Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    184s
  • max time network
    193s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/12/2022, 15:42

General

  • Target

    a82ac7439d8b81cea17c1ddc09f99e606f9baebaca70821acc35bc84b6653829.exe

  • Size

    63KB

  • MD5

    a94ee8fae54514eda3b0276453a6fb52

  • SHA1

    bd676c5336f18f94e928868a6824b70d2111193d

  • SHA256

    a82ac7439d8b81cea17c1ddc09f99e606f9baebaca70821acc35bc84b6653829

  • SHA512

    c84f130384b227157f1c36be304dda3cc64c8d8bd41d81a2fef77540ff9ffbf74af15b50b1b6dfd437510993ddf6f973771413e3ae68fd0c33a81ea724bc6d4d

  • SSDEEP

    1536:f3CKsatliGykj2OycDM1GRWFwKJ1OzybJcb/nv06Sh5IM3:/LrlTj2O7gQWKKJ1AyCX0NCc

Score
10/10

Malware Config

Signatures

  • Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Program crash 1 IoCs
  • Modifies registry class 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:2596
      • C:\Users\Admin\AppData\Local\Temp\a82ac7439d8b81cea17c1ddc09f99e606f9baebaca70821acc35bc84b6653829.exe
        "C:\Users\Admin\AppData\Local\Temp\a82ac7439d8b81cea17c1ddc09f99e606f9baebaca70821acc35bc84b6653829.exe"
        2⤵
        • Adds autorun key to be loaded by Explorer.exe on startup
        • Suspicious use of SetThreadContext
        • Drops file in Program Files directory
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2800
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe "C:\Program Files (x86)\Common Files\Thunder Network\kankan\xappext.dll",DllPreTranslateMessage
          3⤵
          • Loads dropped DLL
          • Suspicious behavior: EnumeratesProcesses
          PID:2372
        • C:\Windows\SysWOW64\calc.exe
          "C:\Windows\system32\calc.exe"
          3⤵
            PID:4476
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 4476 -s 300
              4⤵
              • Program crash
              PID:4500
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4476 -ip 4476
        1⤵
          PID:4668

        Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Program Files (x86)\Common Files\Thunder Network\kankan\xappext.dll

          Filesize

          59KB

          MD5

          983141138d37ba3a17315ef357cd05ac

          SHA1

          758af8c325b54813f545efa884cf6410348cb1fa

          SHA256

          2f24f7d01e76e5f5dadcdd7aedc04ef74804a5324c70668e4b4e02a4008f375f

          SHA512

          d401bb59aca454ec6c6137d06469b4687424e37d5d84f457d10286c051242b551e86398373ff8b508fec2ec96dc825f8990fc01d2f4fe5d94166e387e3870dfd

        • C:\Program Files (x86)\Common Files\Thunder Network\kankan\xappext.dll

          Filesize

          59KB

          MD5

          983141138d37ba3a17315ef357cd05ac

          SHA1

          758af8c325b54813f545efa884cf6410348cb1fa

          SHA256

          2f24f7d01e76e5f5dadcdd7aedc04ef74804a5324c70668e4b4e02a4008f375f

          SHA512

          d401bb59aca454ec6c6137d06469b4687424e37d5d84f457d10286c051242b551e86398373ff8b508fec2ec96dc825f8990fc01d2f4fe5d94166e387e3870dfd

        • memory/2372-142-0x0000000001530000-0x0000000001545000-memory.dmp

          Filesize

          84KB

        • memory/2800-140-0x0000000000400000-0x0000000000411000-memory.dmp

          Filesize

          68KB

        • memory/2800-141-0x0000000000030000-0x0000000000036000-memory.dmp

          Filesize

          24KB

        • memory/4476-139-0x0000000000FF0000-0x0000000000FF1000-memory.dmp

          Filesize

          4KB