Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    169s
  • max time network
    180s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/11/2022, 11:28

General

  • Target

    9cfee1993bd2ba3b348c86e4e2e87a001d3dc435a60d9cb3d1f40488939d0320.exe

  • Size

    231KB

  • MD5

    0f2d2be5d9800794b23a1912ba246251

  • SHA1

    a2efb31f80432227de63a96177f8d54087593f11

  • SHA256

    9cfee1993bd2ba3b348c86e4e2e87a001d3dc435a60d9cb3d1f40488939d0320

  • SHA512

    9338d1a8b643632c1c2539fc708d8474547cc051e70c9a7ae532d0c9f42d9a05baf6c2f74862cd5d45557e0dc785b997d0ff9c7b3638688819ece414dc3d7f43

  • SSDEEP

    3072:gZ6S2r9wAru5P5ZXcSNAA3x0Ee9FdEKcwAuTkqb//npGc6hnI1dAF9NAqwv:gsr9wArAPXcXexgrcwAm7PAcwnIgAR

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Modifies Internet Explorer Phishing Filter 1 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9cfee1993bd2ba3b348c86e4e2e87a001d3dc435a60d9cb3d1f40488939d0320.exe
    "C:\Users\Admin\AppData\Local\Temp\9cfee1993bd2ba3b348c86e4e2e87a001d3dc435a60d9cb3d1f40488939d0320.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:3504
    • C:\Users\Admin\AppData\Local\Temp\9cfee1993bd2ba3b348c86e4e2e87a001d3dc435a60d9cb3d1f40488939d0320.exe
      C:\Users\Admin\AppData\Local\Temp\9cfee1993bd2ba3b348c86e4e2e87a001d3dc435a60d9cb3d1f40488939d0320.exe
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3144
      • C:\wndows\EC9BF84DC25.exe
        "C:\wndows\EC9BF84DC25.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:3592
        • C:\wndows\EC9BF84DC25.exe
          C:\wndows\EC9BF84DC25.exe
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2204
          • C:\Users\Admin\AppData\Local\Temp\wZg21E0.exe
            "C:\Users\Admin\AppData\Local\Temp\wZg21E0.exe"
            5⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • Modifies Internet Explorer Phishing Filter
            • Modifies Internet Explorer settings
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:3500

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\wZg21E0.exe

    Filesize

    3KB

    MD5

    29090b6b4d6605a97ac760d06436ac2d

    SHA1

    d929d3389642e52bae5ad8512293c9c4d3e4fab5

    SHA256

    98a24f0caf5b578e230e6f1103a5fba6aecb28a9128cad5520fcde546d643272

    SHA512

    9121ec42fa66e14a4fc3932c8dbcc8fb1a93ab9de00da57a82e176faa70b73f6992f8c5e2ab52c02fc28c8f0c59aee73b6fbbd39107db7d15105054f4390e9be

  • C:\Users\Admin\AppData\Local\Temp\wZg21E0.exe

    Filesize

    3KB

    MD5

    29090b6b4d6605a97ac760d06436ac2d

    SHA1

    d929d3389642e52bae5ad8512293c9c4d3e4fab5

    SHA256

    98a24f0caf5b578e230e6f1103a5fba6aecb28a9128cad5520fcde546d643272

    SHA512

    9121ec42fa66e14a4fc3932c8dbcc8fb1a93ab9de00da57a82e176faa70b73f6992f8c5e2ab52c02fc28c8f0c59aee73b6fbbd39107db7d15105054f4390e9be

  • C:\wndows\416A62607B8BE4F

    Filesize

    38KB

    MD5

    4e9f5e19f191a321dbcf2a863f701b30

    SHA1

    f87421ee6c12379c868e9880609c876b1d66c4c8

    SHA256

    0404c386355b8b4db2d2773b36b5b84260ef55defc1beb92ca522d03d1113278

    SHA512

    cf6b08db8a2b4d13b24a1e63757c15d0e4ea85eea23b3ec83c5ce590c6c308b5c19f489f0b92633a50b7b8f7ba1c410b656a1308d7e583d9f3374d6aef7ec46a

