Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
104s -
max time network
58s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
06/03/2023, 14:30
Static task
static1
Behavioral task
behavioral1
Sample
48538dea30f2042edcae98127b9e163f4f0d6a56aec15625d8bd2dae5ba8ac35.exe
Resource
win10-20230220-en
General
-
Target
48538dea30f2042edcae98127b9e163f4f0d6a56aec15625d8bd2dae5ba8ac35.exe
-
Size
4.2MB
-
MD5
35f181ee49ec409d056cca073b71fdae
-
SHA1
c03b476e3ebea8c806149072963125c032f5016a
-
SHA256
48538dea30f2042edcae98127b9e163f4f0d6a56aec15625d8bd2dae5ba8ac35
-
SHA512
7dafc8c67971f1e49004566f815ca85553562317b7a661dcca0eb4d8cdcb08347ee21799242a79b8c1afa89700dd12f5621281971615e5937762538771737219
-
SSDEEP
98304:3pEhTEG4s2Rk5cs38shhSNjJe+i4sYeq69DedTV0VbTXF2RAvRthQ:ZRG4sskf38s7MjJeVYT69id+VbaM8
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 3224 DesktopMicrosoft-type2.3.5.7.exe 4504 DesktopMicrosoft-type2.3.5.7.exe -
Modifies file permissions 1 TTPs 3 IoCs
pid Process 3992 icacls.exe 4264 icacls.exe 1544 icacls.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4128 set thread context of 3840 4128 48538dea30f2042edcae98127b9e163f4f0d6a56aec15625d8bd2dae5ba8ac35.exe 67 -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4644 schtasks.exe -
Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 4128 wrote to memory of 3840 4128 48538dea30f2042edcae98127b9e163f4f0d6a56aec15625d8bd2dae5ba8ac35.exe 67 PID 4128 wrote to memory of 3840 4128 48538dea30f2042edcae98127b9e163f4f0d6a56aec15625d8bd2dae5ba8ac35.exe 67 PID 4128 wrote to memory of 3840 4128 48538dea30f2042edcae98127b9e163f4f0d6a56aec15625d8bd2dae5ba8ac35.exe 67 PID 4128 wrote to memory of 3840 4128 48538dea30f2042edcae98127b9e163f4f0d6a56aec15625d8bd2dae5ba8ac35.exe 67 PID 4128 wrote to memory of 3840 4128 48538dea30f2042edcae98127b9e163f4f0d6a56aec15625d8bd2dae5ba8ac35.exe 67 PID 3840 wrote to memory of 4264 3840 AppLaunch.exe 68 PID 3840 wrote to memory of 4264 3840 AppLaunch.exe 68 PID 3840 wrote to memory of 4264 3840 AppLaunch.exe 68 PID 3840 wrote to memory of 1544 3840 AppLaunch.exe 70 PID 3840 wrote to memory of 1544 3840 AppLaunch.exe 70 PID 3840 wrote to memory of 1544 3840 AppLaunch.exe 70 PID 3840 wrote to memory of 3992 3840 AppLaunch.exe 73 PID 3840 wrote to memory of 3992 3840 AppLaunch.exe 73 PID 3840 wrote to memory of 3992 3840 AppLaunch.exe 73 PID 3840 wrote to memory of 4644 3840 AppLaunch.exe 74 PID 3840 wrote to memory of 4644 3840 AppLaunch.exe 74 PID 3840 wrote to memory of 4644 3840 AppLaunch.exe 74 PID 3840 wrote to memory of 3224 3840 AppLaunch.exe 76 PID 3840 wrote to memory of 3224 3840 AppLaunch.exe 76
Processes
-
C:\Users\Admin\AppData\Local\Temp\48538dea30f2042edcae98127b9e163f4f0d6a56aec15625d8bd2dae5ba8ac35.exe"C:\Users\Admin\AppData\Local\Temp\48538dea30f2042edcae98127b9e163f4f0d6a56aec15625d8bd2dae5ba8ac35.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4128 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3840 -
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\ProgramData\DesktopMicrosoft-type2.3.5.7" /inheritance:e /deny "*S-1-1-0:(R,REA,RA,RD)"3⤵
- Modifies file permissions
PID:4264
-
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\ProgramData\DesktopMicrosoft-type2.3.5.7" /inheritance:e /deny "*S-1-5-7:(R,REA,RA,RD)"3⤵
- Modifies file permissions
PID:1544
-
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\ProgramData\DesktopMicrosoft-type2.3.5.7" /inheritance:e /deny "admin:(R,REA,RA,RD)"3⤵
- Modifies file permissions
PID:3992
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /CREATE /TN "DesktopMicrosoft-type2.3.5.7\DesktopMicrosoft-type2.3.5.7" /TR "C:\ProgramData\DesktopMicrosoft-type2.3.5.7\DesktopMicrosoft-type2.3.5.7.exe" /SC MINUTE3⤵
- Creates scheduled task(s)
PID:4644
-
-
C:\ProgramData\DesktopMicrosoft-type2.3.5.7\DesktopMicrosoft-type2.3.5.7.exe"C:\ProgramData\DesktopMicrosoft-type2.3.5.7\DesktopMicrosoft-type2.3.5.7.exe" "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"3⤵
- Executes dropped EXE
PID:3224
-
-
-
C:\ProgramData\DesktopMicrosoft-type2.3.5.7\DesktopMicrosoft-type2.3.5.7.exeC:\ProgramData\DesktopMicrosoft-type2.3.5.7\DesktopMicrosoft-type2.3.5.7.exe1⤵
- Executes dropped EXE
PID:4504
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
652.7MB
MD54462db1a5d6252bc5ad6753e4c372d8a
SHA1ae8af0675bd4b62aaad671054a44bfa3fa140b20
SHA256060e93e0742ddc337b75b08c1e2411b09ebdb3eba3bf167aebf55b6d9af84811
SHA512b5ef9b05bd377e564a4d4911023a2cdf9a330cbd15536e313f480afde77ea1e7a46282da9b0156ee91daed89459886d2d4422fbea43c5a174b99942ecbeeae32
-
Filesize
638.1MB
MD5fac6722b64026a9c743fcf6f589ee019
SHA16472fe4052ae31dce25e0b40196e27f3ad949c25
SHA256f23ea990dc9e38c461876d544658b21c4993fa867a68213a8d9d0ff1ffb34fdf
SHA5123b86f40f52c55fa96fe33d9b84869dffe6cfdcee15f2bf4f7835afce4ce811ceea59477c107c8b9aaca44e64002e10a747359c8e2e683a2220d7c8d1b11ea570
-
Filesize
196.1MB
MD50e0ca754f1979364edbc321a7fecf3a7
SHA1a0d75ddb9ca3bdb8adb33ce3dbe9861c46fe26ee
SHA256827dfde661ab0b576c7a387174b3fbf984c2494f3426dfe21687d5d853dc58ff
SHA512b83323fe64b9d9ab17c4dba850446025d0d57ce8cc53f22ad5ead8a79dcd94275d177c8964bac0e99b23a08dd70080c6240dcc06188fec992f93f3c2d35d6214