Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    181s
  • max time network
    217s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/11/2022, 23:29

General

  • Target

    39f6351e6dd779ab0c70e7d6089819398dcdcadd99263b71ba7094e296bc6a03.exe

  • Size

    2.7MB

  • MD5

    767016da6755f565ac3c0dc40aeb84ae

  • SHA1

    fbeeb27314d5634e172ef6957bceabe94fecadb4

  • SHA256

    39f6351e6dd779ab0c70e7d6089819398dcdcadd99263b71ba7094e296bc6a03

  • SHA512

    b103814764d6d0c9f70b497c131c5df3b5c5d4efed0bf4db4717a498b14f56f6562800b83e67c1774b4f7f850e005107fe69cbdda0d951ba411d3f4456fed49c

  • SSDEEP

    49152:J9RxdV8aZqlnGe8TOYUxCcd9OHsO5czEpOQB8hRFMgwGaoftX7uH9TL4Lbusq1:XRxdV82Qu/UxC2JtIgQB8aNGzX7udTLD

Score
9/10

Malware Config

Signatures

  • Checks for common network interception software 1 TTPs

    Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 6 IoCs
  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Enumerates processes with tasklist 1 TTPs 6 IoCs
  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Script User-Agent 2 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of WriteProcessMemory 63 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\39f6351e6dd779ab0c70e7d6089819398dcdcadd99263b71ba7094e296bc6a03.exe
    "C:\Users\Admin\AppData\Local\Temp\39f6351e6dd779ab0c70e7d6089819398dcdcadd99263b71ba7094e296bc6a03.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1332
    • C:\Users\Admin\AppData\Local\Temp\is-D65B8.tmp\39f6351e6dd779ab0c70e7d6089819398dcdcadd99263b71ba7094e296bc6a03.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-D65B8.tmp\39f6351e6dd779ab0c70e7d6089819398dcdcadd99263b71ba7094e296bc6a03.tmp" /SL5="$A0064,2529934,56832,C:\Users\Admin\AppData\Local\Temp\39f6351e6dd779ab0c70e7d6089819398dcdcadd99263b71ba7094e296bc6a03.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Maps connected drives based on registry
      • Enumerates system info in registry
      • Suspicious use of WriteProcessMemory
      PID:3580
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /C ""CheckProc.cmd""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4156
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq Setup.exe" /FO CSV
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1920
          • C:\Windows\SysWOW64\tasklist.exe
            tasklist /FI "IMAGENAME eq Setup.exe" /FO CSV
            5⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:3788
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /C ""CheckProc.cmd""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2184
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq Setup (1).exe" /FO CSV
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:504
          • C:\Windows\SysWOW64\tasklist.exe
            tasklist /FI "IMAGENAME eq Setup (1).exe" /FO CSV
            5⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:764
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /C ""CheckProc.cmd""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4324
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq Setup (2).exe" /FO CSV
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:3448
          • C:\Windows\SysWOW64\tasklist.exe
            tasklist /FI "IMAGENAME eq Setup (2).exe" /FO CSV
            5⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:2628
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /C ""CheckProc.cmd""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1668
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq Procmon.exe" /FO CSV
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4356
          • C:\Windows\SysWOW64\tasklist.exe
            tasklist /FI "IMAGENAME eq Procmon.exe" /FO CSV
            5⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:5016
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /C ""CheckProc.cmd""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:5052
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq unchecky_svc.exe" /FO CSV
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:64
          • C:\Windows\SysWOW64\tasklist.exe
            tasklist /FI "IMAGENAME eq unchecky_svc.exe" /FO CSV
            5⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:5048
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /C ""CheckProc.cmd""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2308
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq unchecky_gb.exe" /FO CSV
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2152
          • C:\Windows\SysWOW64\tasklist.exe
            tasklist /FI "IMAGENAME eq unchecky_gb.exe" /FO CSV
            5⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:3652
      • C:\Users\Admin\AppData\Local\Temp\is-FVIK2.tmp\gentlemjfst_ifr.exe
        "C:\Users\Admin\AppData\Local\Temp\is-FVIK2.tmp\gentlemjfst_ifr.exe" go=ofcourse product_id=UPD
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:2372
        • C:\Users\Admin\AppData\Local\Temp\is-GV4MM.tmp\gentlemjfst_ifr.tmp
          "C:\Users\Admin\AppData\Local\Temp\is-GV4MM.tmp\gentlemjfst_ifr.tmp" /SL5="$A01E2,2081576,56832,C:\Users\Admin\AppData\Local\Temp\is-FVIK2.tmp\gentlemjfst_ifr.exe" go=ofcourse product_id=UPD
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:4456

