Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    154s
  • max time network
    159s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/03/2023, 15:41

General

  • Target

    e066fc71749b0a90749d3b8af5b53aa21bab9d43c63cddcb46c9b1f9ae5beb76.exe

  • Size

    251KB

  • MD5

    e25796ad27eb0153d8662e37d05ec56b

  • SHA1

    47e308112a5b98f8b2d286bb09c4559b6021b3bc

  • SHA256

    e066fc71749b0a90749d3b8af5b53aa21bab9d43c63cddcb46c9b1f9ae5beb76

  • SHA512

    a425eb1df23630def72f07d528ad157b57d0291713e8969f590f5969688e559e9c2a37b2abf78c4ec650ea8d8edaa398d60ad26323c6679b8c7d30cb44ff210c

  • SSDEEP

    6144:DYa6T344OhBM8I5Tq7kDaFqPocnRppmMgDN0h0wx/:DYRuhBz4anOa03/

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3148
    • C:\Users\Admin\AppData\Local\Temp\e066fc71749b0a90749d3b8af5b53aa21bab9d43c63cddcb46c9b1f9ae5beb76.exe
      "C:\Users\Admin\AppData\Local\Temp\e066fc71749b0a90749d3b8af5b53aa21bab9d43c63cddcb46c9b1f9ae5beb76.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1212
      • C:\Users\Admin\AppData\Local\Temp\mgcah.exe
        "C:\Users\Admin\AppData\Local\Temp\mgcah.exe" C:\Users\Admin\AppData\Local\Temp\nmlbeworo.wp
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of WriteProcessMemory
        PID:1988
        • C:\Users\Admin\AppData\Local\Temp\mgcah.exe
          "C:\Users\Admin\AppData\Local\Temp\mgcah.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          PID:1300
    • C:\Windows\SysWOW64\msdt.exe
      "C:\Windows\SysWOW64\msdt.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Modifies Internet Explorer settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4184
      • C:\Program Files\Mozilla Firefox\Firefox.exe
        "C:\Program Files\Mozilla Firefox\Firefox.exe"
        3⤵
          PID:3088
          • C:\Windows\system32\WerFault.exe
            C:\Windows\system32\WerFault.exe -u -p 3088 -s 128
            4⤵
            • Program crash
            PID:4552
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -pss -s 476 -p 3088 -ip 3088
      1⤵
        PID:3328

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\mgcah.exe

        Filesize

        7KB

        MD5

        24b418a08bfce8a6faaf67543794a280

        SHA1

        f4474f8b1e37748be7be9053d5bab23eb2bc801a

        SHA256

        c49828c2c6fdbbe1c29221893d31e95cbb75210390259a884f1beb8c2898fd76

        SHA512

        229985bdbcd3dcd411badaec590073754ecd8ff78cc228098c64a1f93979df5f8d42bbc5ab32084a6bde64991a83d9d35f9afd98630a08546b8b89243d25bee3

      • C:\Users\Admin\AppData\Local\Temp\mgcah.exe

        Filesize

        7KB

        MD5

        24b418a08bfce8a6faaf67543794a280

        SHA1

        f4474f8b1e37748be7be9053d5bab23eb2bc801a

        SHA256

        c49828c2c6fdbbe1c29221893d31e95cbb75210390259a884f1beb8c2898fd76

        SHA512

        229985bdbcd3dcd411badaec590073754ecd8ff78cc228098c64a1f93979df5f8d42bbc5ab32084a6bde64991a83d9d35f9afd98630a08546b8b89243d25bee3

      • C:\Users\Admin\AppData\Local\Temp\mgcah.exe

        Filesize

        7KB

        MD5

        24b418a08bfce8a6faaf67543794a280

        SHA1

        f4474f8b1e37748be7be9053d5bab23eb2bc801a

        SHA256

        c49828c2c6fdbbe1c29221893d31e95cbb75210390259a884f1beb8c2898fd76

        SHA512

        229985bdbcd3dcd411badaec590073754ecd8ff78cc228098c64a1f93979df5f8d42bbc5ab32084a6bde64991a83d9d35f9afd98630a08546b8b89243d25bee3

      • C:\Users\Admin\AppData\Local\Temp\nmlbeworo.wp

        Filesize

        5KB

        MD5

        0d21fef0892b0f6420ca2e779eea172a

        SHA1

        66f233ff2b691ca9f59f94866902f0000f2e9518

        SHA256

        df151fce86ca5123f99488c0575d691b004149e167a3cf181ddfa6e0834b6c79

        SHA512

        6992aaccd778be88fae0ddd69783b74a6997871f04aa1fc420cf670b95107579e9863cc8380b8a440ce141cad3f8fb678c4646346ff5816ab4c988cee464e7dd

      • C:\Users\Admin\AppData\Local\Temp\zaaeuxmxil.e

        Filesize

        205KB

        MD5

        936f56b919389031bd5d638c9bad07ca

        SHA1

        ab88090f736103d535484be8727fe0fac2c52e08

        SHA256

        8f7ea36e02e2cf059b3c58dac801ce27f58a7d449569f795694aff273438a89c

        SHA512

        fb897b9475ab16d5d5a492b932d8c01ab61466bfa49d83ba4531e424f6c5fd907e857878186415d3dad66a6e50f45b773ab479be23ff7901ebb779343145abaf

      • memory/1300-147-0x00000000018D0000-0x0000000001C1A000-memory.dmp

        Filesize

        3.3MB

      • memory/1300-146-0x0000000000400000-0x000000000042F000-memory.dmp

        Filesize

        188KB

      • memory/1300-142-0x0000000000400000-0x000000000042F000-memory.dmp

        Filesize

        188KB

      • memory/1300-148-0x0000000001460000-0x0000000001470000-memory.dmp

        Filesize

        64KB

      • memory/1300-145-0x0000000000400000-0x000000000042F000-memory.dmp

        Filesize

        188KB

      • memory/3148-155-0x00000000025F0000-0x00000000026AC000-memory.dmp

        Filesize

        752KB

      • memory/3148-149-0x0000000002520000-0x00000000025EC000-memory.dmp

        Filesize

        816KB

      • memory/3148-159-0x00000000025F0000-0x00000000026AC000-memory.dmp

        Filesize

        752KB

      • memory/4184-151-0x0000000000C20000-0x0000000000C77000-memory.dmp

        Filesize

        348KB

      • memory/4184-153-0x0000000000840000-0x000000000086D000-memory.dmp

        Filesize

        180KB

      • memory/4184-154-0x0000000002A60000-0x0000000002DAA000-memory.dmp

        Filesize

        3.3MB

      • memory/4184-152-0x0000000000840000-0x000000000086D000-memory.dmp

        Filesize

        180KB

      • memory/4184-156-0x0000000000FF0000-0x000000000107F000-memory.dmp

        Filesize

        572KB

      • memory/4184-150-0x0000000000C20000-0x0000000000C77000-memory.dmp

        Filesize

        348KB