Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    31s
  • max time network
    36s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/11/2022, 10:02

Errors

Reason
Machine shutdown

General

  • Target

    a6d79208ffd797d53bfaf8bebb9988f4400c138d0f3ecd466f6e6adb13cb4e59.exe

  • Size

    759KB

  • MD5

    d9ea4f8848c1349ce785e76c04f9c603

  • SHA1

    31933f0a34d0bdac3007b0248adfbe16916a9a7d

  • SHA256

    a6d79208ffd797d53bfaf8bebb9988f4400c138d0f3ecd466f6e6adb13cb4e59

  • SHA512

    ab257a38c41d4b1e32828ce418b238bbdba2ca969c5f66354a39958751ba2c9d72935a595901c890bcddb109de797042f7279e12b314967edcfd4db463d668ef

  • SSDEEP

    3072:aSsvihLlTQz9z71iURo2SJJmY6uFNcgifDbmeTXwVdBR:rsqhJMxzJiU5SeLmNSbmebW1

Malware Config

Signatures

  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Adds policy Run key to start application 2 TTPs 7 IoCs
  • Executes dropped EXE 2 IoCs
  • Sets file execution options in registry 2 TTPs 8 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 10 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Windows\system32\lsass.exe
    C:\Windows\system32\lsass.exe
    1⤵
      PID:676
      • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\Settings\MAysTrP3ZmmjKdTdL286yfU4uPlQwXRplZH6HGecuTAGCD1ESynBCtU.bat
        "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\Settings\MAysTrP3ZmmjKdTdL286yfU4uPlQwXRplZH6HGecuTAGCD1ESynBCtU.bat" 2
        2⤵
        • Executes dropped EXE
        • Sets file execution options in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3916
    • C:\Users\Admin\AppData\Local\Temp\a6d79208ffd797d53bfaf8bebb9988f4400c138d0f3ecd466f6e6adb13cb4e59.exe
      "C:\Users\Admin\AppData\Local\Temp\a6d79208ffd797d53bfaf8bebb9988f4400c138d0f3ecd466f6e6adb13cb4e59.exe"
      1⤵
      • Adds policy Run key to start application
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      PID:4996
    • C:\Windows\system32\LogonUI.exe
      "LogonUI.exe" /flags:0x4 /state0:0xa39ee855 /state1:0x41c64e6d
      1⤵
      • Modifies data under HKEY_USERS
      • Suspicious use of SetWindowsHookEx
      PID:4800
    • C:\Windows\system32\gpscript.exe
      gpscript.exe /Shutdown
      1⤵
      • Modifies data under HKEY_USERS
      • Suspicious use of WriteProcessMemory
      PID:624
      • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\Settings\MAysTrP3ZmmjKdTdL286yfU4uPlQwXRplZH6HGecuTAGCD1ESynBCtU.bat
        "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\Settings\MAysTrP3ZmmjKdTdL286yfU4uPlQwXRplZH6HGecuTAGCD1ESynBCtU.bat" 1
        2⤵
        • Suspicious use of NtCreateUserProcessOtherParentProcess
        • Adds policy Run key to start application
        • Executes dropped EXE
        • Sets file execution options in registry
        • Modifies data under HKEY_USERS
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2836

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\adm\XY0SCovDC0GraDMrH5KK5.exe

      Filesize

      1.3MB

      MD5

      57f1176e1987952d38d889f0cb06c73e

      SHA1

      25fddf1041824c53bf8fec81961ae7e5d541a1a2

      SHA256

      62848cf55567204e1a2339ce506ae33e16c5818786e50b1a7d0fa94534afe5a5

      SHA512

      63ce55fb5d76c8c8b3426db270b2b71ad88ef64b966f12c7a00117f76cdc24337103c8a21588819176c055d3d12926f42a9048066f2be83f6a875af162657efe

    • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\nso-ZA\1cG1nadY5fhvvwbkkxkKvj3tDgwyOScIlxUIKC0rCqwOp.exe

      Filesize

      1.2MB

      MD5

      6defe5e4e73ba4e26e2a04f1d178c76c

      SHA1

      84f7c2a785d2b8b7129413c88fc9c09ec325ae0d

      SHA256

      d94717ecab4ccce0f90e6ad903457c25be7f88274fb59d23a4e1ac483b4006b6

      SHA512

      553c7723dc95024d153e5e9019d09fa902aacd63271d1cc254fc519b310ff1a966abd13fc8146554a57fe084c5820d63f37d3bd962e20046c40e7bfffbcad6ae

