Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

a094342d28...3f.exe

windows7-x64

8

a094342d28...3f.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    152s
  • max time network
    160s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/10/2022, 07:06

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    a094342d281db61eccf530d2406b3760cc7baa6fef1bd75b162d54d9cc3b0c3f.exe

  • Size

    814KB

  • MD5

    6f806557a708ece6ff79e3d45341fcc8

  • SHA1

    344193fdf9877b7cada23ab145a90ca91969db31

  • SHA256

    a094342d281db61eccf530d2406b3760cc7baa6fef1bd75b162d54d9cc3b0c3f

  • SHA512

    3b93f9b2196526417219e5f11204fc42047460063a7f54629353ef93eb44513cf9d4a6e5a55997dc895ccf28c2f6779467102fb73c692ca7155933a68dd39f28

  • SSDEEP

    24576:/J4WIZ/LLxxIsiS7IuDXh6vSiq6zwl5JSqa9:/JBIZzFxV0uDhN2gDSqa9

Score
8/10
bootkitpersistence

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in System32 directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 60 IoCs
  • Modifies registry class 8 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of FindShellTrayWindow 23 IoCs
  • Suspicious use of SendNotifyMessage 7 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a094342d281db61eccf530d2406b3760cc7baa6fef1bd75b162d54d9cc3b0c3f.exe
    "C:\Users\Admin\AppData\Local\Temp\a094342d281db61eccf530d2406b3760cc7baa6fef1bd75b162d54d9cc3b0c3f.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:2736
    • C:\ProgramData\defender.exe
      C:\ProgramData\defender.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Enumerates connected drives
      • Writes to the Master Boot Record (MBR)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:4868
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of FindShellTrayWindow
    PID:3720
  • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
    "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
    1⤵
    • Drops file in System32 directory
    • Modifies data under HKEY_USERS
    • Suspicious use of SetWindowsHookEx
    PID:4248
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of FindShellTrayWindow
    PID:2280
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4104
    • C:\Windows\explorer.exe
      explorer.exe /LOADSAVEDWINDOWS
      2⤵
      • Modifies registry class
      PID:2164
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4296
    • C:\Windows\explorer.exe
      explorer.exe /LOADSAVEDWINDOWS
      2⤵
        PID:1064
    • C:\Windows\system32\sihost.exe
      sihost.exe
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:4920
      • C:\Windows\explorer.exe
        explorer.exe /LOADSAVEDWINDOWS
        2⤵
          PID:3196
      • C:\Windows\system32\sihost.exe
        sihost.exe
        1⤵
        • Suspicious use of WriteProcessMemory
        PID:3528
        • C:\Windows\explorer.exe
          explorer.exe /LOADSAVEDWINDOWS
          2⤵
            PID:524
        • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
          "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
          1⤵
            PID:1340
          • C:\Windows\explorer.exe
            C:\Windows\explorer.exe /factory,{682159d9-c321-47ca-b3f1-30e36b2ec8b9} -Embedding
            1⤵
            • Enumerates connected drives
            • Modifies Internet Explorer settings
            • Modifies registry class
            • Suspicious behavior: AddClipboardFormatListener
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of SetWindowsHookEx
            PID:780
          • C:\Windows\System32\rundll32.exe
            C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
            1⤵
              PID:1448
            • C:\Windows\System32\rundll32.exe
              C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {3eef301f-b596-4c0b-bd92-013beafce793} -Embedding
              1⤵
                PID:4072

              Network

              MITRE ATT&CK Enterprise v6

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\ProgramData\defender.exe
                Filesize

                794KB

                MD5

                62bee61dd5ace761b97cae0f762aa675

                SHA1

                3a997ba082d2f6180a9e02c0c4db0ac7726d067e

                SHA256

                f2ddc46f2891f8749908879e574173f161266eeb3ff9e7fa525703dd57060781

                SHA512

                7a949301934211bed0472b8a920b9de49ca8309ad70590a5c89084ee0f81cd2d076e960f5f1df76dce448477003cbad78870a2bb14971e7dbd908c1ae1a6cca2

                Download Submit

              • C:\ProgramData\defender.exe
                Filesize

                794KB

                MD5

                62bee61dd5ace761b97cae0f762aa675

                SHA1

                3a997ba082d2f6180a9e02c0c4db0ac7726d067e

                SHA256

                f2ddc46f2891f8749908879e574173f161266eeb3ff9e7fa525703dd57060781

                SHA512

                7a949301934211bed0472b8a920b9de49ca8309ad70590a5c89084ee0f81cd2d076e960f5f1df76dce448477003cbad78870a2bb14971e7dbd908c1ae1a6cca2

                Download Submit

              • memory/2736-132-0x0000000000400000-0x0000000000590000-memory.dmp

                Filesize

                1.6MB

                Download

              • memory/2736-133-0x00000000023E0000-0x00000000023E9000-memory.dmp

                Filesize

                36KB

                Download

              • memory/4868-137-0x0000000000400000-0x0000000000AC6000-memory.dmp

                Filesize

                6.8MB

                Download

              • memory/4868-139-0x0000000000C40000-0x0000000000C49000-memory.dmp

                Filesize

                36KB

                Download

              • memory/4868-140-0x0000000000400000-0x0000000000AC6000-memory.dmp

                Filesize

                6.8MB

                Download

              • memory/4868-141-0x0000000000400000-0x0000000000AC6000-memory.dmp

                Filesize

                6.8MB

                Download