Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    69s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/12/2022, 13:39

General

  • Target

    da1124a617761808836118fbfacdc50a6ed406b7e269946bcb9ecef0b88ede2b.exe

  • Size

    434KB

  • MD5

    0e2bca9e9eec75bba508ca21a673c1ba

  • SHA1

    4f9c98c7bc787e5a3904b9ae7ed210546ed6fc15

  • SHA256

    da1124a617761808836118fbfacdc50a6ed406b7e269946bcb9ecef0b88ede2b

  • SHA512

    aedd21b8ce455cbca20e2c8444e06849e0e1b49b57636741032f867bb40e14a0f47fe2d2d6840655e531af2c8131e3b22a5e41411ef9914108c14ed39a6bfaf8

  • SSDEEP

    12288:/WWZmQtWsYtpyAEMYvu5fAT8hMn28f6sRE:pBtTAEM2u5fAzVf6p

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
  • Modifies visibility of file extensions in Explorer 2 TTPs 2 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Modifies Internet Explorer start page 1 TTPs 2 IoCs
  • Modifies registry class 43 IoCs
  • Runs .reg file with regedit 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\da1124a617761808836118fbfacdc50a6ed406b7e269946bcb9ecef0b88ede2b.exe
    "C:\Users\Admin\AppData\Local\Temp\da1124a617761808836118fbfacdc50a6ed406b7e269946bcb9ecef0b88ede2b.exe"
    1⤵
    • Modifies visibility of file extensions in Explorer
    • Modifies visiblity of hidden/system files in Explorer
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:1368
    • C:\Windows\SysWOW64\regedit.exe
      C:\Windows\regedit.exe /S C:\Windows\system32\msscp.reg
      2⤵
      • Modifies WinLogon for persistence
      • Modifies registry class
      • Runs .reg file with regedit
      PID:3412
    • C:\Users\Admin\AppData\Local\Temp\da1124a617761808836118fbfacdc50a6ed406b7e269946bcb9ecef0b88ede2b.exe
      C:\Users\Admin\AppData\Local\Temp\da1124a617761808836118fbfacdc50a6ed406b7e269946bcb9ecef0b88ede2b.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:4140
      • C:\Windows\SysWOW64\regedit.exe
        C:\Windows\regedit.exe /S C:\Windows\system32\msscp.reg
        3⤵
        • Modifies WinLogon for persistence
        • Modifies registry class
        • Runs .reg file with regedit
        PID:1516

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\Common Files\System\taobao.ico

    Filesize

    14KB

    MD5

    468fada123f5548ac87e57bae81f6782

    SHA1

    edb8f012c25906e6afd8bf335b495e16c440243d

    SHA256

    091c882bb307d57f2c7c42309e7ba8740130fef8c3ed772b0bc5e5505e37034d

    SHA512

    635ec26c88c2394dd4f2a81b9aea8f429a91adfeb37ae34e51b03f3cf8e503c123c3685938f40cea07d6146e0c7113aadbe62fa528f1f6d8b995e617fd68a4aa

  • C:\Windows\SysWOW64\msscp.reg

    Filesize

    1KB

    MD5

    2a645eb5023a526549f59a9ff4e5270d

    SHA1

    0b0dcba132e7e83d9d5c4bb74a745109299c1bfd

    SHA256

    1ce92aff6ba1628f372ff559fbc787475b473f59d0797f2cbf627d619fa31d42

    SHA512

    a8de7ba1dd17b3f842bd995e71fd63a224a1483296fc4a1560d11fc132741a45188b7ade6f5d21b7bf64d4a029728268ebe1698d4a13abd2a7e180b06b8b3a33

  • C:\Windows\SysWOW64\msscp.reg

    Filesize

    1KB

    MD5

    2a645eb5023a526549f59a9ff4e5270d

    SHA1

    0b0dcba132e7e83d9d5c4bb74a745109299c1bfd

    SHA256

    1ce92aff6ba1628f372ff559fbc787475b473f59d0797f2cbf627d619fa31d42

    SHA512

    a8de7ba1dd17b3f842bd995e71fd63a224a1483296fc4a1560d11fc132741a45188b7ade6f5d21b7bf64d4a029728268ebe1698d4a13abd2a7e180b06b8b3a33

  • memory/1368-132-0x0000000000400000-0x000000000047D000-memory.dmp

    Filesize

    500KB

  • memory/1368-141-0x0000000000400000-0x000000000047D000-memory.dmp

    Filesize

    500KB

  • memory/4140-139-0x0000000000400000-0x000000000047D000-memory.dmp

    Filesize

    500KB

  • memory/4140-140-0x0000000000400000-0x000000000047D000-memory.dmp

    Filesize

    500KB