Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

8

29ce06feb1...88.exe

windows7-x64

10

29ce06feb1...88.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    140s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/11/2022, 02:07

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    29ce06feb138c8a032cb103623affc4d2c55e78cbf07f32c035ef7ef1a35cd88.exe

  • Size

    693KB

  • MD5

    e4540200b9618a0e460c3ffc4373c6c2

  • SHA1

    07757e76942afbef15c6dcb05d1eb0b95f2ba659

  • SHA256

    29ce06feb138c8a032cb103623affc4d2c55e78cbf07f32c035ef7ef1a35cd88

  • SHA512

    a7a0f6c50bb1cbe21371cd397c78ec594f81261442cc8609d7290601a8b17e432f69762d5cbeb07313fd340b9b7ed466ca1df016583af107e5da7af5f942b8ed

  • SSDEEP

    1536:cd04boUzdIBsZUpUQSe1sjL/91IqmM4nouy8:cdJboUpEsueFssP11I5Mwout

Score
10/10
evasionpersistencespywarestealertrojanupx

Malware Config

Signatures

  • Modifies firewall policy service 2 TTPs 18 IoCs
    evasion
  • Modifies security service 2 TTPs 1 IoCs
    evasion
  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • UAC bypass 3 TTPs 3 IoCs
    evasiontrojan
  • Windows security bypass 2 TTPs 4 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Disables Task Manager via registry modification
    evasion
  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Sets file execution options in registry 2 TTPs 64 IoCs
    persistence
  • UPX packed file 13 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 15 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Control Panel 2 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 64 IoCs
    adwarespyware
  • Modifies Internet Explorer start page 1 TTPs 2 IoCs
    stealer
  • Modifies registry class 27 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs
  • System policy modification 1 TTPs 4 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\29ce06feb138c8a032cb103623affc4d2c55e78cbf07f32c035ef7ef1a35cd88.exe
    "C:\Users\Admin\AppData\Local\Temp\29ce06feb138c8a032cb103623affc4d2c55e78cbf07f32c035ef7ef1a35cd88.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4204
    • C:\Users\Admin\E696D64614\winlogon.exe
      "C:\Users\Admin\E696D64614\winlogon.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1052
      • C:\Users\Admin\E696D64614\winlogon.exe
        "C:\Users\Admin\E696D64614\winlogon.exe"
        3⤵
        • Modifies firewall policy service
        • Modifies security service
        • Modifies visibility of file extensions in Explorer
        • Modifies visiblity of hidden/system files in Explorer
        • UAC bypass
        • Windows security bypass
        • Disables RegEdit via registry modification
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Sets file execution options in registry
        • Windows security modification
        • Adds Run key to start application
        • Checks whether UAC is enabled
        • Modifies Control Panel
        • Modifies Internet Explorer settings
        • Modifies Internet Explorer start page
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • System policy modification
        PID:32
  • C:\Program Files (x86)\Internet Explorer\ielowutil.exe
    "C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
    1⤵
      PID:4744
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
      1⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3864
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3864 CREDAT:17410 /prefetch:2
        2⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:3772

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
      Filesize

      2KB

      MD5

      76e7d5bf61b2e80d159f88aa9798ce91

      SHA1

      32a46de50c9c02b068e39cf49b78c7e2d5ace20d

      SHA256

      280fd6ae3ad21323199759814c4dd82329eb8f9847ed1fa2be145e83b4c88bf3

      SHA512

      5efd8c64ac40ae006d2ce4509eb9e5f1448fb1156e914d303e8bc4dcfe1d94c57c7eae216b362877e7b644876656cc9e5c4cebfc905bab3f8b09cb1a051d69c4

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
      Filesize

      471B

      MD5

      dedb504b3469b24ec0df79c68f5772e2

      SHA1

      177a8b1045b456316ca32d90aba942bf34774c64

      SHA256

      e18111fd56db31f02eb16990f0bbc7991a0c80571703281ee66010e229c9f8b0

      SHA512

      101312fa01991caeaef010d0d21e740244cb3768490a1b82ae12e7524e50b6e7f2e23c08978ac4c373e9013baa0a8f50de8e1994341556b78ecd88ce13df5680

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
      Filesize

      1KB

      MD5

      916c512d221c683beeea9d5cb311b0b0

      SHA1

      bf0db4b1c4566275b629efb095b6ff8857b5748e

      SHA256

      64a36c1637d0a111152002a2c0385b0df9dd81b616b3f2073fbbe3f2975aa4d8

      SHA512

      af32cffea722438e9b17b08062dc2e209edc5417418964ead0b392bd502e1a647a8456b2ee2ea59faf69f93d0c6ea6f15949b6c30924db7da65b91cb18e8dc6c

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C67047FE238D580B731A13BEA5F7481F
      Filesize

      472B

      MD5

      cfbcb12817712d4f8f816c208590444a

      SHA1

      9999caeedbb1a95ae4236a5b962c233633df6799

      SHA256

      b5a41ab77d5ff4ba1a17ff074eb91bc18824d56dfc4b6c3320e900bbd6f3a90a

      SHA512

      a70eb8c366dfa0226cd62dbffbf51bd2da25571a6ff6b1f2e44dd8d9193a72f79ab7d90367378edf808ff3152ca45bf2a6ba3d64882d0f6d4aa437b6881d13f2