    • C:\Users\Admin\AppData\Local\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Settings\jWZZ1Kpu15mEjlarB9HkzyQ4FHiPCv.exe

      Filesize

      1.1MB

      MD5

      dcf7ba6c621d31230715086545699ff8

      SHA1

      f03f5c33be24eaa88693a9869020f27940254468

      SHA256

      bc37963e0dc4a591bd6dc589a1726decb3b5ad2f58fda88c2e4c196cb1a86d4b

      SHA512

      65376d79dade430f4caaba9cc314a4949d3bb8cd731e4767342afa76a2bef39aede1eafdca18b5a45ff5f9dd00f89b0b662e7ef86d7e20950786da12ced18b8b

    • C:\Users\Admin\AppData\Local\Packages\Microsoft.BioEnrollment_cw5n1h2txyewy\AC\Temp\ArlOlAE4YQtjzrCdrsDI.exe

      Filesize

      837KB

      MD5

      ef14310de38340a26bbce841965df1b4

      SHA1

      17e90c4d3e833c6735d2b20762862f97070a9e61

      SHA256

      5139c9dca745b7d4fc4a99398d2a89685535e6a757b4ed781f0c5c9443325aaf

      SHA512

      5ea278faa9d86ad6d9adc9dd3fe5340dd6ffe7a7b07665fc85417cef2e5fed856277535e88c967d684b26277f66a68baedb9cf7a76a1125151f50aef47c4fb61

    • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.NarratorQuickStart_8wekyb3d8bbwe\AC\INetCookies\ugKmEpUHOOjObzGOQC1ney7Cr14ZlR4Ts0o4kFM7J.exe

      Filesize

      1.7MB

      MD5

      a07913fdbc48129e6325ef20d9ef9736

      SHA1

      4a92f239b4ab3c293e00c8d89a859309bee56fed

      SHA256

      14234b386ae04e5771a8c190c201ba97883a4fcd21be38b62ddaed5cc8f4a229

      SHA512

      6101f466f54e0139ad847056325e59189e8e4bb100f07acaaedfc96f9f35909c946d8ab1561dcff59ffcba6cd7dc943280f2236aecc28400bafc307cb6af5b7e

    • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\Settings\MAysTrP3ZmmjKdTdL286yfU4uPlQwXRplZH6HGecuTAGCD1ESynBCtU.bat

      Filesize

      1.2MB

      MD5

      928aacce3405b37ecc660359a232327b

      SHA1

      98f083ce9578dd31df4a236a9140051e324e70d7

      SHA256

      bb06c19cdee4b8bf7d8fbbae5cb8065d6d7f7ff66213bd376da5368b88a733bb

      SHA512

      66487f880213e0f44d0627012a1f6c2ffcad0915c2d7cc58aedfa73b59ec234fd5da141628c8c61470e7d502929a403e14b0cbc52a45ef300b5b00d192ddf619

    • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\Settings\MAysTrP3ZmmjKdTdL286yfU4uPlQwXRplZH6HGecuTAGCD1ESynBCtU.bat

      Filesize

      1.2MB

      MD5

      928aacce3405b37ecc660359a232327b

      SHA1

      98f083ce9578dd31df4a236a9140051e324e70d7

      SHA256

      bb06c19cdee4b8bf7d8fbbae5cb8065d6d7f7ff66213bd376da5368b88a733bb

      SHA512

      66487f880213e0f44d0627012a1f6c2ffcad0915c2d7cc58aedfa73b59ec234fd5da141628c8c61470e7d502929a403e14b0cbc52a45ef300b5b00d192ddf619

    • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\Settings\MAysTrP3ZmmjKdTdL286yfU4uPlQwXRplZH6HGecuTAGCD1ESynBCtU.bat

      Filesize

      1.2MB

      MD5

      928aacce3405b37ecc660359a232327b

      SHA1

      98f083ce9578dd31df4a236a9140051e324e70d7

      SHA256

      bb06c19cdee4b8bf7d8fbbae5cb8065d6d7f7ff66213bd376da5368b88a733bb

      SHA512

      66487f880213e0f44d0627012a1f6c2ffcad0915c2d7cc58aedfa73b59ec234fd5da141628c8c61470e7d502929a403e14b0cbc52a45ef300b5b00d192ddf619

    • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\tK0ShchgzMJuNsGhAcaBppPgwwqW.exe

      Filesize

      787KB

      MD5

      0c115a21a51494f8462e7220f79f2581

      SHA1

      1667bcabe2c2e201263f0bacb636be7ea90094f6

      SHA256

      63172549bb2adaf0ee5433ad7be5f87055772a35ea7bcede665dd04c2d5441c1

      SHA512

      136b62f37efe194891fcf01fd749844f1f0db91e38d7b74b4d7da6de5c7af358a75965c2e4b92390dd612dec6f6f971734f760f1f7cd19655e7535ef766bea42

    • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\LocalState\1rGo7Rp25X3Pwuih.cmd

      Filesize

      1.7MB

      MD5

      d5e5e71bd1ba444cf1a39a79776825f9

      SHA1

      bdc3a15ba290d7006a022ab9548b82cd202c1146

      SHA256

      d0fa870776fbaa7d59b2ef59e03ee76569e7b7fbd3b79386aa2f99f4c1455acd

      SHA512

      140ae66c6c8a1bc8f847881eba9c3a4eb8fff14fffe9d63ae4435241107c0931e1e9b84ddd9150dffedbe1003321558bc75f87e2f3bd6cbc51ba0029e545d92e

    • C:\Users\Admin\AppData\Local\Packages\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\LocalCache\mBx3iSgwxTFZtkMF4rldn.exe

      Filesize

      838KB

      MD5

      8ff97befcd0978185aa783ec69249326

      SHA1

      2e9465ae6c8f23ba5c7590f4332fd1f6a97daf56

      SHA256

      bc8dccf426371f4f7b0760232a88b74c96b906a2b215e42fb7ae05e5929601f8

      SHA512

      34ea573ad14ceec1aca764a5c804a62b54d8ccfdee685fe781a1efab1e608fd354c37092f4351437adb3a1bdf568745599a234f578931d394bb2de023064aad8

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\OYjMtOu619RUNqZjyuPOiCDhbXa2bTYPGwnTUjqUX3fgOgexBJjbyA5ZqjDCf9v8.exe

      Filesize

      1.2MB

      MD5

      a4cca4655bc0160b26acd201d7951d26

      SHA1

      dcf2c0f0d081481e519642dc41f6d120ae872a8f

      SHA256

      8acbbaad37838c98305d94bd95d9082b095611305b7fbbb46e02f2f02145b86d

      SHA512

      c4a0135d6558a5514714d44ea0592e9051929683f236fd534ec3b09cded3f4090043792f53d9bfa5ed36e854793afc12aa9b0b2697678f81cd451b0ac5af143b

    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ycivfgho.default-release\storage\default\moz-extension+++c1c51a97-85be-4681-8297-029d8363d1be^userContextId=4294967295\idb\Q0Ck9iIGi4ZzXbCjh3V8W5QBRCEZqcVRSuRQIculZ4IZEMZFPo6.exe

      Filesize

      1.2MB

      MD5

      0dde6913e3b465c54439bc4155e2ee4c

      SHA1

      1c1d29730e9aeeaf9ae6a454e6663b0844be4f5a

      SHA256

      7877cb01d0b10a8e9af438e9b5b8495f8955f312b1f1f81bf2331fe50929c37e

      SHA512

      2f3e7abf33fbd6095ab95658ada525e10b34b6d5b0d283f74a57e1cec0ee042568de9f718b097f4247753d1fdc14f6853facb5428b6138e93185e8a022bb09ea

    • memory/2836-139-0x0000000000400000-0x000000000042D000-memory.dmp

      Filesize

      180KB

    • memory/2836-146-0x0000000000400000-0x000000000042D000-memory.dmp

      Filesize

      180KB

    • memory/2836-149-0x0000000000400000-0x000000000042D000-memory.dmp

      Filesize

      180KB

    • memory/3916-152-0x0000000000400000-0x000000000042D000-memory.dmp

      Filesize

      180KB

    • memory/4996-132-0x0000000000400000-0x000000000042D000-memory.dmp

      Filesize

      180KB

    • memory/4996-133-0x0000000000400000-0x000000000042D000-memory.dmp

      Filesize

      180KB