Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    142s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/11/2022, 15:14

General

  • Target

    ceaf58ec3fe3e00c5de53880b87775843ac5a89d88fa2b6121b500cd97b9e2e7.exe

  • Size

    354KB

  • MD5

    1f04108924a073198369170e9ccec248

  • SHA1

    bb3e5f5f565c7ae0f588ea3e4c40b0ffcf91510c

  • SHA256

    ceaf58ec3fe3e00c5de53880b87775843ac5a89d88fa2b6121b500cd97b9e2e7

  • SHA512

    a08f36fbfd6ddb8817417c6079fe3e1fdad0272624363b4a3a5f956c595b4398f9f41d802fbd92acb16412418bb732521c1d754f1a608d9ea819798b16e7e851

  • SSDEEP

    3072:7ToHR8L1KwK9f7UgV4qJMEG5qzxb251AEwRnEsScv3qug0z:7TEqL1u9TUgV5Rpzxb2nsnXh

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 30 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 29 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ceaf58ec3fe3e00c5de53880b87775843ac5a89d88fa2b6121b500cd97b9e2e7.exe
    "C:\Users\Admin\AppData\Local\Temp\ceaf58ec3fe3e00c5de53880b87775843ac5a89d88fa2b6121b500cd97b9e2e7.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:388
    • C:\Users\Admin\AppData\Local\Temp\ceaf58ec3fe3e00c5de53880b87775843ac5a89d88fa2b6121b500cd97b9e2e7.exe
      C:\Users\Admin\AppData\Local\Temp\ceaf58ec3fe3e00c5de53880b87775843ac5a89d88fa2b6121b500cd97b9e2e7.exe
      2⤵
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1824
      • C:\Users\Admin\AppData\Roaming\Pviwil.exe
        "C:\Users\Admin\AppData\Roaming\Pviwil.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:3060
        • C:\Users\Admin\AppData\Roaming\Pviwil.exe
          C:\Users\Admin\AppData\Roaming\Pviwil.exe
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4808
          • C:\Program Files (x86)\Internet Explorer\iexplore.exe
            "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:4860
            • C:\Program Files\Internet Explorer\IEXPLORE.EXE
              "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
              6⤵
              • Modifies Internet Explorer settings
              • Suspicious behavior: GetForegroundWindowSpam
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:4756
              • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4756 CREDAT:17410 /prefetch:2
                7⤵
                • Modifies Internet Explorer settings
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of SetWindowsHookEx
                PID:444

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

    Filesize

    471B

    MD5

    cb295ed32b0acd9eac87bcc961fb315a

    SHA1

    a580f2d38c9d1611e25b6aaa3d79b54eb34d3ebe

    SHA256

    980abeaa872503211925db8acf8bdcdff0bc3c6deb2182fd698f6a444d2625be

    SHA512

    974f48bdfb8ea90a49cfa25cacc98c9a145702f4e4967dd6ffddd5eaee6144189499682e80b342708e04f812006314b04e5715492170d0f63c7b0530e9cd399a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

    Filesize

    434B

    MD5

    68e06f56874544e073dfdc95247f8cb6

    SHA1

    12e5706084a251da32a1079ad3bd8718bf53a50b

    SHA256

    4d0a1a8120b3f782da004aaba32501ee69cb6fb516e42f2294417e297f603678

    SHA512

    eb8a05ec4d76a31ed0f55e379d236ebe3a4ae90784f3afecc5fefdecd35a0b0bf2965bf892551433b6041b2d1edcf64bae1fe15b6e335edd4287af3f9a815cbc

  • C:\Users\Admin\AppData\Roaming\Pviwil.exe

    Filesize

    354KB

    MD5

    1f04108924a073198369170e9ccec248

    SHA1

    bb3e5f5f565c7ae0f588ea3e4c40b0ffcf91510c

    SHA256

    ceaf58ec3fe3e00c5de53880b87775843ac5a89d88fa2b6121b500cd97b9e2e7

    SHA512

    a08f36fbfd6ddb8817417c6079fe3e1fdad0272624363b4a3a5f956c595b4398f9f41d802fbd92acb16412418bb732521c1d754f1a608d9ea819798b16e7e851

  • C:\Users\Admin\AppData\Roaming\Pviwil.exe

    Filesize

    354KB

    MD5

    1f04108924a073198369170e9ccec248

    SHA1

    bb3e5f5f565c7ae0f588ea3e4c40b0ffcf91510c

    SHA256

    ceaf58ec3fe3e00c5de53880b87775843ac5a89d88fa2b6121b500cd97b9e2e7

    SHA512

    a08f36fbfd6ddb8817417c6079fe3e1fdad0272624363b4a3a5f956c595b4398f9f41d802fbd92acb16412418bb732521c1d754f1a608d9ea819798b16e7e851

  • C:\Users\Admin\AppData\Roaming\Pviwil.exe

    Filesize

    354KB

    MD5

    1f04108924a073198369170e9ccec248

    SHA1

    bb3e5f5f565c7ae0f588ea3e4c40b0ffcf91510c

    SHA256

    ceaf58ec3fe3e00c5de53880b87775843ac5a89d88fa2b6121b500cd97b9e2e7

    SHA512

    a08f36fbfd6ddb8817417c6079fe3e1fdad0272624363b4a3a5f956c595b4398f9f41d802fbd92acb16412418bb732521c1d754f1a608d9ea819798b16e7e851

  • memory/388-136-0x0000000000400000-0x0000000000463000-memory.dmp

    Filesize

    396KB

  • memory/388-132-0x0000000000400000-0x0000000000463000-memory.dmp

    Filesize

    396KB

  • memory/1824-137-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/1824-141-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/1824-138-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/1824-134-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/3060-143-0x0000000000400000-0x0000000000463000-memory.dmp

    Filesize

    396KB

  • memory/3060-148-0x0000000000400000-0x0000000000463000-memory.dmp

    Filesize

    396KB

  • memory/4808-150-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/4808-151-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB