Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    91s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/10/2022, 07:26

General

  • Target

    d735e5716967491b9ab08b69efe6082c3c2ecf58e3e2bbb7d398f95b1bec438e.exe

  • Size

    316KB

  • MD5

    c7e35572b202a69514b99c13aaf21422

  • SHA1

    a868a6304bdbe8d46716c653b5c9e01303e799bb

  • SHA256

    d735e5716967491b9ab08b69efe6082c3c2ecf58e3e2bbb7d398f95b1bec438e

  • SHA512

    b6bbac2ed1027451115006a5f78041d424cf13c1c3a48886b975b97ddf72790300284f5bf4ad259895a57036b8c7159c16e32066c7f1f858229ea81b137827aa

  • SSDEEP

    6144:9rybUzkuvcBYC47l2xphuK2+Otbaysqo+/VKitoTxwbs5iD3B2phoo:9rLkuveY3EMK9ObxD/06s5w3BLo

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 3 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d735e5716967491b9ab08b69efe6082c3c2ecf58e3e2bbb7d398f95b1bec438e.exe
    "C:\Users\Admin\AppData\Local\Temp\d735e5716967491b9ab08b69efe6082c3c2ecf58e3e2bbb7d398f95b1bec438e.exe"
    1⤵
    • Loads dropped DLL
    • Maps connected drives based on registry
    • Suspicious behavior: EnumeratesProcesses
    PID:4540

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\TsuCB54F616.dll

    Filesize

    269KB

    MD5

    af7ce801c8471c5cd19b366333c153c4

    SHA1

    4267749d020a362edbd25434ad65f98b073581f1

    SHA256

    cf7e00ba429bc9f27ccfacc49ae367054f40ada6cede9f513cc29a24e88bf49e

    SHA512

    88655bd940e9b540c4df551fe68135793eceed03f94389b0654637a18b252bf4d3ef73b0c49548b5fa6ba2cf6d9aff79335c4ebcc0b668e008bcc62c40d2a73c

  • C:\Users\Admin\AppData\Local\Temp\{93CB376C-DE66-43D6-A13D-96444828159A}\Custom.dll

    Filesize

    91KB

    MD5

    e6692b129ceb719afac35060c82a3f5b

    SHA1

    ae6add5ece16154b0954e675c45b4f9db964002b

    SHA256

    959d6a1a450279d35b253e104e9e5ea02d9eb996a3b8042cc31ee4891b571198

    SHA512

    1353b1324478322e216f559fdf35a90604764a600ab6c779e33c67622445d4b881a82bfb33454f783a4c3bb95c2f6a0c46e63c45290863d10e9bd6c2e98fe118

  • C:\Users\Admin\AppData\Local\Temp\{93CB376C-DE66-43D6-A13D-96444828159A}\_Setup.dll

    Filesize

    173KB

    MD5

    a9f8248fbe4c08e7031641baf102f432

    SHA1

    f830f1c75f35abb352aaa67b3c15bf01bc2f3b2c

    SHA256

    9c760af153597853ca6c96e6ddf6674d8cefefa4b4daa3001ebf6399768cd2d8

    SHA512

    92c32c9ccfbd4fcf9c7d6f743a24deba733a7545871d6d6a436490ad0001e7f07cd8b926f858999d4d2c7e1adddeb93100c6cdbaeff4e8aaf9b50b3714c48992