Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    145s
  • max time network
    190s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/11/2022, 14:12

General

  • Target

    15e7be218dfd4994b88b654b9d264fce077f6fa423482ca0c5199ea29ed1c5cd.exe

  • Size

    115KB

  • MD5

    0f76cf7b3e144048f566941346c75e92

  • SHA1

    1c6a5e27fee8e7097861ad3badcf04fdf43c5b4c

  • SHA256

    15e7be218dfd4994b88b654b9d264fce077f6fa423482ca0c5199ea29ed1c5cd

  • SHA512

    63d5810622ff301593bf02a0e7660ad598996b4a5fb2808a995e56e9972d803383edafcde002ea0e0339423957768572a0f2d1ecf1ba5e807d32e7a1dc8b3011

  • SSDEEP

    3072:MfVp/jp0hYkB+y5z83cRJbAERDaJVsPrFgVUfIqVkS:MtpEYW+y632JkEMsqeIqV

Score
6/10

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 3 IoCs
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 30 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 34 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\15e7be218dfd4994b88b654b9d264fce077f6fa423482ca0c5199ea29ed1c5cd.exe
    "C:\Users\Admin\AppData\Local\Temp\15e7be218dfd4994b88b654b9d264fce077f6fa423482ca0c5199ea29ed1c5cd.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Suspicious behavior: RenamesItself
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1932
    • C:\Windows\SysWOW64\svchost.exe
      "C:\Windows\system32\svchost.exe"
      2⤵
      • Enumerates connected drives
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1220
      • C:\Windows\SysWOW64\mspaint.exe
        "C:\Windows\system32\mspaint.exe"
        3⤵
        • Adds Run key to start application
        • Enumerates connected drives
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:3088
    • C:\Users\Admin\AppData\Local\Temp\15e7be218dfd4994b88b654b9d264fce077f6fa423482ca0c5199ea29ed1c5cd.exe
      "C:\Users\Admin\AppData\Local\Temp\15e7be218dfd4994b88b654b9d264fce077f6fa423482ca0c5199ea29ed1c5cd.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2272
      • C:\Program Files (x86)\Internet Explorer\iexplore.exe
        "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
        3⤵
        • Adds Run key to start application
        • Enumerates connected drives
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4780
        • C:\Program Files\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1348
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1348 CREDAT:17410 /prefetch:2
            5⤵
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            PID:3956
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
    1⤵
      PID:3856

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1220-142-0x0000000000E90000-0x0000000000EB1000-memory.dmp

      Filesize

      132KB

    • memory/1220-148-0x0000000003120000-0x000000000316E000-memory.dmp

      Filesize

      312KB

    • memory/1932-133-0x0000000000400000-0x0000000000435000-memory.dmp

      Filesize

      212KB

    • memory/1932-135-0x00000000005D0000-0x00000000005E5000-memory.dmp

      Filesize

      84KB

    • memory/1932-132-0x0000000000400000-0x0000000000435000-memory.dmp

      Filesize

      212KB

    • memory/1932-146-0x0000000002D60000-0x0000000002DAE000-memory.dmp

      Filesize

      312KB

    • memory/1932-144-0x0000000000400000-0x0000000000435000-memory.dmp

      Filesize

      212KB

    • memory/2272-138-0x0000000000400000-0x000000000044E000-memory.dmp

      Filesize

      312KB

    • memory/2272-143-0x0000000000400000-0x000000000044E000-memory.dmp

      Filesize

      312KB

    • memory/2272-145-0x0000000000400000-0x000000000044E000-memory.dmp

      Filesize

      312KB

    • memory/2272-147-0x0000000000400000-0x000000000044E000-memory.dmp

      Filesize

      312KB

    • memory/2272-140-0x0000000000400000-0x000000000044E000-memory.dmp

      Filesize

      312KB

    • memory/3088-149-0x00000000032C0000-0x000000000330E000-memory.dmp

      Filesize

      312KB

    • memory/3088-150-0x00000000032C0000-0x000000000330E000-memory.dmp

      Filesize

      312KB