Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    145s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/12/2022, 20:37

General

  • Target

    8487a96fb05cbe05604bb5c3aadc44a5f8f66df2e10c4fe602bf97b50505a8f8.exe

  • Size

    640KB

  • MD5

    f4c4fc3857150ed0ba3868dfa0e54ded

  • SHA1

    9820e32607d7f3c32af43be8b815b5923125efe8

  • SHA256

    8487a96fb05cbe05604bb5c3aadc44a5f8f66df2e10c4fe602bf97b50505a8f8

  • SHA512

    4a880ad57f9129949cee7373c62f394e5a01932cec1aac4093c3a401d083778e831504afab67d4688292b85d75096245fdce50d0ac984423fe8023df182bc5c8

  • SSDEEP

    12288:YbV/LJwUPNnKoeVLln+B8JusAvWyhsdEoT+R9Yx:ipJwCNKoeVLFk2vAeyhsyoc9G

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Loads dropped DLL 2 IoCs
  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8487a96fb05cbe05604bb5c3aadc44a5f8f66df2e10c4fe602bf97b50505a8f8.exe
    "C:\Users\Admin\AppData\Local\Temp\8487a96fb05cbe05604bb5c3aadc44a5f8f66df2e10c4fe602bf97b50505a8f8.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Checks BIOS information in registry
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:1056

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\MSWINSCK.OCX

    Filesize

    121KB

    MD5

    e8a2190a9e8ee5e5d2e0b599bbf9dda6

    SHA1

    4e97bf9519c83835da9db309e61ec87ddf165167

    SHA256

    80ab0b86de58a657956b2a293bd9957f78e37e7383c86d6cd142208c153b6311

    SHA512

    57f8473eedaf7e8aad3b5bcbb16d373fd6aaec290c3230033fc50b5ec220e93520b8915c936e758bb19107429a49965516425350e012f8db0de6d4f6226b42ee

  • C:\Windows\SysWOW64\MSWINSCK.OCX

    Filesize

    121KB

    MD5

    e8a2190a9e8ee5e5d2e0b599bbf9dda6

    SHA1

    4e97bf9519c83835da9db309e61ec87ddf165167

    SHA256

    80ab0b86de58a657956b2a293bd9957f78e37e7383c86d6cd142208c153b6311

    SHA512

    57f8473eedaf7e8aad3b5bcbb16d373fd6aaec290c3230033fc50b5ec220e93520b8915c936e758bb19107429a49965516425350e012f8db0de6d4f6226b42ee

  • memory/1056-133-0x0000000000400000-0x00000000004BE000-memory.dmp

    Filesize

    760KB

  • memory/1056-134-0x0000000000510000-0x000000000055D000-memory.dmp

    Filesize

    308KB

  • memory/1056-139-0x0000000000400000-0x00000000004BE000-memory.dmp

    Filesize

    760KB

  • memory/1056-140-0x0000000000401000-0x000000000040A000-memory.dmp

    Filesize

    36KB

  • memory/1056-145-0x0000000000400000-0x00000000004BE000-memory.dmp

    Filesize

    760KB