\Temp\{1E969705-610C-4AD0-A83B-292EC575B5F3}\_Setup.dll

      Filesize

      173KB

      MD5

      849cfed02ed4ded563da47d93592b653

      SHA1

      bcdc289cf10557a0ee5b8a3f956739710215a4e5

      SHA256

      40f7374f5089a9429f4fe0d568364c567d535fa2d3d542d4f7dfb948c480be27

      SHA512

      8f6d24b7234efb6cbf11be13bfa11f5e6d11aea48d1c81c37a421862aa452b6af0a06bc8637b58bfae631a68aa0d532c7922ccca6433cd2e05e87198ad719cf0