Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    151s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/03/2023, 18:54

General

  • Target

    DHL Shipment Document.exe

  • Size

    2.0MB

  • MD5

    852ecbb34661097c525cc541fcc8f093

  • SHA1

    1bad774af30e8ebd3acbfd16d02446529a9018f9

  • SHA256

    70bc64f3d04300d8a41114c1676cca08abdd2d69ecf37e05ae38a8461f8bf5cc

  • SHA512

    90a043575f91285e89dc5782138664513d53141e373a8dd779c7116cbee5613b609eb6b02aacde4979e553518156fdd5c9408239ee22c527a395b5508b1412f4

  • SSDEEP

    24576:p1v1MN0slyRnfYSIZozmwF2ny/v/LtGZsYjot02EgwT83Zm+cobMvvyThQcYAwv1:p1v1MN0slyz/s59jmkS

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 56 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 13 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3128
    • C:\Users\Admin\AppData\Local\Temp\DHL Shipment Document.exe
      "C:\Users\Admin\AppData\Local\Temp\DHL Shipment Document.exe"
      2⤵
      • Checks computer location settings
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:2788
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4784
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        3⤵
        • Checks computer location settings
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:1436
    • C:\Windows\SysWOW64\netsh.exe
      "C:\Windows\SysWOW64\netsh.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Modifies Internet Explorer settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4732
      • C:\Program Files\Mozilla Firefox\Firefox.exe
        "C:\Program Files\Mozilla Firefox\Firefox.exe"
        3⤵
          PID:3096
          • C:\Windows\system32\WerFault.exe
            C:\Windows\system32\WerFault.exe -u -p 3096 -s 160
            4⤵
            • Program crash
            PID:4124
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -pss -s 476 -p 3096 -ip 3096
      1⤵
        PID:4152

