Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    146s
  • max time network
    128s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/03/2023, 01:02

General

  • Target

    fd1afa3037c1ad95cce195ab062b4bd0f49d8da628afaaa47faca7d587d39bed.exe

  • Size

    3.4MB

  • MD5

    fdfc520c5f30be46b70ccd3dca1c3f4c

  • SHA1

    bcf01e5d4e6575a51a79c4f59dbc38b581e6c4e7

  • SHA256

    fd1afa3037c1ad95cce195ab062b4bd0f49d8da628afaaa47faca7d587d39bed

  • SHA512

    ff69e491a14e0a5301e9a036f3a3d7b9ad5ada11dcfc0fe805e1f31887c2537c0a4e31454e80c4ea60e350519f2514f1a982b801c1732017a6ff3f0e56b6878a

  • SSDEEP

    98304:2B33mwMi6hqm+mXHkTiGDsAsQJEwky5CXjcM0Jhv8jYhz:ImRhfv3DG4+vsXjcM0zv8jS

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 2 IoCs
  • Modifies file permissions 1 TTPs 3 IoCs
  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Checks whether UAC is enabled 1 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fd1afa3037c1ad95cce195ab062b4bd0f49d8da628afaaa47faca7d587d39bed.exe
    "C:\Users\Admin\AppData\Local\Temp\fd1afa3037c1ad95cce195ab062b4bd0f49d8da628afaaa47faca7d587d39bed.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2748
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4472
      • C:\Windows\SysWOW64\icacls.exe
        "C:\Windows\System32\icacls.exe" "C:\ProgramData\WindowsHolographicDevicesUSOShared-type3.5.6.2" /inheritance:e /deny "*S-1-1-0:(R,REA,RA,RD)"
        3⤵
        • Modifies file permissions
        PID:1744
      • C:\Windows\SysWOW64\icacls.exe
        "C:\Windows\System32\icacls.exe" "C:\ProgramData\WindowsHolographicDevicesUSOShared-type3.5.6.2" /inheritance:e /deny "*S-1-5-7:(R,REA,RA,RD)"
        3⤵
        • Modifies file permissions
        PID:5108
      • C:\Windows\SysWOW64\icacls.exe
        "C:\Windows\System32\icacls.exe" "C:\ProgramData\WindowsHolographicDevicesUSOShared-type3.5.6.2" /inheritance:e /deny "admin:(R,REA,RA,RD)"
        3⤵
        • Modifies file permissions
        PID:3364
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /CREATE /TN "WindowsHolographicDevicesUSOShared-type3.5.6.2\WindowsHolographicDevicesUSOShared-type3.5.6.2" /TR "C:\ProgramData\WindowsHolographicDevicesUSOShared-type3.5.6.2\WindowsHolographicDevicesUSOShared-type3.5.6.2.exe" /SC MINUTE
        3⤵
        • Creates scheduled task(s)
        PID:2756
      • C:\ProgramData\WindowsHolographicDevicesUSOShared-type3.5.6.2\WindowsHolographicDevicesUSOShared-type3.5.6.2.exe
        "C:\ProgramData\WindowsHolographicDevicesUSOShared-type3.5.6.2\WindowsHolographicDevicesUSOShared-type3.5.6.2.exe" "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Checks whether UAC is enabled
        PID:4412
  • C:\ProgramData\WindowsHolographicDevicesUSOShared-type3.5.6.2\WindowsHolographicDevicesUSOShared-type3.5.6.2.exe
    C:\ProgramData\WindowsHolographicDevicesUSOShared-type3.5.6.2\WindowsHolographicDevicesUSOShared-type3.5.6.2.exe
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Executes dropped EXE
    • Checks whether UAC is enabled
    PID:2100

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\WindowsHolographicDevicesUSOShared-type3.5.6.2\WindowsHolographicDevicesUSOShared-type3.5.6.2.exe

    Filesize

    756.9MB

    MD5

    42cc13fa50f8957925501dc3b78d29c3

    SHA1

    16d77fc7a6777a1b6705ac7e5ca45bbfabfef78c

    SHA256

    49d23c6249c5c95204fff71221e287d343c5c224bb5d2e838d93f8b42e988aa4

    SHA512

    016c9033dbeee8dad695295fd827b5b7d109555eed1d85879d982e8d803fd57bf7dd6fd94e53c57c548bc8859ce4e6df72034f9aa98329b0195909eb9f3a03e3

  • C:\ProgramData\WindowsHolographicDevicesUSOShared-type3.5.6.2\WindowsHolographicDevicesUSOShared-type3.5.6.2.exe

    Filesize

    835.1MB

    MD5

    1d7c51d40e7e6363346835910809f0b5

    SHA1

    1878e2b5e0918bb1822c032936b6057b20cb8af6

    SHA256

    8ac9eb0c10fc0c01ee6960a87ba21ad9b6f85ecd84aa250dd118bf8d0cf67e96

    SHA512

    badcfdd040e6da87f699b7dcddd129b6071745992181d8ba6b8d278539e86d87a889dc0ab27ccd79ec3d0885fd9c8443f510927279022ffe63f21bc946855e4d

  • C:\ProgramData\WindowsHolographicDevicesUSOShared-type3.5.6.2\WindowsHolographicDevicesUSOShared-type3.5.6.2.exe

    Filesize

    447.4MB

    MD5

    7678efc8a990bbc34cdb30c771198752

    SHA1

    11c0596a02a41ece299b02b3e74fa952b9c37330

    SHA256

    652217821911d5cb6f0966d0cf2154ff5f58c33aa2117e22e497458905853b7c

    SHA512

    b37d961abf4bd3e73af123582cb367dee50853ef61b60051b07d0108527139d056668ec279ac81a0db2c036bacaa48bab1afed2623138fac7e9ce6ce4b7518d1

  • memory/2100-160-0x00007FF705AF0000-0x00007FF70600F000-memory.dmp

    Filesize

    5.1MB

  • memory/2100-159-0x00007FF705AF0000-0x00007FF70600F000-memory.dmp

    Filesize

    5.1MB

  • memory/2100-157-0x00007FF705AF0000-0x00007FF70600F000-memory.dmp

    Filesize

    5.1MB

  • memory/4412-155-0x00007FF705AF0000-0x00007FF70600F000-memory.dmp

    Filesize

    5.1MB

  • memory/4412-153-0x00007FF705AF0000-0x00007FF70600F000-memory.dmp

    Filesize

    5.1MB

  • memory/4412-154-0x00007FF705AF0000-0x00007FF70600F000-memory.dmp

    Filesize

    5.1MB

  • memory/4472-145-0x0000000005850000-0x0000000005860000-memory.dmp

    Filesize

    64KB

  • memory/4472-144-0x0000000005850000-0x0000000005860000-memory.dmp

    Filesize

    64KB

  • memory/4472-143-0x0000000005850000-0x0000000005860000-memory.dmp

    Filesize

    64KB

  • memory/4472-134-0x0000000000D00000-0x000000000105C000-memory.dmp

    Filesize

    3.4MB

  • memory/4472-142-0x0000000005850000-0x0000000005860000-memory.dmp

    Filesize

    64KB

  • memory/4472-141-0x0000000005600000-0x000000000560A000-memory.dmp

    Filesize

    40KB

  • memory/4472-140-0x0000000005630000-0x00000000056C2000-memory.dmp

    Filesize

    584KB

  • memory/4472-139-0x0000000005C90000-0x0000000006234000-memory.dmp

    Filesize

    5.6MB