Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    142s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/11/2022, 06:22

General

  • Target

    531cd38bd4dcde299d18261a83682b2e399408541d4a274c1702851c030d4cd8.exe

  • Size

    330KB

  • MD5

    505c214da8ff59f03cbf27f152149173

  • SHA1

    2e917d6cc497ed576a56a229abc6a67bd8654f85

  • SHA256

    531cd38bd4dcde299d18261a83682b2e399408541d4a274c1702851c030d4cd8

  • SHA512

    bca0a0d219ed62013c602531931d40c960f4bb0397f7995d6d088e34a5104670625842a2a60635ffe265a0f6392c29183f855b2fe3599df81fd3de0155c6420f

  • SSDEEP

    6144:Bsit+joWDgZP/D3RnKn5U/SofsIcSs2EmrHzMW:xqKz3RnKn5u99s27rT

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 4 IoCs

    Detects file using ACProtect software.

  • Executes dropped EXE 1 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 14 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Installs/modifies Browser Helper Object 2 TTPs 3 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies registry class 51 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\531cd38bd4dcde299d18261a83682b2e399408541d4a274c1702851c030d4cd8.exe
    "C:\Users\Admin\AppData\Local\Temp\531cd38bd4dcde299d18261a83682b2e399408541d4a274c1702851c030d4cd8.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Installs/modifies Browser Helper Object
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:764
    • C:\Windows\SysWOW64\cmd.exe
      cmd /C schtasks /Create /F /TN "Windowshonorzone" /SC ONLOGON /TR "'C:\Users\Admin\AppData\Roaming\honorzone\honorzone.exe' schcmd" /rL HIGHEST
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1104
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /Create /F /TN "Windowshonorzone" /SC ONLOGON /TR "'C:\Users\Admin\AppData\Roaming\honorzone\honorzone.exe' schcmd" /rL HIGHEST
        3⤵
        • Creates scheduled task(s)
        PID:4604
    • C:\Users\Admin\AppData\Roaming\honorzone\honorzone.exe
      "C:\Users\Admin\AppData\Roaming\honorzone\honorzone.exe" Updatecmd
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3436
      • C:\Windows\SysWOW64\sc.exe
        sc query npf
        3⤵
        • Launches sc.exe
        PID:4344
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c \DelUS.bat
      2⤵
        PID:2844

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\DelUS.bat

      Filesize

      264B

      MD5

      e369f9f0e77f167b37b0733f8ce0f466

      SHA1

      c2b7ec938fc7ca8a54be38a16270dbf06235258f

      SHA256

      b292b90c50d03286443808315fbe2842f812e5837b4b708b2575974b517abe35

      SHA512

      136abbaadc72dc237b2460e0e900a8a9045286b754634f4e36f1fa92b8d651878b56f5aa6157b80d64a1e355c69a0c0acd5afbe0e5313d4a2dfa945a1165d4b5

    • C:\Users\Admin\AppData\Local\Temp\nsu9486.tmp\DLLWebCount.dll

      Filesize

      32KB

      MD5

      248536afcb6f59c1797f079a0da15b63

      SHA1

      7fa238f871b357c66168728ab1bb38addcfba3f8

      SHA256

      9c5f4eeadc9c2881bc02b45d757b35d3bfd2dc7d917d2e8fde2917fabf48908f

      SHA512

      b82accc8530650ebae8d4f8752002c2d23ab7b29e958e6c14731ad186a0fcdbbab937723a540de62d58f4659580843191fd53cb415e07167d7b55cd174a79652

    • C:\Users\Admin\AppData\Local\Temp\nsu9486.tmp\IEKill.dll

      Filesize

      28KB

      MD5

      090f0ab18996feae6c0a62d83b2149c6

      SHA1

      5292898561ad88630088ae22fb877dfc7146ee77

      SHA256

      914536dd97645de7789666da5dc03d02f4fbe0593214678e6e1982a02a8a1c4d

      SHA512

      2fccda2cb95583fdb184b7edaa7ae088ca484e06d020159bf9776e36b660c6672812b7e821b111fa52d63ad5e2ce70602dc117edc2eba3c46029653c5ef5ffc6

