Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    294s
  • max time network
    323s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/11/2022, 14:25

General

  • Target

    19f98e902e08436d9c575f3c432e593d02d6d50da7fb2e1123de0693303361db.exe

  • Size

    72KB

  • MD5

    2b8d91984ebe7a2a1068ec976386fbe0

  • SHA1

    5518fafb476fa1d8be8a6bb73399b6352325fc72

  • SHA256

    19f98e902e08436d9c575f3c432e593d02d6d50da7fb2e1123de0693303361db

  • SHA512

    6b68ebe69c5b7baa32722187a6b5b5a83039077ee8ce1ea92290a48eb073db6fe9917eaaf23b9777a6b8e04b14a8c7e37f34611da1268feacb72bb4e2e964d03

  • SSDEEP

    384:i6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf2o:ipQNwC3BEddsEqOt/hyJF+x3BEJwRr0

Score
10/10

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 4 IoCs
  • Disables RegEdit via registry modification 8 IoCs
  • Executes dropped EXE 10 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Suspicious use of SetWindowsHookEx 11 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs
  • System policy modification 1 TTPs 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\19f98e902e08436d9c575f3c432e593d02d6d50da7fb2e1123de0693303361db.exe
    "C:\Users\Admin\AppData\Local\Temp\19f98e902e08436d9c575f3c432e593d02d6d50da7fb2e1123de0693303361db.exe"
    1⤵
    • Modifies visibility of file extensions in Explorer
    • Disables RegEdit via registry modification
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:3844
    • C:\Users\Admin\AppData\Local\Temp\440291082\backup.exe
      C:\Users\Admin\AppData\Local\Temp\440291082\backup.exe C:\Users\Admin\AppData\Local\Temp\440291082\
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:1804
      • C:\backup.exe
        \backup.exe \
        3⤵
        • Modifies visibility of file extensions in Explorer
        • Disables RegEdit via registry modification
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        • System policy modification
        PID:1732
        • C:\odt\backup.exe
          C:\odt\backup.exe C:\odt\
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:832
        • C:\PerfLogs\backup.exe
          C:\PerfLogs\backup.exe C:\PerfLogs\
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:3180
        • C:\Program Files\backup.exe
          "C:\Program Files\backup.exe" C:\Program Files\
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:1220
    • C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe
      C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe C:\Users\Admin\AppData\Local\Temp\acrocef_low\
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:4804
    • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
      C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      • System policy modification
      PID:3076
    • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
      C:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:4840
    • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
      "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:1912
    • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
      "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:3624

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\PerfLogs\backup.exe

    Filesize

    72KB

    MD5

    13e7bd0dadd77ca2ea1a3155f3454cea

    SHA1

    dd09a421ab28ea60ca5e630155cbda3a20eaed73

    SHA256

    2b96d7c49f006b913364e646c82fc9a533deb1b1aff85d56a5016709d23768f0

    SHA512

    63da949b856726304d9f6490bb29fabcf29264b86a3cb26486dc670951b893a62f6ba541b8fe4e07ba537cbda307c5511081dd6ade73a1038017e3698ef157b7

  • C:\PerfLogs\backup.exe

    Filesize

    72KB

    MD5

    13e7bd0dadd77ca2ea1a3155f3454cea

    SHA1

    dd09a421ab28ea60ca5e630155cbda3a20eaed73

    SHA256

    2b96d7c49f006b913364e646c82fc9a533deb1b1aff85d56a5016709d23768f0

    SHA512

    63da949b856726304d9f6490bb29fabcf29264b86a3cb26486dc670951b893a62f6ba541b8fe4e07ba537cbda307c5511081dd6ade73a1038017e3698ef157b7

  • C:\Program Files\backup.exe

    Filesize

    72KB

    MD5

    ff36e3c79b345cb9b0b9ee2e9bfbcbac

    SHA1

    5bbb253002ca8e16fa9d4c1f1f82a4e44bdb56fb

    SHA256

    75816543896974a834488efaf4a843f9e30d78510be46b74261a99ba8b0fd526

    SHA512

    afeff2ab89b944b74217b3d4cb5e412a1032696aac19da9c9f662f80a7fc4ca3b1ce4e4a48dfaf28389e2f85a062e80bc14f5b7761b6940a9688e4d8cc1646f8

  • C:\Program Files\backup.exe

    Filesize

    72KB

    MD5

    ff36e3c79b345cb9b0b9ee2e9bfbcbac

    SHA1

    5bbb253002ca8e16fa9d4c1f1f82a4e44bdb56fb

    SHA256

    75816543896974a834488efaf4a843f9e30d78510be46b74261a99ba8b0fd526

    SHA512

    afeff2ab89b944b74217b3d4cb5e412a1032696aac19da9c9f662f80a7fc4ca3b1ce4e4a48dfaf28389e2f85a062e80bc14f5b7761b6940a9688e4d8cc1646f8