  • C:\wndows\EC9BF84DC25.exe

    Filesize

    231KB

    MD5

    0f2d2be5d9800794b23a1912ba246251

    SHA1

    a2efb31f80432227de63a96177f8d54087593f11

    SHA256

    9cfee1993bd2ba3b348c86e4e2e87a001d3dc435a60d9cb3d1f40488939d0320

    SHA512

    9338d1a8b643632c1c2539fc708d8474547cc051e70c9a7ae532d0c9f42d9a05baf6c2f74862cd5d45557e0dc785b997d0ff9c7b3638688819ece414dc3d7f43

  • C:\wndows\EC9BF84DC25.exe

    Filesize

    231KB

    MD5

    0f2d2be5d9800794b23a1912ba246251

    SHA1

    a2efb31f80432227de63a96177f8d54087593f11

    SHA256

    9cfee1993bd2ba3b348c86e4e2e87a001d3dc435a60d9cb3d1f40488939d0320

    SHA512

    9338d1a8b643632c1c2539fc708d8474547cc051e70c9a7ae532d0c9f42d9a05baf6c2f74862cd5d45557e0dc785b997d0ff9c7b3638688819ece414dc3d7f43

  • C:\wndows\EC9BF84DC25.exe

    Filesize

    231KB

    MD5

    0f2d2be5d9800794b23a1912ba246251

    SHA1

    a2efb31f80432227de63a96177f8d54087593f11

    SHA256

    9cfee1993bd2ba3b348c86e4e2e87a001d3dc435a60d9cb3d1f40488939d0320

    SHA512

    9338d1a8b643632c1c2539fc708d8474547cc051e70c9a7ae532d0c9f42d9a05baf6c2f74862cd5d45557e0dc785b997d0ff9c7b3638688819ece414dc3d7f43

  • memory/2204-160-0x0000000000940000-0x000000000098E000-memory.dmp

    Filesize

    312KB

  • memory/2204-156-0x0000000000400000-0x0000000000468000-memory.dmp

    Filesize

    416KB

  • memory/2204-152-0x0000000000443000-0x0000000000467000-memory.dmp

    Filesize

    144KB

  • memory/3144-198-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/3144-194-0x0000000077BB0000-0x0000000077D53000-memory.dmp

    Filesize

    1.6MB

  • memory/3144-233-0x0000000077AD0000-0x0000000077B33000-memory.dmp

    Filesize

    396KB

  • memory/3144-140-0x0000000000400000-0x0000000000468000-memory.dmp

    Filesize

    416KB

  • memory/3144-139-0x0000000000443000-0x0000000000467000-memory.dmp

    Filesize

    144KB

  • memory/3144-231-0x0000000075580000-0x00000000759D0000-memory.dmp

    Filesize

    4.3MB

  • memory/3144-227-0x000000000BB05000-0x000000000BB07000-memory.dmp

    Filesize

    8KB

  • memory/3144-138-0x0000000000443000-0x0000000000467000-memory.dmp

    Filesize

    144KB

  • memory/3144-137-0x0000000000443000-0x0000000000467000-memory.dmp

    Filesize

    144KB

  • memory/3144-136-0x0000000000400000-0x0000000000468000-memory.dmp

    Filesize

    416KB

  • memory/3144-135-0x0000000000400000-0x0000000000468000-memory.dmp

    Filesize

    416KB

  • memory/3144-133-0x0000000000400000-0x0000000000468000-memory.dmp

    Filesize

    416KB

  • memory/3144-228-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/3144-225-0x0000000077BB0000-0x0000000077D53000-memory.dmp

    Filesize

    1.6MB

  • memory/3144-163-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/3144-166-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/3144-224-0x0000000000400000-0x0000000000468000-memory.dmp

    Filesize

    416KB

  • memory/3144-223-0x000000000BB06000-0x000000000BB08000-memory.dmp

    Filesize

    8KB

  • memory/3144-173-0x0000000077BB0000-0x0000000077D53000-memory.dmp

    Filesize

    1.6MB

  • memory/3144-222-0x0000000077BB0000-0x0000000077D53000-memory.dmp

    Filesize

    1.6MB

  • memory/3144-195-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/3144-177-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/3144-144-0x0000000077BB0000-0x0000000077D53000-memory.dmp

