Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    147s
  • max time network
    169s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/10/2022, 14:58

General

  • Target

    025606c67d093e6549e67f9f40cfc7c2034eaa3a9d2f3aaa7a4b1c66fd6af20a.exe

  • Size

    327KB

  • MD5

    a0ec641e1a76a4a4e76b19e46c1aaff0

  • SHA1

    70a499662c1d5fc46aaab768a0ddeca76ef25a55

  • SHA256

    025606c67d093e6549e67f9f40cfc7c2034eaa3a9d2f3aaa7a4b1c66fd6af20a

  • SHA512

    878057038a9ac92a9cfdb76c3f089eef749a748233a127d58c8e7135f9cae23084cf563183f1877794e99de28f9002cea3bfd7455e46fa3a2bdcc8e4d57091bd

  • SSDEEP

    6144:PrQbUzkuvcBYC47l2xVmoQ0gDf3RHy9217LUAnM9iZXjr0:PrFkuveY38g9pfEiZXj4

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 3 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\025606c67d093e6549e67f9f40cfc7c2034eaa3a9d2f3aaa7a4b1c66fd6af20a.exe
    "C:\Users\Admin\AppData\Local\Temp\025606c67d093e6549e67f9f40cfc7c2034eaa3a9d2f3aaa7a4b1c66fd6af20a.exe"
    1⤵
    • Loads dropped DLL
    • Maps connected drives based on registry
    • Suspicious behavior: EnumeratesProcesses
    PID:628

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\Tsu26468EEE.dll

    Filesize

    269KB

    MD5

    af7ce801c8471c5cd19b366333c153c4

    SHA1

    4267749d020a362edbd25434ad65f98b073581f1

    SHA256

    cf7e00ba429bc9f27ccfacc49ae367054f40ada6cede9f513cc29a24e88bf49e

    SHA512

    88655bd940e9b540c4df551fe68135793eceed03f94389b0654637a18b252bf4d3ef73b0c49548b5fa6ba2cf6d9aff79335c4ebcc0b668e008bcc62c40d2a73c

  • C:\Users\Admin\AppData\Local\Temp\{3CF0BDFF-79F9-4147-A3AC-31DBE7139F09}\Custom.dll

    Filesize

    91KB

    MD5

    dc1e339686c8ccab49a2860c6709760b

    SHA1

    4662d7283d4ad26b4a235d82d831db526e9daa42

    SHA256

    07d70be92b1ef086f5f41f95fe14044fe8186e85a3972bb790ae143c66214f0b

    SHA512

    913e466fcae98118375c19e000c75ef03d7f5d30f16a29ad98fd90cbed425adf6415598b332cf30652a3dab2371e4a59a6a2c813d1df739bd09080e56aed9c52

  • C:\Users\Admin\AppData\Local\Temp\{3CF0BDFF-79F9-4147-A3AC-31DBE7139F09}\_Setup.dll

    Filesize

    183KB

    MD5

    9e898ffdc682cf853f7df237678a6f3a

    SHA1

    55cacb14771890e8028a8a9ce8ae936dff17944f

    SHA256

    e78f957aceb637683a41b00dd094d4e88f706b94fd7b679b35add56269e4d047

    SHA512

    942746351a7c0f43f633a4732ca54404b4d8e767616ffe724e265359506375f9c3b5c3a84a46b3ec452ae4b5d80a966d3b6b5aa0161c2150db39cb84c588a9d0