  • C:\Users\Admin\AppData\Local\Temp\440291082\backup.exe

    Filesize

    72KB

    MD5

    747deeea3a65c09fc8cd864b1b223393

    SHA1

    b97b96bdd440af3af0af52abfef276ef6280db85

    SHA256

    ddd386e4ab84bcc58375e00368d4bb1d2d2d7e1227e6779417e0548d179ff7a3

    SHA512

    77cf616a113a690383cb90ede6715c3313a6092e478df2aa6f88a16da9986332570dbded53554ead340b7a94786395af215d8b685946cc467e38d8374d3473a3

  • C:\Users\Admin\AppData\Local\Temp\440291082\backup.exe

    Filesize

    72KB

    MD5

    747deeea3a65c09fc8cd864b1b223393

    SHA1

    b97b96bdd440af3af0af52abfef276ef6280db85

    SHA256

    ddd386e4ab84bcc58375e00368d4bb1d2d2d7e1227e6779417e0548d179ff7a3

    SHA512

    77cf616a113a690383cb90ede6715c3313a6092e478df2aa6f88a16da9986332570dbded53554ead340b7a94786395af215d8b685946cc467e38d8374d3473a3

  • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe

    Filesize

    72KB

    MD5

    332c210583fdaeb917ea42451bc46312

    SHA1

    7b8761dd25a1e6c7ece5241a5f882ca73979d9bd

    SHA256

    43a6f980c5b30424cbb4a9b87d48df6692658b7ec157aae6343fdff6ef02fd8d

    SHA512

    c7c2756d60dd8863a430868375fec0409f6d4a024e3e3e6f51caf4a8dbb7ee736d687fa596b6bdb8c4be6794e1639b259c9118d489f80f1349f884fec7e06982

  • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe

    Filesize

    72KB

    MD5

    332c210583fdaeb917ea42451bc46312

    SHA1

    7b8761dd25a1e6c7ece5241a5f882ca73979d9bd

    SHA256

    43a6f980c5b30424cbb4a9b87d48df6692658b7ec157aae6343fdff6ef02fd8d

    SHA512

    c7c2756d60dd8863a430868375fec0409f6d4a024e3e3e6f51caf4a8dbb7ee736d687fa596b6bdb8c4be6794e1639b259c9118d489f80f1349f884fec7e06982

  • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe

    Filesize

    72KB

    MD5

    54870c5f0196fd25252d58cc1167bc71

    SHA1

    c078139243d8eb3830e8dc36f58a2a377b5f60eb

    SHA256

    eea98f1facf0a16c0aa220002eb046d4d344f641e0b1da9951b8b474290e15a2

    SHA512

    5338bcb41ee8feb335c29a971e388d87ce3369aacc924dd77b33474fc180cf09565410628a8f589806505b7f86bc85fbef1c06ddff4edf5628d049842e6a2b11

  • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe

    Filesize

    72KB

    MD5

    54870c5f0196fd25252d58cc1167bc71

    SHA1

    c078139243d8eb3830e8dc36f58a2a377b5f60eb

    SHA256

    eea98f1facf0a16c0aa220002eb046d4d344f641e0b1da9951b8b474290e15a2

    SHA512

    5338bcb41ee8feb335c29a971e388d87ce3369aacc924dd77b33474fc180cf09565410628a8f589806505b7f86bc85fbef1c06ddff4edf5628d049842e6a2b11

  • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

    Filesize

    72KB

    MD5

    e4669b256f216b2644dc4d315031f3f3

    SHA1

    4f9273262110a01d115352709cc6348d8e5db70f

    SHA256

    9807970bcbd2f3d23fdea3733241c60a382aaccc885aeba59f87a5d8863b8348

    SHA512

    2628759db67478e34051dee0f1a3b0bd1e6b37d848d50c656b5f71de43e400a8c09c05fb69e0888f9c53e0075b185e21a7f386e5e7b2f7152d7ede469ab7cda5

  • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

    Filesize

    72KB

    MD5

    e4669b256f216b2644dc4d315031f3f3

    SHA1

    4f9273262110a01d115352709cc6348d8e5db70f

    SHA256

    9807970bcbd2f3d23fdea3733241c60a382aaccc885aeba59f87a5d8863b8348

    SHA512

    2628759db67478e34051dee0f1a3b0bd1e6b37d848d50c656b5f71de43e400a8c09c05fb69e0888f9c53e0075b185e21a7f386e5e7b2f7152d7ede469ab7cda5