    • C:\Users\Admin\AppData\Local\Temp\nsu9486.tmp\IEKill.dll

      Filesize

      28KB

      MD5

      090f0ab18996feae6c0a62d83b2149c6

      SHA1

      5292898561ad88630088ae22fb877dfc7146ee77

      SHA256

      914536dd97645de7789666da5dc03d02f4fbe0593214678e6e1982a02a8a1c4d

      SHA512

      2fccda2cb95583fdb184b7edaa7ae088ca484e06d020159bf9776e36b660c6672812b7e821b111fa52d63ad5e2ce70602dc117edc2eba3c46029653c5ef5ffc6

    • C:\Users\Admin\AppData\Local\Temp\nsu9486.tmp\KillProcDLL.dll

      Filesize

      32KB

      MD5

      83142eac84475f4ca889c73f10d9c179

      SHA1

      dbe43c0de8ef881466bd74861b2e5b17598b5ce8

      SHA256

      ae2f1658656e554f37e6eac896475a3862841a18ffc6fad2754e2d3525770729

      SHA512

      1c66eab21f0c9e0b99ecc3844516a6978f52e0c7f489405a427532ecbe78947c37dac5b4c8b722cc8bc1edfb74ba4824519d56099e587e754e5c668701e83bd1

    • C:\Users\Admin\AppData\Local\Temp\nsu9486.tmp\KillProcDLL.dll

      Filesize

      32KB

      MD5

      83142eac84475f4ca889c73f10d9c179

      SHA1

      dbe43c0de8ef881466bd74861b2e5b17598b5ce8

      SHA256

      ae2f1658656e554f37e6eac896475a3862841a18ffc6fad2754e2d3525770729

      SHA512

      1c66eab21f0c9e0b99ecc3844516a6978f52e0c7f489405a427532ecbe78947c37dac5b4c8b722cc8bc1edfb74ba4824519d56099e587e754e5c668701e83bd1

    • C:\Users\Admin\AppData\Local\Temp\nsu9486.tmp\KillProcDLL.dll

      Filesize

      32KB

      MD5

      83142eac84475f4ca889c73f10d9c179

      SHA1

      dbe43c0de8ef881466bd74861b2e5b17598b5ce8

      SHA256

      ae2f1658656e554f37e6eac896475a3862841a18ffc6fad2754e2d3525770729

      SHA512

      1c66eab21f0c9e0b99ecc3844516a6978f52e0c7f489405a427532ecbe78947c37dac5b4c8b722cc8bc1edfb74ba4824519d56099e587e754e5c668701e83bd1

    • C:\Users\Admin\AppData\Local\Temp\nsu9486.tmp\KillProcDLL.dll

      Filesize

      32KB

      MD5

      83142eac84475f4ca889c73f10d9c179

      SHA1

      dbe43c0de8ef881466bd74861b2e5b17598b5ce8

      SHA256

      ae2f1658656e554f37e6eac896475a3862841a18ffc6fad2754e2d3525770729

      SHA512

      1c66eab21f0c9e0b99ecc3844516a6978f52e0c7f489405a427532ecbe78947c37dac5b4c8b722cc8bc1edfb74ba4824519d56099e587e754e5c668701e83bd1

    • C:\Users\Admin\AppData\Local\Temp\nsu9486.tmp\SelfDelete.dll

      Filesize

      24KB

      MD5

      ddc0d6806073a5b034104c88288ca762

      SHA1

      9663cc10c496f05d6167e19c3920245040e5e431

      SHA256

      2f4767da9dc7e720d910d32d451674cd08b7892ca753ec5c10b11fe85e12f06b

      SHA512

      545ca797a397cfcbd9b5d3bd2da2e3219ba7a294e541831655c5763a7f17480fd0b990d0c2e58ba8c71f81d85472b2da6d079b8211b44c40c8c36d21168ec054

    • C:\Users\Admin\AppData\Local\Temp\nsu9486.tmp\nsExec.dll

      Filesize

      6KB

      MD5

      acc2b699edfea5bf5aae45aba3a41e96

      SHA1

      d2accf4d494e43ceb2cff69abe4dd17147d29cc2

      SHA256

      168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

      SHA512

      e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

    • C:\Users\Admin\AppData\Local\Temp\nsu9486.tmp\version.dll

      Filesize

      22KB

      MD5

      fbe588b15eb1bd86defade69f796b56f

      SHA1

      2f63cf44039addddb22c2c0497673b49e6b3ad7a

      SHA256

      31144e8b156fe87317073c48a09abcb033fda8dbdd96986c4abea8c00c00355f

      SHA512

      e1a9e29e4c62e77a2ec2c539344f0b5a8cd67ca3fd8dfefb0b0666a992eb2fabadb0034d439c4adbbdffd9c9439f23ee5757fac0ed669d3c9db48f50c677143d

