Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    144s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/10/2022, 03:10

General

  • Target

    60758a7ad36b27f20c240fc62ea741079f7eaab1ac3d7b9f65b2348e7b1a01d8.exe

  • Size

    313KB

  • MD5

    a70435f20dbe641e6d732c762f2de12a

  • SHA1

    811e6aeb3a9e6eeb7d3a72043ba7eaa6748df0ea

  • SHA256

    60758a7ad36b27f20c240fc62ea741079f7eaab1ac3d7b9f65b2348e7b1a01d8

  • SHA512

    90d4cb6d150be6f0f26affdf71e0004f63f79d2d1d14f0a4148623bfddeb3195702b77e82cff1bc86baf2b23c174854c482a5b577e47349223ccc14bcf82ce8a

  • SSDEEP

    6144:CrkP9uEo2S1YnQmCX492DkwNP3qpYFpdteedaMtBxOWUevASojincBSf1:CrkFu6/eIo4mdt2M/lUevAzicM1

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 3 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\60758a7ad36b27f20c240fc62ea741079f7eaab1ac3d7b9f65b2348e7b1a01d8.exe
    "C:\Users\Admin\AppData\Local\Temp\60758a7ad36b27f20c240fc62ea741079f7eaab1ac3d7b9f65b2348e7b1a01d8.exe"
    1⤵
    • Loads dropped DLL
    • Maps connected drives based on registry
    • Suspicious behavior: EnumeratesProcesses
    PID:4904

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\Tsu8B6063BC.dll

    Filesize

    269KB

    MD5

    af7ce801c8471c5cd19b366333c153c4

    SHA1

    4267749d020a362edbd25434ad65f98b073581f1

    SHA256

    cf7e00ba429bc9f27ccfacc49ae367054f40ada6cede9f513cc29a24e88bf49e

    SHA512

    88655bd940e9b540c4df551fe68135793eceed03f94389b0654637a18b252bf4d3ef73b0c49548b5fa6ba2cf6d9aff79335c4ebcc0b668e008bcc62c40d2a73c

  • C:\Users\Admin\AppData\Local\Temp\{B23EDC4B-AA40-440F-A6E4-E26269DDFEBD}\Custom.dll

    Filesize

    91KB

    MD5

    1ddad019fb1368d41772a70d80ed78dd

    SHA1

    2a622f9767b15216b00c7ec03de0100ce8bdced3

    SHA256

    8a9773f1d8bcd315888bcf4ef3e7dbbf4a84147aa6c1a920330326f97a240f4f

    SHA512

    a539e5048285bdd432bde5ec572b97ae47522000ea51da2264612345d498758e9ba21513328b55be4e4a31d004ebd02975c2405d4b3911809680c1f97cb3b3fa

  • C:\Users\Admin\AppData\Local\Temp\{B23EDC4B-AA40-440F-A6E4-E26269DDFEBD}\_Setup.dll

    Filesize

    169KB

    MD5

    14615d42dc6cd9a024a685e25356048c

    SHA1

    5d6c45e35d0c5951ab75b7c121421d1ee91d733d

    SHA256

    ec0265a1e752ed296e125645ea4c0097e4615a7e4c74ab5c520a2eb2ce2edaf5

    SHA512

    9a99f6e70f752ac3c904aa05070f3cbe2825ee396b3b7b3cbbede3b19ac8e36b96311078e4a3fa4d65cb765c2a7e73035cfdfaeb4f85b1bec66416cc4045bc34