Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    300s
  • max time network
    303s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    16/03/2023, 09:12

General

  • Target

    ACH_ deposit _receipt12901234.exe

  • Size

    817KB

  • MD5

    fd42e94e57c66c93fc0a93e514101070

  • SHA1

    3640481f0566252477aff1a98ec7ae9bb6051fed

  • SHA256

    92517d9eb76bab41956c0dddf8160db00210e20b07f1b76a573c193fe5d40bb2

  • SHA512

    f3a577ce8e2f715eebbe7cd69b015dee2d0129be83d4de742231adc226837a0ea7f95ffc989363146cddcafb435a9db24af864f1aca2fa6e35fa6c6eb7cc8d3a

  • SSDEEP

    12288:J2zAi64ekCyyIS1UKeO9fUu3fopFwOZYjJ9rup5no5m/NrGIk7/3SzkZalfyl15O:JyipOZ4JxASz68m0U

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Delays execution with timeout.exe 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 27 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\ACH_ deposit _receipt12901234.exe
    "C:\Users\Admin\AppData\Local\Temp\ACH_ deposit _receipt12901234.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2044
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"' & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1988
      • C:\Windows\system32\schtasks.exe
        schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"'
        3⤵
        • Creates scheduled task(s)
        PID:872
    • C:\Windows\system32\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp3C75.tmp.bat""
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:588
      • C:\Windows\system32\timeout.exe
        timeout 3
        3⤵
        • Delays execution with timeout.exe
        PID:564
      • C:\Users\Admin\AppData\Roaming\svchost.exe
        "C:\Users\Admin\AppData\Roaming\svchost.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1704
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe"
          4⤵
            PID:648
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe
            "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe"
            4⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:1760

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\tmp3C75.tmp.bat

      Filesize

      151B

      MD5

      93fe7152e1d2b6b74559fffe6f4a58ab

      SHA1

      42f7a37c25fcc7617900e7197702575067dbccca

      SHA256

      e1522c62134c6c0176558cc1249b1ae5c32007ff36444379cb3f9a2a25721c58

      SHA512

      aca30541e68ecb21ba37971cf655df10c7a98bb927a90fed357b0c9f26b3f8bec44bfc14729dca071e3a459aabc5d255b248a4f9e3fbf2888b110531ad6cc7df

    • C:\Users\Admin\AppData\Local\Temp\tmp3C75.tmp.bat

      Filesize

      151B

      MD5

      93fe7152e1d2b6b74559fffe6f4a58ab

      SHA1

      42f7a37c25fcc7617900e7197702575067dbccca

      SHA256

      e1522c62134c6c0176558cc1249b1ae5c32007ff36444379cb3f9a2a25721c58

      SHA512

      aca30541e68ecb21ba37971cf655df10c7a98bb927a90fed357b0c9f26b3f8bec44bfc14729dca071e3a459aabc5d255b248a4f9e3fbf2888b110531ad6cc7df

    • C:\Users\Admin\AppData\Roaming\svchost.exe

      Filesize

      817KB

      MD5

      fd42e94e57c66c93fc0a93e514101070

      SHA1

      3640481f0566252477aff1a98ec7ae9bb6051fed

      SHA256

      92517d9eb76bab41956c0dddf8160db00210e20b07f1b76a573c193fe5d40bb2

      SHA512

      f3a577ce8e2f715eebbe7cd69b015dee2d0129be83d4de742231adc226837a0ea7f95ffc989363146cddcafb435a9db24af864f1aca2fa6e35fa6c6eb7cc8d3a

    • C:\Users\Admin\AppData\Roaming\svchost.exe

      Filesize

      817KB

      MD5

      fd42e94e57c66c93fc0a93e514101070

      SHA1

      3640481f0566252477aff1a98ec7ae9bb6051fed

      SHA256

      92517d9eb76bab41956c0dddf8160db00210e20b07f1b76a573c193fe5d40bb2

      SHA512

      f3a577ce8e2f715eebbe7cd69b015dee2d0129be83d4de742231adc226837a0ea7f95ffc989363146cddcafb435a9db24af864f1aca2fa6e35fa6c6eb7cc8d3a

    • \Users\Admin\AppData\Roaming\svchost.exe

      Filesize

      817KB

      MD5

      fd42e94e57c66c93fc0a93e514101070

      SHA1

      3640481f0566252477aff1a98ec7ae9bb6051fed

      SHA256

      92517d9eb76bab41956c0dddf8160db00210e20b07f1b76a573c193fe5d40bb2

      SHA512

      f3a577ce8e2f715eebbe7cd69b015dee2d0129be83d4de742231adc226837a0ea7f95ffc989363146cddcafb435a9db24af864f1aca2fa6e35fa6c6eb7cc8d3a

    • memory/1704-70-0x00000000000C0000-0x0000000000190000-memory.dmp

      Filesize

      832KB

    • memory/1704-71-0x000000001AF80000-0x000000001B000000-memory.dmp

      Filesize

      512KB

    • memory/1760-72-0x0000000000400000-0x0000000000410000-memory.dmp

      Filesize

      64KB

    • memory/1760-74-0x0000000000400000-0x0000000000410000-memory.dmp

      Filesize

      64KB

    • memory/1760-76-0x0000000000400000-0x0000000000410000-memory.dmp

      Filesize

      64KB

    • memory/1760-77-0x0000000004AE0000-0x0000000004B20000-memory.dmp

      Filesize

      256KB

    • memory/1760-78-0x0000000004AE0000-0x0000000004B20000-memory.dmp

      Filesize

      256KB

    • memory/2044-56-0x000000001AE10000-0x000000001AE90000-memory.dmp

      Filesize

      512KB

    • memory/2044-55-0x0000000000620000-0x000000000066E000-memory.dmp

      Filesize

      312KB

    • memory/2044-54-0x00000000010F0000-0x00000000011C0000-memory.dmp

      Filesize

      832KB