Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

04/05/2023, 21:16

230504-z4frlaha9y 3

04/05/2023, 20:53

230504-zpsgvafb66 3

04/05/2023, 20:38

230504-zew3aafa88 8

04/05/2023, 20:30

230504-y97ltsgg7x 3

Analysis

  • max time kernel
    259s
  • max time network
    263s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-de
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-delocale:de-deos:windows10-2004-x64systemwindows
  • submitted
    04/05/2023, 20:53

General

  • Target

    MossfieldOrigin.exe

  • Size

    33.1MB

  • MD5

    bb48e12db27082f17fbaf07fa1f11276

  • SHA1

    68b4b598a36f9325169a3a5b1c4e00d86dee3b6e

  • SHA256

    83e7c2cd30fbc3fbb7baa0b997d9fa5bf9ed075a510ba2382be7d6c44006273c

  • SHA512

    f2b37160c99d6512d10eb260759d731636f418bbdca936c317079963cc286fbf09da75724b5c05b25a937cfa24ddca47d8bf7068ee164ebc5f3590532eb4cd7c

  • SSDEEP

    393216:RVkZDbxDV08qbsvOaNpDBcDsxsbqFlUMFkEli4dqRYVHkFtOv9OBBuX6rYRAqs3s:RG/DpKtzIVm09tX6rYSnyQH1lQ

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\MossfieldOrigin.exe
    "C:\Users\Admin\AppData\Local\Temp\MossfieldOrigin.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1856
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "chcp"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1844
      • C:\Windows\system32\chcp.com
        chcp
        3⤵
          PID:2236
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1172
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -c " Add-Type -Name Window -Namespace Console -MemberDefinition ' [DllImport(\"Kernel32.dll\")] public static extern IntPtr GetConsoleWindow(); [DllImport(\"user32.dll\")] public static extern bool ShowWindow(IntPtr hWnd, Int32 nCmdShow); ' $consolePtr = [Console.Window]::GetConsoleWindow() #0 hide [Console.Window]::ShowWindow($consolePtr, 0) "
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1176
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
          "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\x1qw2cda\x1qw2cda.cmdline"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4568
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9DFA.tmp" "c:\Users\Admin\AppData\Local\Temp\x1qw2cda\CSC8A4574AB9BBF498B853FE43C29732CB.TMP"
            4⤵
              PID:3948
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3596
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2424
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "echo %COMPUTERNAME%.%USERDNSDOMAIN%"
          2⤵
            PID:3356
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
            2⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:2480
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
            2⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:1736
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
            2⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:4308
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /d /s /c "findstr /C:"Detected boot environment" "%windir%\Panther\setupact.log""
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:4480
            • C:\Windows\system32\findstr.exe
              findstr /C:"Detected boot environment" "C:\Windows\Panther\setupact.log"
              3⤵
                PID:4424
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
              2⤵
              • Suspicious behavior: EnumeratesProcesses
              PID:1064
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /v MachineGuid"
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:1380
              • C:\Windows\System32\reg.exe
                C:\Windows\System32\reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /v MachineGuid
                3⤵
                  PID:4532
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /d /s /c ""undefined\VBoxManage.exe" list vms --long"
                2⤵
                  PID:4672

              Network

              MITRE ATT&CK Matrix

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                Filesize

                2KB

                MD5

                2f57fde6b33e89a63cf0dfdd6e60a351

                SHA1

                445bf1b07223a04f8a159581a3d37d630273010f

                SHA256

                3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55

                SHA512

                42857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                Filesize

                2KB

                MD5

                2f87410b0d834a14ceff69e18946d066

                SHA1

                f2ec80550202d493db61806693439a57b76634f3

                SHA256

                5422bc17b852ad463110de0db9b59ffa4219e065d3e2843618d6ebbd14273c65

                SHA512

                a313702f22450ceff0a1d7f890b0c16cf667dbcd668dbafa6dbecd0791236c0bc68e834d12113cc75352365c2a2b6cfcf30b6ef7c97ea53ed135da50de389db4

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                Filesize

                2KB

                MD5

                4eb400925f6065f4a30605fa85e114c8

                SHA1

                20b9e82684e82e1e2e28fa4544829ea78fd03c1c

                SHA256

                1a548941fde07792cbe4ac9eab97f29a5f7cbc2e126f64368301dbaf9013af28

                SHA512

                a53758b74e6fc2ec5200eb9a88eef72e6d011d9ceff6e2cd27348270c06ee101a72ecb98a5467481d539952c21b53dfae8e93d9c3dbf05e2b0ce3eb1e0dd2387