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\is-D65B8.tmp\39f6351e6dd779ab0c70e7d6089819398dcdcadd99263b71ba7094e296bc6a03.tmp

    Filesize

    690KB

    MD5

    1305181de520f125aeabf85dc24a89d6

    SHA1

    98b7548fede3f1468ccbdee405abdc4e5d2ec671

    SHA256

    0e19765b89a1a29afee09810dcb3ec5cc7c66053947be8f1aebdbb7c801dfeaf

    SHA512

    b0bfa9749a6a5a18c1926e6c5ebb4cdb156df1652cb822f067422a1cd21583340f32e4a1fc2f4c21a09343d73a55651972edbd2dec98ce44641a1097c16bc793

  • C:\Users\Admin\AppData\Local\Temp\is-D65B8.tmp\39f6351e6dd779ab0c70e7d6089819398dcdcadd99263b71ba7094e296bc6a03.tmp

    Filesize

    690KB

    MD5

    1305181de520f125aeabf85dc24a89d6

    SHA1

    98b7548fede3f1468ccbdee405abdc4e5d2ec671

    SHA256

    0e19765b89a1a29afee09810dcb3ec5cc7c66053947be8f1aebdbb7c801dfeaf

    SHA512

    b0bfa9749a6a5a18c1926e6c5ebb4cdb156df1652cb822f067422a1cd21583340f32e4a1fc2f4c21a09343d73a55651972edbd2dec98ce44641a1097c16bc793

  • C:\Users\Admin\AppData\Local\Temp\is-F9L6N.tmp\innocallback.dll

    Filesize

    63KB

    MD5

    1c55ae5ef9980e3b1028447da6105c75

    SHA1

    f85218e10e6aa23b2f5a3ed512895b437e41b45c

    SHA256

    6afa2d104be6efe3d9a2ab96dbb75db31565dad64dd0b791e402ecc25529809f

    SHA512

    1ec4d52f49747b29cfd83e1a75fc6ae4101add68ada0b9add5770c10be6dffb004bb47d0854d50871ed8d77acf67d4e0445e97f0548a95c182e83b94ddf2eb6b

  • C:\Users\Admin\AppData\Local\Temp\is-F9L6N.tmp\innocallback.dll

    Filesize

    63KB

    MD5

    1c55ae5ef9980e3b1028447da6105c75

    SHA1

    f85218e10e6aa23b2f5a3ed512895b437e41b45c

    SHA256

    6afa2d104be6efe3d9a2ab96dbb75db31565dad64dd0b791e402ecc25529809f

    SHA512

    1ec4d52f49747b29cfd83e1a75fc6ae4101add68ada0b9add5770c10be6dffb004bb47d0854d50871ed8d77acf67d4e0445e97f0548a95c182e83b94ddf2eb6b

  • C:\Users\Admin\AppData\Local\Temp\is-F9L6N.tmp\itdownload.dll

    Filesize

    200KB

    MD5

    d82a429efd885ca0f324dd92afb6b7b8

    SHA1

    86bbdaa15e6fc5c7779ac69c84e53c43c9eb20ea

    SHA256

    b258c4d7d2113dee2168ed7e35568c8e03341e24e3eafc7a22a0d62e32122ef3

    SHA512

    5bf0c3b8fa5db63205a263c4fa5337188173248bef609ba4d03508c50db1fd1e336f3041ce96d78cc97659357a83e6e422f5b079d893a20a683270e05f5438df

  • C:\Users\Admin\AppData\Local\Temp\is-F9L6N.tmp\itdownload.dll

    Filesize

    200KB

    MD5

    d82a429efd885ca0f324dd92afb6b7b8

    SHA1

    86bbdaa15e6fc5c7779ac69c84e53c43c9eb20ea

    SHA256

    b258c4d7d2113dee2168ed7e35568c8e03341e24e3eafc7a22a0d62e32122ef3

    SHA512

    5bf0c3b8fa5db63205a263c4fa5337188173248bef609ba4d03508c50db1fd1e336f3041ce96d78cc97659357a83e6e422f5b079d893a20a683270e05f5438df