    Filesize

    1.6MB

  • memory/3144-197-0x0000000077BB0000-0x0000000077D53000-memory.dmp

    Filesize

    1.6MB

  • memory/3144-174-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/3144-201-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/3144-170-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/3144-168-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/3144-211-0x0000000077BB0000-0x0000000077D53000-memory.dmp

    Filesize

    1.6MB

  • memory/3144-214-0x0000000077BB0000-0x0000000077D53000-memory.dmp

    Filesize

    1.6MB

  • memory/3144-180-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/3144-183-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/3144-204-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/3144-218-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/3144-182-0x0000000077BB0000-0x0000000077D53000-memory.dmp

    Filesize

    1.6MB

  • memory/3144-212-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/3144-191-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/3144-210-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/3144-188-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/3144-207-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/3144-215-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/3500-178-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/3500-175-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/3500-171-0x00000000001B0000-0x00000000001B6000-memory.dmp

    Filesize

    24KB

  • memory/3500-216-0x0000000077BB0000-0x0000000077D53000-memory.dmp

    Filesize

    1.6MB

  • memory/3500-192-0x0000000077BB0000-0x0000000077D53000-memory.dmp

    Filesize

    1.6MB

  • memory/3500-186-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/3500-189-0x0000000077BB0000-0x0000000077D53000-memory.dmp

    Filesize

    1.6MB

  • memory/3500-187-0x0000000000930000-0x0000000000939000-memory.dmp

    Filesize

    36KB

  • memory/3500-206-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/3500-217-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/3500-219-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/3500-185-0x0000000000510000-0x0000000000516000-memory.dmp

    Filesize

    24KB

  • memory/3500-184-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/3500-181-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/3500-213-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/3500-165-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/3500-209-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/3500-208-0x0000000077BB0000-0x0000000077D53000-memory.dmp

    Filesize

    1.6MB

  • memory/3500-205-0x0000000077BB0000-0x0000000077D53000-memory.dmp

    Filesize

    1.6MB

  • memory/3500-202-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/3500-203-0x0000000077BB0000-0x0000000077D53000-memory.dmp

    Filesize

    1.6MB

  • memory/3500-200-0x0000000077BB0000-0x0000000077D53000-memory.dmp

    Filesize

    1.6MB

  • memory/3500-199-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/3500-196-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/3500-179-0x00000000001D0000-0x00000000001D7000-memory.dmp

    Filesize

    28KB

  • memory/3500-176-0x0000000000940000-0x000000000098E000-memory.dmp

    Filesize

    312KB

  • memory/3500-190-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/3500-193-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/3500-220-0x000000000BB06000-0x000000000BB08000-memory.dmp

    Filesize

    8KB

  • memory/3500-169-0x0000000001000000-0x0000000001004000-memory.dmp

    Filesize

    16KB

  • memory/3500-221-0x0000000077BB0000-0x0000000077D53000-memory.dmp

    Filesize

    1.6MB

  • memory/3500-172-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/3500-167-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/3500-164-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/3500-226-0x0000000075580000-0x00000000759D0000-memory.dmp

    Filesize

    4.3MB

  • memory/3500-162-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/3500-230-0x000000000BB04000-0x000000000BB06000-memory.dmp

    Filesize

    8KB

  • memory/3500-229-0x000000000BB18000-0x000000000BB1A000-memory.dmp

    Filesize

    8KB

  • memory/3500-153-0x0000000000940000-0x000000000098E000-memory.dmp

    Filesize

    312KB

  • memory/3500-232-0x0000000077AD0000-0x0000000077B33000-memory.dmp

    Filesize

    396KB

  • memory/3500-239-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/3500-234-0x000000000BB05000-0x000000000BB07000-memory.dmp

    Filesize

    8KB

  • memory/3500-235-0x0000000077BB0000-0x0000000077D53000-memory.dmp

    Filesize

    1.6MB

  • memory/3500-236-0x000000000BB06000-0x000000000BB08000-memory.dmp

    Filesize

    8KB

  • memory/3500-237-0x000000000BB18000-0x000000000BB1A000-memory.dmp

    Filesize

    8KB

  • memory/3500-238-0x0000000000940000-0x000000000098E000-memory.dmp

    Filesize

    312KB