Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    178s
  • max time network
    173s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/10/2022, 22:25

General

  • Target

    3c7d982471b041b1ba25def3ac74d478d083ba867e1ed7356375b7caa87d308d.exe

  • Size

    840KB

  • MD5

    40244b155cf2aac338de3ce94f01747d

  • SHA1

    b82cc85facaaffe12313fb7f28ee6b37d37f6d97

  • SHA256

    3c7d982471b041b1ba25def3ac74d478d083ba867e1ed7356375b7caa87d308d

  • SHA512

    301a5597e8b9c7660341c17b008911501fd6028de3c955b3a4cecd407b8bc09946b13cb804fd2a3939fd8df2dc0237784cca10ef111edf336208223ecbdf2353

  • SSDEEP

    12288:7CpyvXFPTfnCvX66h/NYJ9nDW6FApNg3gZqdDUtOuBiMc/j6KRVrxn7Nl4+GtlrL:+k9P7nCvX6MNYLIbgYJ3chra+GbrL

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Executes dropped EXE 9 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 56 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Enumerates processes with tasklist 1 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3c7d982471b041b1ba25def3ac74d478d083ba867e1ed7356375b7caa87d308d.exe
    "C:\Users\Admin\AppData\Local\Temp\3c7d982471b041b1ba25def3ac74d478d083ba867e1ed7356375b7caa87d308d.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3532
    • C:\Users\Admin\AppData\Local\Temp\3c7d982471b041b1ba25def3ac74d478d083ba867e1ed7356375b7caa87d308d.exe
      "C:\Users\Admin\AppData\Local\Temp\3c7d982471b041b1ba25def3ac74d478d083ba867e1ed7356375b7caa87d308d.exe"
      2⤵
      • Checks computer location settings
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1144
      • C:\Users\Admin\d3WQGzd9.exe
        C:\Users\Admin\d3WQGzd9.exe
        3⤵
        • Modifies visiblity of hidden/system files in Explorer
        • Executes dropped EXE
        • Checks computer location settings
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4236
        • C:\Users\Admin\naiiso.exe
          "C:\Users\Admin\naiiso.exe"
          4⤵
          • Modifies visiblity of hidden/system files in Explorer
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of SetWindowsHookEx
          PID:4272
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c tasklist&&del d3WQGzd9.exe
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:316
          • C:\Windows\SysWOW64\tasklist.exe
            tasklist
            5⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:2568
      • C:\Users\Admin\awhost.exe
        C:\Users\Admin\awhost.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3660
        • C:\Windows\SysWOW64\svchost.exe
          "C:\Windows\system32\svchost.exe"
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:4632
      • C:\Users\Admin\bwhost.exe
        C:\Users\Admin\bwhost.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2932
        • C:\Users\Admin\bwhost.exe
          "C:\Users\Admin\bwhost.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:3032
          • C:\Windows\explorer.exe
            000000D8*
            5⤵
              PID:2112
              • C:\Windows\system32\WerFault.exe
                C:\Windows\system32\WerFault.exe -u -p 2112 -s 112
                6⤵
                • Program crash
                PID:2148
        • C:\Users\Admin\cwhost.exe
          C:\Users\Admin\cwhost.exe
          3⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in Program Files directory
          • Suspicious use of WriteProcessMemory
          PID:3472
          • C:\Users\Admin\cwhost.exe
            C:\Users\Admin\cwhost.exe startC:\Users\Admin\AppData\Roaming\conhost.exe%C:\Users\Admin\AppData\Roaming
            4⤵
            • Executes dropped EXE
            PID:4772
          • C:\Users\Admin\cwhost.exe
            C:\Users\Admin\cwhost.exe startC:\Users\Admin\AppData\Local\Temp\dwm.exe%C:\Users\Admin\AppData\Local\Temp
            4⤵
            • Executes dropped EXE
            PID:1852
        • C:\Users\Admin\dwhost.exe
          C:\Users\Admin\dwhost.exe
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:1640
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c tasklist&&del 3c7d982471b041b1ba25def3ac74d478d083ba867e1ed7356375b7caa87d308d.exe
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2264
          • C:\Windows\SysWOW64\tasklist.exe
            tasklist
            4⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:3808
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -pss -s 416 -p 2112 -ip 2112
      1⤵
        PID:3516

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\awhost.exe

        Filesize

        68KB

        MD5

        b0406fa1f1b4a471ce4c1521708d1ef3

        SHA1

        bd2bb68d92c8b6af7604d52e336152bc48ea1227

        SHA256

        ef2abd7d609bba1f141b3e1dc6a79d937fe68e37d51b093fc29e0d800bf6fa29

        SHA512

        07bec70b25b083919a91de4930842ba8b264e869d0251134cbfecbc9227be704c70600c9db878eee08f7d1fa1df6c848577b632f810b014d62ace26b961bb2cc