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                Filesize

                2KB

                MD5

                910539cdc76a750d2c492e31fe8d484e

                SHA1

                29a156b0af48af213330ab7007306a7c4e48e058

                SHA256

                3a0224e78878215c0a42a3ee994d2c28460a2b26690c2422c51df07b655fbfc9

                SHA512

                d78c7cc654bfc9b510734e861516bd198545b34033d7986e9dfc87da6a796d92372a9522e1dea7d15a40bf2caaa1bf8eac90e07d7995a798a903104b77a984fb

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                Filesize

                2KB

                MD5

                c3a06929af71e23edaf1fa5ec6752698

                SHA1

                f4a37072442c4eb61b9f194a61b688fb7bc4a3e5

                SHA256

                4775dc65660d47c971c95f4ba1d4d606de7ff1d805a6b0fb985d2f7b75eec59d

                SHA512

                527d762aaf4053d20d1c1dadd8ca4822e530490d9422366e9587e9946bfd0ca90d324072dc94c9e3c0f68c65b78da4e7897de1257aba659a2295678595374adc

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                Filesize

                2KB

                MD5

                c3a06929af71e23edaf1fa5ec6752698

                SHA1

                f4a37072442c4eb61b9f194a61b688fb7bc4a3e5

                SHA256

                4775dc65660d47c971c95f4ba1d4d606de7ff1d805a6b0fb985d2f7b75eec59d

                SHA512

                527d762aaf4053d20d1c1dadd8ca4822e530490d9422366e9587e9946bfd0ca90d324072dc94c9e3c0f68c65b78da4e7897de1257aba659a2295678595374adc

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                Filesize

                2KB

                MD5

                c3a06929af71e23edaf1fa5ec6752698

                SHA1

                f4a37072442c4eb61b9f194a61b688fb7bc4a3e5

                SHA256

                4775dc65660d47c971c95f4ba1d4d606de7ff1d805a6b0fb985d2f7b75eec59d

                SHA512

                527d762aaf4053d20d1c1dadd8ca4822e530490d9422366e9587e9946bfd0ca90d324072dc94c9e3c0f68c65b78da4e7897de1257aba659a2295678595374adc

              • C:\Users\Admin\AppData\Local\Temp\RES9DFA.tmp

                Filesize

                1KB

                MD5

                0c83132f3b4428be9e9905fa12c762da

                SHA1

                d3346091e54e33fde5638d27d8f4a528027a16a0

                SHA256

                2b9b236c722f3c69a55dac09674e9b42a5e4c2fe31958c605334392f19c1f8e6

                SHA512

                64a7a310b673360786f76e33c3725b8d9a54a3a4388372731c7c335dc196842300f727de1191e362a65b66c0556a0fb0c35e60160bb7d2cd611412badcf9e3f4

              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5zxmxsgi.e5q.ps1

                Filesize

                60B

                MD5

                d17fe0a3f47be24a6453e9ef58c94641

                SHA1

                6ab83620379fc69f80c0242105ddffd7d98d5d9d

                SHA256

                96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                SHA512

                5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

              • C:\Users\Admin\AppData\Local\Temp\x1qw2cda\x1qw2cda.dll

                Filesize

                3KB

                MD5

                72c9885edc1e9b5b6c2645b684863854

                SHA1

                461f6d8acf525b55e7faa135ee1fa0c8e49da7ec

                SHA256

                28a18e63eae6a52b4b9b2eea12a7f8d31dda594eebc30158de0d96a24b47ef01

                SHA512

                a7add876e7c47c8012b076b5735401a4e34b483c866bff8dfe0ae4db79a9b78d3996d64842c163e1e94fe8427278f7cd50fb849e873c8f55a90ae1f8bb97b585

              • \??\c:\Users\Admin\AppData\Local\Temp\x1qw2cda\CSC8A4574AB9BBF498B853FE43C29732CB.TMP

                Filesize

                652B

                MD5

                e7123a10935b695d7c4e500383a7b898

                SHA1

                74a144cb71a0f2a2c8805feafa6c0971d047f6a6

                SHA256

                7a5a32524141e5740dc8b7c89e549d1f20e8a4f4c3503475835fcb47edcedf67

                SHA512

                a3a9bcada87e00909fdafb9f23de9b84c8a2bc7d61842d606b25913086976f95c255a34835f5fd5623a04da4688dd96d981f920b823caadbe25d7eac69084feb

              • \??\c:\Users\Admin\AppData\Local\Temp\x1qw2cda\x1qw2cda.0.cs

                Filesize

                312B

                MD5

                ecbf151f81ff98f7dff196304a40239e

                SHA1

                ccf6b97b6f8276656b042d64f0595963fe9ec79c

                SHA256

                295ca195631c485c876e7c468ddcbb3fe7cd219d3e5005a2441be2de54e62ac8

                SHA512

                4526a59055a18af6c0c13fb9f55a9a9bc15aa1407b697849e19b6cc32c88ee7206b3efff806bd154d36bce144ae1d9c407c6ea0f5077c54fbe92cd172c203720

