Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    165s
  • max time network
    192s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/12/2022, 16:10

General

  • Target

    de31908fa894a030c75f423955620326cf8c1c00bce19427b280e51b277ab5dc.exe

  • Size

    83KB

  • MD5

    42d68211aeb022610c8c622f94683651

  • SHA1

    5b336158cfc04c95238c1502eabc8db76a90e112

  • SHA256

    de31908fa894a030c75f423955620326cf8c1c00bce19427b280e51b277ab5dc

  • SHA512

    2b4051a1c9732141098410e70e072d22341bd312eaed2880aa7d35197902da38d034f694e989ebfdafc96c3e638f3fb2d4dcdbbb58d05505ac6c506971b0706f

  • SSDEEP

    1536:8nHfhdq/LWoxOxjW2Slcnouy8oMgJKTOMlmx:aHuDtxGG8outTgJKCMgx

Score
8/10
upx

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates connected drives 3 TTPs 3 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\de31908fa894a030c75f423955620326cf8c1c00bce19427b280e51b277ab5dc.exe
    "C:\Users\Admin\AppData\Local\Temp\de31908fa894a030c75f423955620326cf8c1c00bce19427b280e51b277ab5dc.exe"
    1⤵
    • Enumerates connected drives
    • Modifies Internet Explorer settings
    • Modifies system certificate store
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4420
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c reg delete HKCU\Software\yahoo\pager /v "Save Password" /f
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2488
      • C:\Windows\SysWOW64\reg.exe
        reg delete HKCU\Software\yahoo\pager /v "Save Password" /f
        3⤵
        • Modifies registry key
        PID:2044
    • C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Acrobat.exe
      "C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Acrobat.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Windows directory
      • Suspicious use of SetWindowsHookEx
      PID:1056

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Acrobat.exe

    Filesize

    83KB

    MD5

    42d68211aeb022610c8c622f94683651

    SHA1

    5b336158cfc04c95238c1502eabc8db76a90e112

    SHA256

    de31908fa894a030c75f423955620326cf8c1c00bce19427b280e51b277ab5dc

    SHA512

    2b4051a1c9732141098410e70e072d22341bd312eaed2880aa7d35197902da38d034f694e989ebfdafc96c3e638f3fb2d4dcdbbb58d05505ac6c506971b0706f

  • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\Acrobat.exe

    Filesize

    83KB

    MD5

    42d68211aeb022610c8c622f94683651

    SHA1

    5b336158cfc04c95238c1502eabc8db76a90e112

    SHA256

    de31908fa894a030c75f423955620326cf8c1c00bce19427b280e51b277ab5dc

    SHA512

    2b4051a1c9732141098410e70e072d22341bd312eaed2880aa7d35197902da38d034f694e989ebfdafc96c3e638f3fb2d4dcdbbb58d05505ac6c506971b0706f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D

    Filesize

    2KB

    MD5

    2e8dab0111c5f3e9103cae92a9e1cdaa

    SHA1

    5d16362cf320faeacf5963532354e99e0dce3e2b

    SHA256

    858dfc9a9af2e0400a91bf3660acb1a123960c5ad53df61b7f73663035e01ba8

    SHA512

    ee28bf368690e56ada1fc8538330cc22cb57a59a1a5012e73d3e0300dc7410b82f8c2a300625560e69bc19344acc333b2138ec49ca5ddf5f24a54debce685abb

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\572BF21E454637C9F000BE1AF9B1E1A9

    Filesize

    506B

    MD5

    37c10f2bde92a7126e4e1a44c73c5d31

    SHA1

    934121e8fa137a7ee135e6955cac5f31301b23f9

    SHA256

    686ab30b2fd395912abec41b17f8b29dc37389393c38c364186fcd69cf573e95

    SHA512

    4f3800b069253d81c611ed2c4be7a2456acb0af3c4d31be9b8c465ab1c99f11b2fc6c35263b7d7c7cb411bc01e7c18a1ecd11676050204feaea7597cac7dc06a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C6872375A2E1BC120603F5605C3CEC71

    Filesize

    472B

    MD5

    50964d71646920295f4a98db21a913c1

    SHA1

    8ede97a36ce131830b2a69f6225790dbd3f2ef8e

    SHA256

    aa282f0e5e4ab3690472c8c867419ea33a4fafba1594722e8ca9dcf1325fd46a

    SHA512

    02c8543fc6b930a0e43727a7614edf92143701c9c81c1452faa2104cb5310c2b0b25c8d441dcac7b9e695b6e64e019d3bede3be20bede395d895e57c4da261aa

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D

    Filesize

    488B

    MD5

    42060c254ce537d681afdc4a199c7009

    SHA1

    24129420e1babdc45ebe03c1b654502eb9b88596

    SHA256

    5d1fe4580097ccadc9576da58f49f07c9d683529bf96de7e932f95363ca0fd22

    SHA512

    44a7f1db940cc6e494337f6c52dc624cad1fb44281662744f4b69a1f258ca10a74032efe69e61f9bd41e2fb71b5d54ec2a2cf9725e332ea44e9d89ce0d6e57fd

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\572BF21E454637C9F000BE1AF9B1E1A9

    Filesize

    248B

    MD5

    0dcace0d7070e8d60e3ea079040f19a2

    SHA1

    a127629275c9d6ff2cc0cbf7e8c20cf7f44f8915

    SHA256

    a05e2bfdf9f5ab312283d0a24a41ddb73596ab5f01ea3b3cd39fdd08eed55252

    SHA512

    dad9aac5add63ff7d286d048d43f76c606352b4c3d1244ec75b856f7581a6a4e374e43ce4bd36fc063be6724e1b712066ee27ecaf9cbcad209754f8350d20dc3

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C6872375A2E1BC120603F5605C3CEC71

    Filesize

    484B

    MD5

    9f7fcf33c46d41db998ad02f4d3d6552

    SHA1

    1e9e60962f603baee109597faa0f5137787e82d7

    SHA256

    86d098afca28dc3345fa438b03affe785315d63b9e6916c6399157aab0677e22

    SHA512

    8adf31095731bcfa75953d0af828b2fc8369d7e09544e2de30e50ff4a669557fcbf735e62f136619d88f7d9284e0250e8327d9a3d4caed5827c9edec34ab0004

  • memory/1056-142-0x0000000000400000-0x0000000000452000-memory.dmp

    Filesize

    328KB

  • memory/4420-132-0x0000000000400000-0x0000000000452000-memory.dmp

    Filesize

    328KB