Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    90s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/12/2022, 06:04

General

  • Target

    edacec5165574683223b96666a6ab206089fe2c60c45d4b010e899441b7ba622.exe

  • Size

    366KB

  • MD5

    7ddc9d7e7d73ac709c5d549fda478360

  • SHA1

    f786cc4bf8db1660331fbd85410fdb3d20e0939a

  • SHA256

    edacec5165574683223b96666a6ab206089fe2c60c45d4b010e899441b7ba622

  • SHA512

    06475435f7744d047365312189c4957289d7559bac2dfe39c0489cfe19caf569bb10693c76bc363557068b3c69adebbc7793cea2327f88361a636f6c51b4828c

  • SSDEEP

    6144:4f+zrJY+/vLTHu4GATr9eRjVla9qqz3xKrBcZmGizBJhtb1xbKIAQMkigXf:nmqOw9eNVw9qq3Si8GUTb5Mkiuf

Score
8/10

Malware Config

Signatures

  • Uses Session Manager for persistence 2 TTPs 3 IoCs

    Creates Session Manager registry key to run executable early in system boot.

  • Kills process with taskkill 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\edacec5165574683223b96666a6ab206089fe2c60c45d4b010e899441b7ba622.exe
    "C:\Users\Admin\AppData\Local\Temp\edacec5165574683223b96666a6ab206089fe2c60c45d4b010e899441b7ba622.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3012
    • C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\SYSTEM\ControlSet001\Control\Session manager" /v BootExecute /t REG_MULTI_SZ /d "autocheck autochk *" /f
      2⤵
      • Uses Session Manager for persistence
      PID:2108
    • C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\SYSTEM\ControlSet002\Control\Session manager" /v BootExecute /t REG_MULTI_SZ /d "autocheck autochk *" /f
      2⤵
      • Uses Session Manager for persistence
      PID:1696
    • C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session manager" /v BootExecute /t REG_MULTI_SZ /d "autocheck autochk *" /f
      2⤵
      • Uses Session Manager for persistence
      PID:4968
    • C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM javasq2.exe
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:2064

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3012-136-0x000000007FDF0000-0x000000007FE4C000-memory.dmp

    Filesize

    368KB

  • memory/3012-142-0x0000000000400000-0x0000000000472000-memory.dmp

    Filesize

    456KB

  • memory/3012-138-0x000000007FDF0000-0x000000007FE4C000-memory.dmp

    Filesize

    368KB

  • memory/3012-137-0x000000007FDF0000-0x000000007FE4C000-memory.dmp

    Filesize

    368KB

  • memory/3012-139-0x000000007FDF0000-0x000000007FE4C000-memory.dmp

    Filesize

    368KB

  • memory/3012-140-0x000000007FDF0000-0x000000007FE4C000-memory.dmp

    Filesize

    368KB

  • memory/3012-141-0x000000007FDF0000-0x000000007FE4C000-memory.dmp

    Filesize

    368KB

  • memory/3012-132-0x0000000000400000-0x0000000000472000-memory.dmp

    Filesize

    456KB

  • memory/3012-135-0x000000007FDF0000-0x000000007FE4C000-memory.dmp

    Filesize

    368KB

  • memory/3012-134-0x000000007FDF0000-0x000000007FE4C000-memory.dmp

    Filesize

    368KB

  • memory/3012-148-0x000000007FDF0000-0x000000007FE4C000-memory.dmp

    Filesize

    368KB

  • memory/3012-133-0x000000007FDF0000-0x000000007FE4C000-memory.dmp

    Filesize

    368KB

  • memory/3012-147-0x0000000000400000-0x0000000000472000-memory.dmp

    Filesize

    456KB