              • \??\c:\Users\Admin\AppData\Local\Temp\x1qw2cda\x1qw2cda.cmdline

                Filesize

                369B

                MD5

                d5660155dd8670d54fad9ab4baad1e44

                SHA1

                e71b616f701cd61cebacb6cb102304c4e84d25e6

                SHA256

                ac1a5d0559a951c3881836e067272340594e24899c34f9bd2011a2857d10ff67

                SHA512

                27ee156adf9e1fce325057c578fa60653755c558ae596320e7cd511339600e21397003278070224c606c7a9350a6dc4e64cd1c4022412c93ba91e8f7e7be6ab2

              • memory/1064-289-0x000001F4A7350000-0x000001F4A7360000-memory.dmp

                Filesize

                64KB

              • memory/1172-168-0x0000029EBF9E0000-0x0000029EBF9F0000-memory.dmp

                Filesize

                64KB

              • memory/1172-167-0x0000029EBF9E0000-0x0000029EBF9F0000-memory.dmp

                Filesize

                64KB

              • memory/1172-159-0x0000029EC1140000-0x0000029EC1184000-memory.dmp

                Filesize

                272KB

              • memory/1172-166-0x0000029EBF9E0000-0x0000029EBF9F0000-memory.dmp

                Filesize

                64KB

              • memory/1172-185-0x0000029EC06D0000-0x0000029EC06FA000-memory.dmp

                Filesize

                168KB

              • memory/1172-186-0x0000029EC06D0000-0x0000029EC06F4000-memory.dmp

                Filesize

                144KB

              • memory/1172-187-0x0000029EC06C0000-0x0000029EC06D6000-memory.dmp

                Filesize

                88KB

              • memory/1172-188-0x0000029EC06A0000-0x0000029EC06A8000-memory.dmp

                Filesize

                32KB

              • memory/1172-137-0x0000029EC0700000-0x0000029EC0786000-memory.dmp

                Filesize

                536KB

              • memory/1172-160-0x0000029EC1210000-0x0000029EC1286000-memory.dmp

                Filesize

                472KB

              • memory/1172-147-0x0000029EC0670000-0x0000029EC0692000-memory.dmp

                Filesize

                136KB

              • memory/1172-148-0x0000029EA76B0000-0x0000029EA76C0000-memory.dmp

                Filesize

                64KB

              • memory/1172-149-0x0000029EC12A0000-0x0000029EC13A4000-memory.dmp

                Filesize

                1.0MB

              • memory/1176-169-0x0000020032260000-0x0000020032270000-memory.dmp

                Filesize

                64KB

              • memory/1176-170-0x0000020032260000-0x0000020032270000-memory.dmp

                Filesize

                64KB

              • memory/1176-173-0x0000020032260000-0x0000020032270000-memory.dmp

                Filesize

                64KB

              • memory/1736-263-0x000001D3D6400000-0x000001D3D6410000-memory.dmp

                Filesize

                64KB

              • memory/1736-259-0x000001D3D6400000-0x000001D3D6410000-memory.dmp

                Filesize

                64KB

              • memory/2424-221-0x0000024578990000-0x00000245789A0000-memory.dmp

                Filesize

                64KB

              • memory/2424-226-0x00000245794B0000-0x00000245796CC000-memory.dmp

                Filesize

                2.1MB

              • memory/2424-222-0x0000024578990000-0x00000245789A0000-memory.dmp

                Filesize

                64KB

              • memory/2424-220-0x0000024578990000-0x00000245789A0000-memory.dmp

                Filesize

                64KB

              • memory/2480-261-0x0000014A703C0000-0x0000014A703D0000-memory.dmp

                Filesize

                64KB

              • memory/2480-260-0x0000014A703C0000-0x0000014A703D0000-memory.dmp

                Filesize

                64KB

              • memory/3596-206-0x000001E804380000-0x000001E804390000-memory.dmp

                Filesize

                64KB

              • memory/3596-204-0x000001E804380000-0x000001E804390000-memory.dmp

                Filesize

                64KB

              • memory/3596-205-0x000001E804380000-0x000001E804390000-memory.dmp

                Filesize

                64KB

              • memory/4308-258-0x00000239B3820000-0x00000239B3830000-memory.dmp

                Filesize

                64KB

              • memory/4308-257-0x00000239B3820000-0x00000239B3830000-memory.dmp

                Filesize

                64KB

              • memory/4308-262-0x00000239B3820000-0x00000239B3830000-memory.dmp

                Filesize

                64KB