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
      Filesize

      488B

      MD5

      7b602666144e8db345839a06db7c151f

      SHA1

      f71abb557f633777e3c3d6dbbeea2ea2564d8e69

      SHA256

      a9ca77a4e4ce1487050b1dcfffd0379d50b10c5adc108646b462b995205f0484

      SHA512

      17aa267024b6ce2d329b0a00f4761e303bef0e4940e17f34858495ed47f3844e76e55eaa2f3e9009351a5812421728477a8160002b0c9327e8ae0d003357c1b0

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
      Filesize

      404B

      MD5

      8701544ccc71daedb57bd3225e281e58

      SHA1

      750a6f287228667d633158d01ab98084289c8f3b

      SHA256

      ba1bb07c56705fc55926662963bc1c3da117f77013eac42241a0771910ee2ea9

      SHA512

      e3e6813055b9ec7977cd895440ae335a0b1dabb5a0f8fd2c487d2dba0ef608cd46d85d3cceb06a7e6a9807cd1f0b61a67dc837e4e4c0831f5d44f20fc35e3218

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
      Filesize

      482B

      MD5

      7c9c87e7dd8b06af28df8c390c91e937

      SHA1

      3e30a3b92efafe961d12e1847f507de1681df293

      SHA256

      fcfe21864a694ad9e8c427eb12abd2e5f315976019d878c5a32a48df0cf6fa30

      SHA512

      5f69af94e06a9a3a3a06a41eba5a0a2ad12feb48991679e554deaea3842a6fbfa5f8b67e0a51895d65e8fc8bf1886f7569a04f08a2dbf89f7ebfdbaaa0d42be4

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C67047FE238D580B731A13BEA5F7481F
      Filesize

      480B

      MD5

      255b3612bc3c38eceb0ba30eb2bb3524

      SHA1

      9a29e6b50699ca0e60d15f8839a45ca4fd305576

      SHA256

      c12fb21d4edb503151e50383c9b750f32a8b5319ec6f9db6328646a321d11f35

      SHA512

      06e4c02abf7b365db2c2012b44f6872f5491f2840bf469fe3dd7d2baf8a6cbc9755d6020df2a3c220e4822dd8684524a126d25e62460fd744c5f97515aab9004

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\versionlist.xml
      Filesize

      15KB

      MD5

      1a545d0052b581fbb2ab4c52133846bc

      SHA1

      62f3266a9b9925cd6d98658b92adec673cbe3dd3

      SHA256

      557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1

      SHA512

      bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d

      Download Submit

    • C:\Users\Admin\E696D64614\winlogon.exe
      Filesize

      693KB

      MD5

      e4540200b9618a0e460c3ffc4373c6c2

      SHA1

      07757e76942afbef15c6dcb05d1eb0b95f2ba659

      SHA256

      29ce06feb138c8a032cb103623affc4d2c55e78cbf07f32c035ef7ef1a35cd88

      SHA512

      a7a0f6c50bb1cbe21371cd397c78ec594f81261442cc8609d7290601a8b17e432f69762d5cbeb07313fd340b9b7ed466ca1df016583af107e5da7af5f942b8ed

      Download Submit

    • C:\Users\Admin\E696D64614\winlogon.exe
      Filesize

      693KB

      MD5

      e4540200b9618a0e460c3ffc4373c6c2

      SHA1

      07757e76942afbef15c6dcb05d1eb0b95f2ba659

      SHA256

      29ce06feb138c8a032cb103623affc4d2c55e78cbf07f32c035ef7ef1a35cd88

      SHA512

      a7a0f6c50bb1cbe21371cd397c78ec594f81261442cc8609d7290601a8b17e432f69762d5cbeb07313fd340b9b7ed466ca1df016583af107e5da7af5f942b8ed

      Download Submit

    • C:\Users\Admin\E696D64614\winlogon.exe
      Filesize

      693KB

      MD5

      e4540200b9618a0e460c3ffc4373c6c2

      SHA1

      07757e76942afbef15c6dcb05d1eb0b95f2ba659

      SHA256

      29ce06feb138c8a032cb103623affc4d2c55e78cbf07f32c035ef7ef1a35cd88

      SHA512

      a7a0f6c50bb1cbe21371cd397c78ec594f81261442cc8609d7290601a8b17e432f69762d5cbeb07313fd340b9b7ed466ca1df016583af107e5da7af5f942b8ed

      Download Submit

    • memory/32-147-0x0000000000400000-0x000000000043F000-memory.dmp

      Filesize

      252KB

      Download

    • memory/32-146-0x0000000000400000-0x000000000043F000-memory.dmp

      Filesize

      252KB

      Download

    • memory/32-143-0x0000000000400000-0x000000000043F000-memory.dmp

      Filesize

      252KB

      Download

    • memory/32-156-0x0000000000400000-0x000000000043F000-memory.dmp

      Filesize

      252KB

      Download

    • memory/32-158-0x0000000000400000-0x000000000043F000-memory.dmp

      Filesize

      252KB

      Download

    • memory/32-159-0x0000000000400000-0x000000000043F000-memory.dmp

      Filesize

      252KB

      Download

    • memory/1052-157-0x0000000000400000-0x0000000000447000-memory.dmp

      Filesize

      284KB

      Download

    • memory/1052-139-0x0000000000400000-0x0000000000447000-memory.dmp

      Filesize

      284KB

      Download

    • memory/4204-134-0x0000000000400000-0x0000000000447000-memory.dmp

      Filesize

      284KB

      Download

    • memory/4204-141-0x0000000000400000-0x0000000000447000-memory.dmp

      Filesize

      284KB

      Download