      • C:\Users\Admin\awhost.exe

        Filesize

        68KB

        MD5

        b0406fa1f1b4a471ce4c1521708d1ef3

        SHA1

        bd2bb68d92c8b6af7604d52e336152bc48ea1227

        SHA256

        ef2abd7d609bba1f141b3e1dc6a79d937fe68e37d51b093fc29e0d800bf6fa29

        SHA512

        07bec70b25b083919a91de4930842ba8b264e869d0251134cbfecbc9227be704c70600c9db878eee08f7d1fa1df6c848577b632f810b014d62ace26b961bb2cc

      • C:\Users\Admin\bwhost.exe

        Filesize

        136KB

        MD5

        acaf206a193335d7983a46a8c9e18fea

        SHA1

        3a33b8148c23887c2b9edc2d0dbec3d83398069b

        SHA256

        8aa2fb2e061fc4a30160f912db3f1ea75189d16d922f82aba6538e92c4df47ca

        SHA512

        846622efa83273ce9f40f38953077eca4a6f064923a8cf9b202d19cac9fac4c8e58007f2531fafafb6b408787d0ed23a3349b49794d0311736efa35bba6fba10

      • C:\Users\Admin\bwhost.exe

        Filesize

        136KB

        MD5

        acaf206a193335d7983a46a8c9e18fea

        SHA1

        3a33b8148c23887c2b9edc2d0dbec3d83398069b

        SHA256

        8aa2fb2e061fc4a30160f912db3f1ea75189d16d922f82aba6538e92c4df47ca

        SHA512

        846622efa83273ce9f40f38953077eca4a6f064923a8cf9b202d19cac9fac4c8e58007f2531fafafb6b408787d0ed23a3349b49794d0311736efa35bba6fba10

      • C:\Users\Admin\bwhost.exe

        Filesize

        136KB

        MD5

        acaf206a193335d7983a46a8c9e18fea

        SHA1

        3a33b8148c23887c2b9edc2d0dbec3d83398069b

        SHA256

        8aa2fb2e061fc4a30160f912db3f1ea75189d16d922f82aba6538e92c4df47ca

        SHA512

        846622efa83273ce9f40f38953077eca4a6f064923a8cf9b202d19cac9fac4c8e58007f2531fafafb6b408787d0ed23a3349b49794d0311736efa35bba6fba10

      • C:\Users\Admin\cwhost.exe

        Filesize

        170KB

        MD5

        40d9607cb66da11b9adfec5b93b8b311

        SHA1

        55bf463cd5c0c90ba92935ef81ae47ab3bc5fea6

        SHA256

        033e60eebb966b3bcfbe27fa3e99e8f393970f320b5cc25cb16517869eb5f3e6

        SHA512

        e764053de1c2444e61e638e67e91cf7d9d968df4d60b8bcc3f5ddfc317edb1f14e950d096d451fa372a699fc886125066f4e2f2de171641433ce1e066aa58078

      • C:\Users\Admin\cwhost.exe

        Filesize

        170KB

        MD5

        40d9607cb66da11b9adfec5b93b8b311

        SHA1

        55bf463cd5c0c90ba92935ef81ae47ab3bc5fea6

        SHA256

        033e60eebb966b3bcfbe27fa3e99e8f393970f320b5cc25cb16517869eb5f3e6

        SHA512

        e764053de1c2444e61e638e67e91cf7d9d968df4d60b8bcc3f5ddfc317edb1f14e950d096d451fa372a699fc886125066f4e2f2de171641433ce1e066aa58078

      • C:\Users\Admin\cwhost.exe

        Filesize

        170KB

        MD5

        40d9607cb66da11b9adfec5b93b8b311

        SHA1

        55bf463cd5c0c90ba92935ef81ae47ab3bc5fea6

        SHA256

        033e60eebb966b3bcfbe27fa3e99e8f393970f320b5cc25cb16517869eb5f3e6

        SHA512

        e764053de1c2444e61e638e67e91cf7d9d968df4d60b8bcc3f5ddfc317edb1f14e950d096d451fa372a699fc886125066f4e2f2de171641433ce1e066aa58078

      • C:\Users\Admin\cwhost.exe

        Filesize

        170KB

        MD5

        40d9607cb66da11b9adfec5b93b8b311

        SHA1

        55bf463cd5c0c90ba92935ef81ae47ab3bc5fea6

        SHA256

        033e60eebb966b3bcfbe27fa3e99e8f393970f320b5cc25cb16517869eb5f3e6

        SHA512

        e764053de1c2444e61e638e67e91cf7d9d968df4d60b8bcc3f5ddfc317edb1f14e950d096d451fa372a699fc886125066f4e2f2de171641433ce1e066aa58078

      • C:\Users\Admin\d3WQGzd9.exe

        Filesize

        364KB

        MD5

        db406d87e556a0008c18429ecf3cc93a

        SHA1

        3a1b7a87080bf1d78fca904bd7515833bbd380e8

        SHA256

        2712b4f742a53c7d4b9a55c8f760447a26925c10a3ca6c10b84dea49482a2768

        SHA512

        e0da870b0c8f8955277b9227ef3de2b4d3e45d37986ac9a9b445e24506f265020f071365a2135b1e2892aaa64c3b7477d6c4a57598f3601655d74d92d6222354

