Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

da064fda26...00.exe

windows7-x64

10

da064fda26...00.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/12/2022, 18:31

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    da064fda26872da41f1a250c07fa3038bff9b9f87136c48fcfb110fabcb24d00.exe

  • Size

    1.4MB

  • MD5

    ac973d02dbb26b8ee2e52bea0ad6b6e6

  • SHA1

    0fd4cfa507c8ececc891648a850ec8f3dd6eda19

  • SHA256

    da064fda26872da41f1a250c07fa3038bff9b9f87136c48fcfb110fabcb24d00

  • SHA512

    7a4ec6f95533b5c0a03ee5e8bbd0165d55880ea039cc55ae2994d930f4953b10d3630c738fbe228e4ca8bb2049e09897c8023b23c99059b3fdb747b087f33201

  • SSDEEP

    1536:7Eo6GzI9cono/es2KyvLh423iZB7LbGnkBwUDXLY+cnCd4SztNXjU8UdatVgc1h:g8ciono/e95vLh4j2Umns4khjU0jZ

Score
10/10
evasionpersistencespywarestealertrojanupx

Malware Config

Signatures

  • Modifies firewall policy service 2 TTPs 18 IoCs
    evasion
  • Modifies security service 2 TTPs 1 IoCs
    evasion
  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • UAC bypass 3 TTPs 3 IoCs
    evasiontrojan
  • Windows security bypass 2 TTPs 4 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Disables Task Manager via registry modification
    evasion
  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 3 IoCs
  • Sets file execution options in registry 2 TTPs 64 IoCs
    persistence
  • UPX packed file 10 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 15 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Control Panel 2 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 42 IoCs
    adwarespyware
  • Modifies Internet Explorer start page 1 TTPs 2 IoCs
    stealer
  • Modifies registry class 24 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs
  • System policy modification 1 TTPs 4 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\da064fda26872da41f1a250c07fa3038bff9b9f87136c48fcfb110fabcb24d00.exe
    "C:\Users\Admin\AppData\Local\Temp\da064fda26872da41f1a250c07fa3038bff9b9f87136c48fcfb110fabcb24d00.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1088
    • C:\Users\Admin\AppData\Local\Temp\da064fda26872da41f1a250c07fa3038bff9b9f87136c48fcfb110fabcb24d00.exe
      2⤵
      • Checks computer location settings
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1884
      • C:\Users\Admin\E696D64614\winlogon.exe
        "C:\Users\Admin\E696D64614\winlogon.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:1436
        • C:\Users\Admin\E696D64614\winlogon.exe
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4408
          • C:\Users\Admin\E696D64614\winlogon.exe
            "C:\Users\Admin\E696D64614\winlogon.exe"
            5⤵
            • Modifies firewall policy service
            • Modifies security service
            • Modifies visibility of file extensions in Explorer
            • Modifies visiblity of hidden/system files in Explorer
            • UAC bypass
            • Windows security bypass
            • Disables RegEdit via registry modification
            • Drops file in Drivers directory
            • Executes dropped EXE
            • Sets file execution options in registry
            • Drops startup file
            • Windows security modification
            • Adds Run key to start application
            • Checks whether UAC is enabled
            • Modifies Control Panel
            • Modifies Internet Explorer settings
            • Modifies Internet Explorer start page
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            • System policy modification
            PID:1236
  • C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\unsecapp.exe -Embedding
    1⤵
      PID:4560
    • C:\Program Files (x86)\Internet Explorer\ielowutil.exe
      "C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
      1⤵
        PID:2964
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
        1⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4856
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4856 CREDAT:17410 /prefetch:2
          2⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:4388

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
        Filesize

        2KB

        MD5

        97acf0930ce9f2f69d40ed8e1178cec6

        SHA1

        6380a2d97e4b4ccc3b4598cc2d431702e54ed69c

        SHA256

        b38f02de41dbb7db433a5f440dff85432150ff71d53b7ef8792d96da80962343

        SHA512

        f49c8a4fa51127e7d8b71cd0257bbedc8855ea708ec0e313e5071b656aedb815b55e51619df24ed967c4df0e685a4940cc1f123aa4ee0198a3d1ada1b42480e1

        Download Submit

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2119239CBE0D3DBEF6F19E0B10265873
        Filesize

        472B

        MD5

        f1dacaaa678dfa6d22420a8b46047d44

        SHA1

        8b80f47f01cc0714a47ff3d734b6bce89756ec26

        SHA256

        6533e522fdc5ac5af0079b6c4599cee64810a54671c9e4c49f8a79597b57926e

        SHA512

        34682d276393fe8c92c96fd8d0e61fd05aced08f6a10278da01fb1294177a8021021ad9c409e56381976f80ba99922c6aacde19084df2fcfff29fbd28108a1f3

        Download Submit

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
        Filesize

        471B

        MD5

        ac572cbbc82d6d652cdbe2596aeac4ee

        SHA1

        a631b27cf33fe134f42ed411d7ea06c21df41ad5

        SHA256

        50b6d8f62150a7bd25fb3e462130e8e054a0f1fb619487e8c426a4c8bf6bdca8

        SHA512

        070095ec83e4eeccae5dcbadcb3132f08fd0aac50badbc42cb72691236b6cfcdf14ce275fb1bf5511896bb4dd25c2121e044341003c1a507be8fabc0b2b1bfff