  • C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe

    Filesize

    72KB

    MD5

    aad5383e4ea225f85f68342ca984fd50

    SHA1

    7d9e5066fb8d14ddc7f1b77b273115f470793171

    SHA256

    52359457b0f735e43937728f29bdae5154256f353bffbaff610b94a11395ad7f

    SHA512

    0925af2910b832d13d632f317743a16206e33941a54aa4a09693067be3230909670b306cc8f3548ba70ece838f751a5a38b58d038429adb8204ed6b40279cc12

  • C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe

    Filesize

    72KB

    MD5

    aad5383e4ea225f85f68342ca984fd50

    SHA1

    7d9e5066fb8d14ddc7f1b77b273115f470793171

    SHA256

    52359457b0f735e43937728f29bdae5154256f353bffbaff610b94a11395ad7f

    SHA512

    0925af2910b832d13d632f317743a16206e33941a54aa4a09693067be3230909670b306cc8f3548ba70ece838f751a5a38b58d038429adb8204ed6b40279cc12

  • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

    Filesize

    72KB

    MD5

    fdfa89d48b4b3f86f55e50de1e6f450e

    SHA1

    77876430009d679d0812a0cf09ef8d9b0ac7fdfb

    SHA256

    fade65e5c5de2e8d4487f84387e616d1fd26205b5dd309d25833c055067ae5d3

    SHA512

    b450701fcae7a51b1436062027fdad5e11fcb47d75e8cb08eedcfda152ec063a3e3fdc08e9b2d2ada60176f2e2883f1bf23e670ca2cf5abc8c46bd927c470fb2

  • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

    Filesize

    72KB

    MD5

    fdfa89d48b4b3f86f55e50de1e6f450e

    SHA1

    77876430009d679d0812a0cf09ef8d9b0ac7fdfb

    SHA256

    fade65e5c5de2e8d4487f84387e616d1fd26205b5dd309d25833c055067ae5d3

    SHA512

    b450701fcae7a51b1436062027fdad5e11fcb47d75e8cb08eedcfda152ec063a3e3fdc08e9b2d2ada60176f2e2883f1bf23e670ca2cf5abc8c46bd927c470fb2

  • C:\backup.exe

    Filesize

    72KB

    MD5

    775d5c3161789e242a470c854e5afd1a

    SHA1

    37129544e8bee60525a14de1cd11c9e8b2d37342

    SHA256

    4ecac50a0b90df017609eb96e0ad4b7c829b1ef7e10056332c68f833fa51b784

    SHA512

    468d3788cb8d0b085e5404ac060cd135c7c122b6e4eb31db642a48909be93a59336a4e25be56c33d6ad8b3b5409581dcc40260ebf2644f208ef716eba2f3bb68

  • C:\backup.exe

    Filesize

    72KB

    MD5

    775d5c3161789e242a470c854e5afd1a

    SHA1

    37129544e8bee60525a14de1cd11c9e8b2d37342

    SHA256

    4ecac50a0b90df017609eb96e0ad4b7c829b1ef7e10056332c68f833fa51b784

    SHA512

    468d3788cb8d0b085e5404ac060cd135c7c122b6e4eb31db642a48909be93a59336a4e25be56c33d6ad8b3b5409581dcc40260ebf2644f208ef716eba2f3bb68

  • C:\odt\backup.exe

    Filesize

    72KB

    MD5

    4f476a2b3e3223a602029cf61dffe994

    SHA1

    bbfb0c9ab8a83ab1f9871bca89d7b00fe107ea7b

    SHA256

    e0dc0759d5c7df2a5c9d88fbdb702d8f058a1b8939fe5b3f05a69436a64ba278

    SHA512

    f413b3bd9f05982bc32bc55d64b3227f03c06c79426fc16a9459b83ff2f346b1c2921eeecc591dd1eeb8cd378be4cde233b40d7e34b1fbd3032d632452f6fdf8

  • C:\odt\backup.exe

    Filesize

    72KB

    MD5

    4f476a2b3e3223a602029cf61dffe994

    SHA1

    bbfb0c9ab8a83ab1f9871bca89d7b00fe107ea7b

    SHA256

    e0dc0759d5c7df2a5c9d88fbdb702d8f058a1b8939fe5b3f05a69436a64ba278

    SHA512

    f413b3bd9f05982bc32bc55d64b3227f03c06c79426fc16a9459b83ff2f346b1c2921eeecc591dd1eeb8cd378be4cde233b40d7e34b1fbd3032d632452f6fdf8