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_b1tnfmf2.e5j.ps1

        Filesize

        60B

        MD5

        d17fe0a3f47be24a6453e9ef58c94641

        SHA1

        6ab83620379fc69f80c0242105ddffd7d98d5d9d

        SHA256

        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

        SHA512

        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

      • memory/1436-170-0x0000000000400000-0x000000000042F000-memory.dmp

        Filesize

        188KB

      • memory/1436-167-0x0000000001440000-0x0000000001450000-memory.dmp

        Filesize

        64KB

      • memory/1436-166-0x0000000003150000-0x000000000349A000-memory.dmp

        Filesize

        3.3MB

      • memory/1436-165-0x0000000000400000-0x000000000042F000-memory.dmp

        Filesize

        188KB

      • memory/1436-164-0x0000000000400000-0x000000000042F000-memory.dmp

        Filesize

        188KB

      • memory/1436-162-0x0000000000400000-0x000000000042F000-memory.dmp

        Filesize

        188KB

      • memory/2788-155-0x00000000033A0000-0x00000000033B0000-memory.dmp

        Filesize

        64KB

      • memory/2788-134-0x00000000033A0000-0x00000000033B0000-memory.dmp

        Filesize

        64KB

      • memory/2788-135-0x0000000006260000-0x0000000006282000-memory.dmp

        Filesize

        136KB

      • memory/2788-133-0x0000000000C80000-0x0000000000E88000-memory.dmp

        Filesize

        2.0MB

      • memory/3128-213-0x0000000002660000-0x0000000002670000-memory.dmp

        Filesize

        64KB

      • memory/3128-216-0x0000000002660000-0x0000000002670000-memory.dmp

        Filesize

        64KB

      • memory/3128-230-0x0000000000C80000-0x0000000000C8A000-memory.dmp

        Filesize

        40KB

      • memory/3128-229-0x0000000000C70000-0x0000000000C72000-memory.dmp

        Filesize

        8KB

      • memory/3128-228-0x0000000002660000-0x0000000002670000-memory.dmp

        Filesize

        64KB

      • memory/3128-227-0x0000000002660000-0x0000000002670000-memory.dmp

        Filesize

        64KB

      • memory/3128-226-0x0000000002660000-0x0000000002670000-memory.dmp

        Filesize

        64KB

      • memory/3128-225-0x0000000002660000-0x0000000002670000-memory.dmp

        Filesize

        64KB

      • memory/3128-224-0x0000000002660000-0x0000000002670000-memory.dmp

        Filesize

        64KB

      • memory/3128-223-0x0000000002660000-0x0000000002670000-memory.dmp

        Filesize

        64KB

      • memory/3128-222-0x0000000002660000-0x0000000002670000-memory.dmp

        Filesize

        64KB

      • memory/3128-168-0x00000000043E0000-0x00000000044B1000-memory.dmp

        Filesize

        836KB

      • memory/3128-221-0x0000000002660000-0x0000000002670000-memory.dmp

        Filesize

        64KB

      • memory/3128-220-0x0000000002660000-0x0000000002670000-memory.dmp

        Filesize

        64KB

      • memory/3128-219-0x0000000002660000-0x0000000002670000-memory.dmp

        Filesize

        64KB

      • memory/3128-217-0x0000000002660000-0x0000000002670000-memory.dmp

        Filesize

        64KB

      • memory/3128-218-0x0000000002660000-0x0000000002670000-memory.dmp

        Filesize

        64KB

      • memory/3128-215-0x0000000002660000-0x0000000002670000-memory.dmp

        Filesize

        64KB

      • memory/3128-214-0x0000000002660000-0x0000000002670000-memory.dmp

        Filesize

        64KB

      • memory/3128-207-0x0000000008500000-0x00000000085CE000-memory.dmp

        Filesize

        824KB

      • memory/3128-177-0x0000000008500000-0x00000000085CE000-memory.dmp

        Filesize

        824KB

      • memory/3128-183-0x0000000008500000-0x00000000085CE000-memory.dmp

        Filesize

        824KB

      • memory/3128-189-0x0000000002660000-0x0000000002670000-memory.dmp

        Filesize

        64KB

      • memory/3128-190-0x0000000002660000-0x0000000002670000-memory.dmp

        Filesize

        64KB

      • memory/3128-191-0x0000000002660000-0x0000000002670000-memory.dmp

        Filesize

        64KB

      • memory/3128-192-0x0000000002660000-0x0000000002670000-memory.dmp

        Filesize

        64KB

      • memory/3128-193-0x0000000002660000-0x0000000002670000-memory.dmp

        Filesize

        64KB

      • memory/3128-194-0x0000000002660000-0x0000000002670000-memory.dmp

        Filesize

        64KB

      • memory/3128-195-0x0000000002660000-0x0000000002670000-memory.dmp

        Filesize

        64KB

      • memory/3128-196-0x0000000002660000-0x0000000002670000-memory.dmp

        Filesize

        64KB

      • memory/3128-197-0x0000000002660000-0x0000000002670000-memory.dmp

        Filesize

        64KB

      • memory/3128-198-0x0000000002660000-0x0000000002670000-memory.dmp

        Filesize

        64KB

      • memory/3128-199-0x0000000002660000-0x0000000002670000-memory.dmp

        Filesize

        64KB

      • memory/3128-200-0x0000000002660000-0x0000000002670000-memory.dmp

        Filesize

        64KB

      • memory/3128-201-0x0000000002660000-0x0000000002670000-memory.dmp

        Filesize

        64KB

      • memory/3128-202-0x0000000002660000-0x0000000002670000-memory.dmp

        Filesize

        64KB

      • memory/3128-203-0x0000000002660000-0x0000000002670000-memory.dmp

        Filesize

        64KB

      • memory/3128-204-0x0000000002660000-0x0000000002670000-memory.dmp

        Filesize

        64KB

      • memory/3128-205-0x0000000008500000-0x00000000085CE000-memory.dmp

        Filesize

        824KB

      • memory/4732-172-0x00000000009C0000-0x00000000009DE000-memory.dmp

        Filesize

        120KB

      • memory/4732-176-0x00000000011A0000-0x000000000122F000-memory.dmp

        Filesize

        572KB

      • memory/4732-174-0x0000000000860000-0x000000000088D000-memory.dmp

        Filesize

        180KB

      • memory/4732-175-0x0000000001370000-0x00000000016BA000-memory.dmp

        Filesize

        3.3MB

      • memory/4732-169-0x00000000009C0000-0x00000000009DE000-memory.dmp

        Filesize

        120KB

      • memory/4732-173-0x0000000000860000-0x000000000088D000-memory.dmp

        Filesize

        180KB

      • memory/4784-137-0x0000000005620000-0x0000000005C48000-memory.dmp

        Filesize

        6.2MB

      • memory/4784-153-0x0000000006A70000-0x0000000006A8A000-memory.dmp

        Filesize

        104KB

      • memory/4784-136-0x0000000004FB0000-0x0000000004FE6000-memory.dmp

        Filesize

        216KB

      • memory/4784-138-0x0000000005EB0000-0x0000000005F16000-memory.dmp

        Filesize

        408KB

      • memory/4784-144-0x0000000005F20000-0x0000000005F86000-memory.dmp

        Filesize

        408KB

      • memory/4784-149-0x0000000002C00000-0x0000000002C10000-memory.dmp

        Filesize

        64KB

      • memory/4784-150-0x0000000002C00000-0x0000000002C10000-memory.dmp

        Filesize

        64KB

      • memory/4784-151-0x0000000006570000-0x000000000658E000-memory.dmp

        Filesize

        120KB

      • memory/4784-158-0x0000000002C00000-0x0000000002C10000-memory.dmp

        Filesize

        64KB

      • memory/4784-157-0x0000000002C00000-0x0000000002C10000-memory.dmp

        Filesize

        64KB

      • memory/4784-156-0x0000000002C00000-0x0000000002C10000-memory.dmp

        Filesize

        64KB

      • memory/4784-152-0x0000000007BA0000-0x000000000821A000-memory.dmp

        Filesize

        6.5MB

      • memory/4784-154-0x0000000002C00000-0x0000000002C10000-memory.dmp

        Filesize

        64KB