  • C:\Users\Admin\AppData\Local\Temp\is-FVIK2.tmp\CheckProc.cmd

    Filesize

    118B

    MD5

    f0315949ccc3d22d958503f5735cfbcc

    SHA1

    883bf4e366046eb1ef6e2d81fd74fe75ae73b2c0

    SHA256

    201c4e665ce446e067cb152d1c3834e416f6a09a9e6d7c45c20f1bc1cc74534d

    SHA512

    aa1faa44ba8f47052bf236d5135dc70f1293028663f4abbc7cc043277428217b047b25d6e6691c1685db52bd2065f0d5c4306d9db590696773c3becf2481a251

  • C:\Users\Admin\AppData\Local\Temp\is-FVIK2.tmp\CheckProc.cmd

    Filesize

    126B

    MD5

    110d64c0e450ff59542f81690a2d53b7

    SHA1

    7f2e989deb095a0530792989e5fa9d7279d5f3e7

    SHA256

    735ca381b6d3cbb675e698aa92222566d5174c0fbdf7807605f105c512c9fa1e

    SHA512

    00b86a1fd4db9e8861d3973a395c34b41a5a277901552b66ac671ced492638174f256785f563bfad263bc93315544bce87c91d26bd48a39fbab7daccceae0d34

  • C:\Users\Admin\AppData\Local\Temp\is-FVIK2.tmp\CheckProc.cmd

    Filesize

    126B

    MD5

    8fec1ab28e8ee7394915990458fb85dc

    SHA1

    c70e183a783a9621cd64584de99f8163deb40872

    SHA256

    b96251154ddbfd11d36e74eae84537229912a54dcb86f1277deab084322ce4dd

    SHA512

    c33223c094764b9704ced1ab6256aa227873c2be81acce328d12113504e55716563ad561641b726dcd2939c6237b4a4dad522512a4f59e3f805f91ffaf3a3be9

  • C:\Users\Admin\AppData\Local\Temp\is-FVIK2.tmp\CheckProc.cmd

    Filesize

    122B

    MD5

    660d266764b1952b43431d6c7dc0dfa9

    SHA1

    809794738d6ca580d6ec14e77a717e831b0d0e5c

    SHA256

    e3c86ead8667eac8c9ea88e2ee5f5f14f0f0be59a54864f99cbee17d554f74e5

    SHA512

    6fc27ec6f453c2791aa9d0c38817128ed8e2fff26748fbe0cfee6411d8a120970494b3504078a3079c90d409434f22b35974efd5cbbaf14ce3657715fc18f4c3

  • C:\Users\Admin\AppData\Local\Temp\is-FVIK2.tmp\CheckProc.cmd

    Filesize

    132B

    MD5

    410515fbd7d2a2b4fab0fb80c76c2a74

    SHA1

    f32bd4fc7ade9efdc92b99e79a0b2f95edfc5893

    SHA256

    6b398a1053c39530e13afb3bad98900d9a5a6d27523a0c5d44c746afb539fe99

    SHA512

    f301aaeb96aa848eb6823830397c9fb12086db558663235c8b0882cefe2ae105cc75e2cc70315ce2fdfa17d3538427f4afa6a9cf24834a884a10cb4cb87652aa

  • C:\Users\Admin\AppData\Local\Temp\is-FVIK2.tmp\CheckProc.cmd

    Filesize

    130B

    MD5

    0cbb771b9f9523adb96d5bae77154a05

    SHA1

    528330a335047039ab012b01bb7a3f585e6f5a8d

    SHA256

    4b6e256fc13fdb04ac97e583dda99f6ade2356f9c692f5150b262d3e464bd71e

    SHA512

    41f44acafb84b24e15ebee4a18c2ae39c06ad401db2272939ad1d650c27e1a219d7c05df63a7ec2ab0676c7ed34ca5c7ed1d4cfaa143998e90ce12f13875f0f1