    • C:\Users\Admin\AppData\Local\Temp\nsu9486.tmp\version.dll

      Filesize

      22KB

      MD5

      fbe588b15eb1bd86defade69f796b56f

      SHA1

      2f63cf44039addddb22c2c0497673b49e6b3ad7a

      SHA256

      31144e8b156fe87317073c48a09abcb033fda8dbdd96986c4abea8c00c00355f

      SHA512

      e1a9e29e4c62e77a2ec2c539344f0b5a8cd67ca3fd8dfefb0b0666a992eb2fabadb0034d439c4adbbdffd9c9439f23ee5757fac0ed669d3c9db48f50c677143d

    • C:\Users\Admin\AppData\Local\Temp\nsu9486.tmp\version.dll

      Filesize

      22KB

      MD5

      fbe588b15eb1bd86defade69f796b56f

      SHA1

      2f63cf44039addddb22c2c0497673b49e6b3ad7a

      SHA256

      31144e8b156fe87317073c48a09abcb033fda8dbdd96986c4abea8c00c00355f

      SHA512

      e1a9e29e4c62e77a2ec2c539344f0b5a8cd67ca3fd8dfefb0b0666a992eb2fabadb0034d439c4adbbdffd9c9439f23ee5757fac0ed669d3c9db48f50c677143d

    • C:\Users\Admin\AppData\Local\Temp\nsu9486.tmp\version.dll

      Filesize

      22KB

      MD5

      fbe588b15eb1bd86defade69f796b56f

      SHA1

      2f63cf44039addddb22c2c0497673b49e6b3ad7a

      SHA256

      31144e8b156fe87317073c48a09abcb033fda8dbdd96986c4abea8c00c00355f

      SHA512

      e1a9e29e4c62e77a2ec2c539344f0b5a8cd67ca3fd8dfefb0b0666a992eb2fabadb0034d439c4adbbdffd9c9439f23ee5757fac0ed669d3c9db48f50c677143d

    • C:\Users\Admin\AppData\Roaming\honorzone\honorzone.dll

      Filesize

      148KB

      MD5

      470f1cfa9eeb0697f667c1f71748cca3

      SHA1

      a47eae50c44fd64c47b3b3c9dcf8d2e2e6c11cb5

      SHA256

      53afd465b64b8b3b102088752d554ae477c5d9f3c18de10fe8c899b1d673a8e8

      SHA512

      831cd2d018d98738b7302875a696f300fc023a967a438d50fe1c03945a00f0840d9c43133244fc3a2bda73a723fd2d612cf42c9ad1585b93adee6ea57cb657ab

    • C:\Users\Admin\AppData\Roaming\honorzone\honorzone.exe

      Filesize

      384KB

      MD5

      c1aa3e00e95d34e7e0e44b9714d928be

      SHA1

      020e1c9c512b57a7c150cc8b2b9b95316f9f120a

      SHA256

      dc8da541f84aa684e52423f0846ee26556236b99fc6730f82aa3eb415da5a6ab

      SHA512

      d5efe6943a5781403e912f3e234f4508cd7de34efd699efdd7b93a3f0bb9a7503f118538323624dfa5c96332efd29c24b6b67231a2a73e2333251fa590f8947f

    • C:\Users\Admin\AppData\Roaming\honorzone\honorzone.exe

      Filesize

      384KB

      MD5

      c1aa3e00e95d34e7e0e44b9714d928be

      SHA1

      020e1c9c512b57a7c150cc8b2b9b95316f9f120a

      SHA256

      dc8da541f84aa684e52423f0846ee26556236b99fc6730f82aa3eb415da5a6ab

      SHA512

      d5efe6943a5781403e912f3e234f4508cd7de34efd699efdd7b93a3f0bb9a7503f118538323624dfa5c96332efd29c24b6b67231a2a73e2333251fa590f8947f

    • memory/764-150-0x0000000002390000-0x00000000023A2000-memory.dmp

      Filesize

      72KB

    • memory/764-151-0x0000000002390000-0x00000000023A2000-memory.dmp

      Filesize

      72KB

    • memory/764-152-0x0000000002390000-0x00000000023A2000-memory.dmp

      Filesize

      72KB