        Download Submit

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
        Filesize

        488B

        MD5

        9a37b1695e526805d056802e289cf6cf

        SHA1

        fa5fe55005e8d5fd29152f727252abf98a03d467

        SHA256

        f465b8f7a96812242e6c9d24bf89c2a471860b8e593c24098e616d435d8cbf8f

        SHA512

        05728c6bfc3a4760df2fe21423cc348186e763d7db1924b495390cf56ffc19425885550b31ff7a78a5c10a7f8d8326212ea2a19af881577a2a1b4ef9ac34ddc8

        Download Submit

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2119239CBE0D3DBEF6F19E0B10265873
        Filesize

        476B

        MD5

        a7d7218bf9eba242721ebcf38b613e61

        SHA1

        9b02941f6f206aee6a03c2e8ac61b7dca0361985

        SHA256

        e2d77600ab01f9a630badf85c4adb286078c5ed3a2de92d721d77415ed6af975

        SHA512

        2e57b4c0e6a9db73d0d984c6218447036a9b70779b5dc3bf038d7ff5aa0975f6a9d9b0115f7986a542cadd5c4f96f231a1f3b5f6fcb6bd51d905129eb160ed74

        Download Submit

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
        Filesize

        434B

        MD5

        a387af62079dac82973e77d3f3c46ebc

        SHA1

        b3b2a4f2d8a4555d59c572b4e1e3fdaa0e429082

        SHA256

        d3266a5f4aeed87b5059e0239914d42b11cbc0bc819e85ddb309c08daa003aed

        SHA512

        a71c809de0f96569221d126cf2e53538cbb3dbeede640637efebda42dabd849337cc3abc408c0de08235d59fe6a7a8b74c0e6b9132ce327e28d7e928e4a0d619

        Download Submit

      • C:\Users\Admin\E696D64614\winlogon.exe
        Filesize

        1.4MB

        MD5

        ac973d02dbb26b8ee2e52bea0ad6b6e6

        SHA1

        0fd4cfa507c8ececc891648a850ec8f3dd6eda19

        SHA256

        da064fda26872da41f1a250c07fa3038bff9b9f87136c48fcfb110fabcb24d00

        SHA512

        7a4ec6f95533b5c0a03ee5e8bbd0165d55880ea039cc55ae2994d930f4953b10d3630c738fbe228e4ca8bb2049e09897c8023b23c99059b3fdb747b087f33201

        Download Submit

      • C:\Users\Admin\E696D64614\winlogon.exe
        Filesize

        1.4MB

        MD5

        ac973d02dbb26b8ee2e52bea0ad6b6e6

        SHA1

        0fd4cfa507c8ececc891648a850ec8f3dd6eda19

        SHA256

        da064fda26872da41f1a250c07fa3038bff9b9f87136c48fcfb110fabcb24d00

        SHA512

        7a4ec6f95533b5c0a03ee5e8bbd0165d55880ea039cc55ae2994d930f4953b10d3630c738fbe228e4ca8bb2049e09897c8023b23c99059b3fdb747b087f33201

        Download Submit

      • C:\Users\Admin\E696D64614\winlogon.exe
        Filesize

        1.4MB

        MD5

        ac973d02dbb26b8ee2e52bea0ad6b6e6

        SHA1

        0fd4cfa507c8ececc891648a850ec8f3dd6eda19

        SHA256

        da064fda26872da41f1a250c07fa3038bff9b9f87136c48fcfb110fabcb24d00

        SHA512

        7a4ec6f95533b5c0a03ee5e8bbd0165d55880ea039cc55ae2994d930f4953b10d3630c738fbe228e4ca8bb2049e09897c8023b23c99059b3fdb747b087f33201

        Download Submit

      • C:\Users\Admin\E696D64614\winlogon.exe
        Filesize

        1.4MB

        MD5

        ac973d02dbb26b8ee2e52bea0ad6b6e6

        SHA1

        0fd4cfa507c8ececc891648a850ec8f3dd6eda19

        SHA256

        da064fda26872da41f1a250c07fa3038bff9b9f87136c48fcfb110fabcb24d00

        SHA512

        7a4ec6f95533b5c0a03ee5e8bbd0165d55880ea039cc55ae2994d930f4953b10d3630c738fbe228e4ca8bb2049e09897c8023b23c99059b3fdb747b087f33201

        Download Submit

      • memory/1236-157-0x0000000000400000-0x000000000043D000-memory.dmp

        Filesize

        244KB

        Download

      • memory/1236-161-0x0000000000400000-0x000000000043D000-memory.dmp

        Filesize

        244KB

        Download

      • memory/1236-158-0x0000000000400000-0x000000000043D000-memory.dmp

        Filesize

        244KB

        Download

      • memory/1236-154-0x0000000000400000-0x000000000043D000-memory.dmp

        Filesize

        244KB

        Download

      • memory/1884-151-0x0000000000400000-0x0000000000419000-memory.dmp

        Filesize

        100KB

        Download

      • memory/1884-139-0x0000000000400000-0x0000000000419000-memory.dmp

        Filesize

        100KB

        Download

      • memory/1884-136-0x0000000000400000-0x0000000000419000-memory.dmp

        Filesize

        100KB

        Download

      • memory/1884-135-0x0000000000400000-0x0000000000419000-memory.dmp

        Filesize

        100KB

        Download

      • memory/1884-133-0x0000000000400000-0x0000000000419000-memory.dmp

        Filesize

        100KB

        Download

      • memory/4408-152-0x0000000000400000-0x0000000000419000-memory.dmp

        Filesize

        100KB

        Download