  • C:\Users\Admin\AppData\Local\Temp\is-FVIK2.tmp\gentlemjfst_ifr.exe

    Filesize

    2.3MB

    MD5

    edb18cb400438312e35de3f9e5de34dc

    SHA1

    5ec2e399db9256608e2e6fae1f4722d7cceae0da

    SHA256

    430ad69ce838f3f00dc6aad006f8ef7442029540547bee291b4086cecbe2d2ee

    SHA512

    dfae3b6c059476ae0d38872cdfa177845d0b4a161b4650e4a477af24c9c5e920d177223546fb0205df3ad74ee4322573e562d8043cb32ed84ef93b11134a722c

  • C:\Users\Admin\AppData\Local\Temp\is-FVIK2.tmp\gentlemjfst_ifr.exe

    Filesize

    2.3MB

    MD5

    edb18cb400438312e35de3f9e5de34dc

    SHA1

    5ec2e399db9256608e2e6fae1f4722d7cceae0da

    SHA256

    430ad69ce838f3f00dc6aad006f8ef7442029540547bee291b4086cecbe2d2ee

    SHA512

    dfae3b6c059476ae0d38872cdfa177845d0b4a161b4650e4a477af24c9c5e920d177223546fb0205df3ad74ee4322573e562d8043cb32ed84ef93b11134a722c

  • C:\Users\Admin\AppData\Local\Temp\is-FVIK2.tmp\itdownload.dll

    Filesize

    200KB

    MD5

    d82a429efd885ca0f324dd92afb6b7b8

    SHA1

    86bbdaa15e6fc5c7779ac69c84e53c43c9eb20ea

    SHA256

    b258c4d7d2113dee2168ed7e35568c8e03341e24e3eafc7a22a0d62e32122ef3

    SHA512

    5bf0c3b8fa5db63205a263c4fa5337188173248bef609ba4d03508c50db1fd1e336f3041ce96d78cc97659357a83e6e422f5b079d893a20a683270e05f5438df

  • C:\Users\Admin\AppData\Local\Temp\is-FVIK2.tmp\itdownload.dll

    Filesize

    200KB

    MD5

    d82a429efd885ca0f324dd92afb6b7b8

    SHA1

    86bbdaa15e6fc5c7779ac69c84e53c43c9eb20ea

    SHA256

    b258c4d7d2113dee2168ed7e35568c8e03341e24e3eafc7a22a0d62e32122ef3

    SHA512

    5bf0c3b8fa5db63205a263c4fa5337188173248bef609ba4d03508c50db1fd1e336f3041ce96d78cc97659357a83e6e422f5b079d893a20a683270e05f5438df

  • C:\Users\Admin\AppData\Local\Temp\is-GV4MM.tmp\gentlemjfst_ifr.tmp

    Filesize

    690KB

    MD5

    1305181de520f125aeabf85dc24a89d6

    SHA1

    98b7548fede3f1468ccbdee405abdc4e5d2ec671

    SHA256

    0e19765b89a1a29afee09810dcb3ec5cc7c66053947be8f1aebdbb7c801dfeaf

    SHA512

    b0bfa9749a6a5a18c1926e6c5ebb4cdb156df1652cb822f067422a1cd21583340f32e4a1fc2f4c21a09343d73a55651972edbd2dec98ce44641a1097c16bc793

  • C:\Users\Admin\AppData\Local\Temp\is-GV4MM.tmp\gentlemjfst_ifr.tmp

    Filesize

    690KB

    MD5

    1305181de520f125aeabf85dc24a89d6

    SHA1

    98b7548fede3f1468ccbdee405abdc4e5d2ec671

    SHA256

    0e19765b89a1a29afee09810dcb3ec5cc7c66053947be8f1aebdbb7c801dfeaf

    SHA512

    b0bfa9749a6a5a18c1926e6c5ebb4cdb156df1652cb822f067422a1cd21583340f32e4a1fc2f4c21a09343d73a55651972edbd2dec98ce44641a1097c16bc793

  • memory/1332-132-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/1332-141-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/1332-183-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/1332-137-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/2372-169-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/2372-171-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/2372-181-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/2372-182-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/3580-140-0x00000000039E0000-0x0000000003A1C000-memory.dmp

    Filesize

    240KB

  • memory/4456-177-0x00000000039D0000-0x0000000003A0C000-memory.dmp

    Filesize

    240KB

  • memory/4456-180-0x0000000003B60000-0x0000000003B75000-memory.dmp

    Filesize

    84KB