      • C:\Users\Admin\d3WQGzd9.exe

        Filesize

        364KB

        MD5

        db406d87e556a0008c18429ecf3cc93a

        SHA1

        3a1b7a87080bf1d78fca904bd7515833bbd380e8

        SHA256

        2712b4f742a53c7d4b9a55c8f760447a26925c10a3ca6c10b84dea49482a2768

        SHA512

        e0da870b0c8f8955277b9227ef3de2b4d3e45d37986ac9a9b445e24506f265020f071365a2135b1e2892aaa64c3b7477d6c4a57598f3601655d74d92d6222354

      • C:\Users\Admin\dwhost.exe

        Filesize

        24KB

        MD5

        aaa893d374547f20f7fdd7c3b6c56b36

        SHA1

        f7aab7bd60af5e948b71abcccbcfb1d62f6580ff

        SHA256

        17c950477ffd3e28c4135c4cc5711589415129c7b21c4af1e89deaf68f043d03

        SHA512

        491b88e809425dd20dc9052fe45ab101ccb803c186a27d6502bf1cbefa8d903d51f72c02e604ec346f77b85c4324daa036341a42fcba0a96e5c69781ebfecb31

      • C:\Users\Admin\dwhost.exe

        Filesize

        24KB

        MD5

        aaa893d374547f20f7fdd7c3b6c56b36

        SHA1

        f7aab7bd60af5e948b71abcccbcfb1d62f6580ff

        SHA256

        17c950477ffd3e28c4135c4cc5711589415129c7b21c4af1e89deaf68f043d03

        SHA512

        491b88e809425dd20dc9052fe45ab101ccb803c186a27d6502bf1cbefa8d903d51f72c02e604ec346f77b85c4324daa036341a42fcba0a96e5c69781ebfecb31

      • C:\Users\Admin\naiiso.exe

        Filesize

        364KB

        MD5

        761c0317ef6020d13af82f7e5788a213

        SHA1

        f9ce95f8a1644aadf658749eea2049fbc54661d6

        SHA256

        20c7bc3c73464a4100aef1e21133b2064e5875b84ff28b3c1cc7741495508001

        SHA512

        19bc60374e0a63a12d4e36a7ba23ce5a9f106feee60bf46831c2e2adb594e57e73cb253c3feb5ad7a6400401c3988ad5f21034d2c5d4f55720bc2a44a7943b67

      • C:\Users\Admin\naiiso.exe

        Filesize

        364KB

        MD5

        761c0317ef6020d13af82f7e5788a213

        SHA1

        f9ce95f8a1644aadf658749eea2049fbc54661d6

        SHA256

        20c7bc3c73464a4100aef1e21133b2064e5875b84ff28b3c1cc7741495508001

        SHA512

        19bc60374e0a63a12d4e36a7ba23ce5a9f106feee60bf46831c2e2adb594e57e73cb253c3feb5ad7a6400401c3988ad5f21034d2c5d4f55720bc2a44a7943b67

      • memory/1144-146-0x0000000000400000-0x00000000004C4000-memory.dmp

        Filesize

        784KB

      • memory/1144-197-0x0000000000400000-0x00000000004C4000-memory.dmp

        Filesize

        784KB

      • memory/1144-140-0x0000000000400000-0x00000000004C4000-memory.dmp

        Filesize

        784KB

      • memory/1144-136-0x0000000000400000-0x00000000004C4000-memory.dmp

        Filesize

        784KB

      • memory/1852-190-0x00000000007B3000-0x00000000007CB000-memory.dmp

        Filesize

        96KB

      • memory/1852-189-0x0000000000400000-0x0000000000449000-memory.dmp

        Filesize

        292KB

      • memory/2112-175-0x0000000000D10000-0x0000000000D25000-memory.dmp

        Filesize

        84KB

      • memory/3032-170-0x0000000000400000-0x000000000041B000-memory.dmp

        Filesize

        108KB

      • memory/3032-173-0x0000000000400000-0x000000000041B000-memory.dmp

        Filesize

        108KB

      • memory/3472-186-0x0000000000692000-0x00000000006AA000-memory.dmp

        Filesize

        96KB

      • memory/3472-179-0x0000000000400000-0x0000000000449000-memory.dmp

        Filesize

        292KB

      • memory/3472-180-0x0000000000692000-0x00000000006AA000-memory.dmp

        Filesize

        96KB

      • memory/3472-185-0x0000000000400000-0x0000000000449000-memory.dmp

        Filesize

        292KB

      • memory/4632-163-0x0000000000400000-0x000000000040B000-memory.dmp

        Filesize

        44KB

      • memory/4632-160-0x0000000000400000-0x000000000040B000-memory.dmp

        Filesize

        44KB

      • memory/4632-162-0x0000000000400000-0x000000000040B000-memory.dmp

        Filesize

        44KB

      • memory/4772-184-0x0000000000703000-0x000000000071B000-memory.dmp

        Filesize

        96KB

      • memory/4772-183-0x0000000000400000-0x0000000000449000-memory.dmp

        Filesize

        292KB