Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    152s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/05/2023, 18:46

General

  • Target

    Best Instagram Bot 4.1/Setup.exe

  • Size

    146KB

  • MD5

    cd91dde96c3573347980bd0229c33bbe

  • SHA1

    584b76e8a2e1defffc5767dd784999e7cdaf95ef

  • SHA256

    afd7e5c6e6c32872c1d4a317758387ae70d725e9e2687f919e67f3a639b93545

  • SHA512

    e92b964e2df99022d7a4dec5bda20bdfcf2da5352800e632f8ae5eab6f717b660f8fff51398af4dd216a16d3d1f77c002e5e03be96382f056fce03a2bea565a2

  • SSDEEP

    1536:/X4lcePuVXdLXrnu2lAK/8n7cJCrHj899WZoZfKZKqK3YWPTnsxn0uIPE:/X4lc/LPlroHj8XWZ0fmK5IHxn8M

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 1 IoCs
  • Executes dropped EXE 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in Windows directory 9 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 21 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Best Instagram Bot 4.1\Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\Best Instagram Bot 4.1\Setup.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1792
    • C:\Users\Admin\AppData\Local\Temp\Best Instagram Bot 4.1\usersys\Launcher.exe
      "C:\Users\Admin\AppData\Local\Temp\Best Instagram Bot 4.1\usersys\Launcher.exe"
      2⤵
      • Drops startup file
      • Adds Run key to start application
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3996
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" add-mppreference -exclusionpath C:\Windows\IMF\
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4412
      • C:\Windows\IMF\Windows Services.exe
        "C:\Windows\IMF\Windows Services.exe" {Arguments If Needed}
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3908
        • C:\Windows\IMF\Secure System Shell.exe
          "C:\Windows\IMF\Secure System Shell.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1564
        • C:\Windows\IMF\Runtime Explorer.exe
          "C:\Windows\IMF\Runtime Explorer.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:1404
    • C:\Users\Admin\AppData\Local\Temp\Best Instagram Bot 4.1\usersys\st.exe
      "C:\Users\Admin\AppData\Local\Temp\Best Instagram Bot 4.1\usersys\st.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3508
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
        3⤵
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        PID:772

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tjfotpjc.kno.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • C:\Windows\IMF\Runtime Explorer.exe

    Filesize

    148KB

    MD5

    aa402d82969674f670c6c8cf68065220

    SHA1

    f700419a2444523937d1dcb1c5f611facce0769f

    SHA256

    0e95a478fa8e5d837aefb08d57760c5154273777804ba1fc9cefc06f6c746b03

    SHA512

    26e2857d3489a43ee8044c43ef9c736b52b4f389d5057c561b740fb5e0d26ba9031ef8321c20607d55b9234a03f652bfd3a2f374771607648eb9935f644d8d44

  • C:\Windows\IMF\Runtime Explorer.exe

    Filesize

    148KB

    MD5

    aa402d82969674f670c6c8cf68065220

    SHA1

    f700419a2444523937d1dcb1c5f611facce0769f

    SHA256

    0e95a478fa8e5d837aefb08d57760c5154273777804ba1fc9cefc06f6c746b03

    SHA512

    26e2857d3489a43ee8044c43ef9c736b52b4f389d5057c561b740fb5e0d26ba9031ef8321c20607d55b9234a03f652bfd3a2f374771607648eb9935f644d8d44

  • C:\Windows\IMF\Runtime Explorer.exe

    Filesize

    148KB

    MD5

    aa402d82969674f670c6c8cf68065220

    SHA1

    f700419a2444523937d1dcb1c5f611facce0769f

    SHA256

    0e95a478fa8e5d837aefb08d57760c5154273777804ba1fc9cefc06f6c746b03

    SHA512

    26e2857d3489a43ee8044c43ef9c736b52b4f389d5057c561b740fb5e0d26ba9031ef8321c20607d55b9234a03f652bfd3a2f374771607648eb9935f644d8d44

  • C:\Windows\IMF\Secure System Shell.exe

    Filesize

    45KB

    MD5

    7d0c7359e5b2daa5665d01afdc98cc00

    SHA1

    c3cc830c8ffd0f53f28d89dcd9f3426be87085cb

    SHA256

    f1abd5ab03189e82971513e6ca04bd372fcf234d670079888f01cf4addd49809

    SHA512

    a8f82b11b045d8dd744506f4f56f3382b33a03684a6aebc91a02ea901c101b91cb43b7d0213f72f39cbb22f616ecd5de8b9e6c99fb5669f26a3ea6bcb63c8407

  • C:\Windows\IMF\Secure System Shell.exe

    Filesize

    45KB

    MD5

    7d0c7359e5b2daa5665d01afdc98cc00

    SHA1

    c3cc830c8ffd0f53f28d89dcd9f3426be87085cb

    SHA256

    f1abd5ab03189e82971513e6ca04bd372fcf234d670079888f01cf4addd49809

    SHA512

    a8f82b11b045d8dd744506f4f56f3382b33a03684a6aebc91a02ea901c101b91cb43b7d0213f72f39cbb22f616ecd5de8b9e6c99fb5669f26a3ea6bcb63c8407

  • C:\Windows\IMF\Secure System Shell.exe

    Filesize

    45KB

    MD5

    7d0c7359e5b2daa5665d01afdc98cc00

    SHA1

    c3cc830c8ffd0f53f28d89dcd9f3426be87085cb

    SHA256

    f1abd5ab03189e82971513e6ca04bd372fcf234d670079888f01cf4addd49809

    SHA512

    a8f82b11b045d8dd744506f4f56f3382b33a03684a6aebc91a02ea901c101b91cb43b7d0213f72f39cbb22f616ecd5de8b9e6c99fb5669f26a3ea6bcb63c8407

  • C:\Windows\IMF\Windows Services.exe

    Filesize

    46KB

    MD5

    ad0ce1302147fbdfecaec58480eb9cf9

    SHA1

    874efbc76e5f91bc1425a43ea19400340f98d42b

    SHA256

    2c339b52b82e73b4698a0110cdfe310c00c5c69078e9e1bd6fa1308652bf82a3

    SHA512

    adccd5520e01b673c2fc5c451305fe31b1a3e74891aece558f75fefc50218adf1fb81bb8c7f19969929d3fecb0fdb2cb5b564400d51e0a5a1ad8d5bc2d4eed53

  • C:\Windows\IMF\Windows Services.exe

    Filesize

    46KB

    MD5

    ad0ce1302147fbdfecaec58480eb9cf9

    SHA1

    874efbc76e5f91bc1425a43ea19400340f98d42b

    SHA256

    2c339b52b82e73b4698a0110cdfe310c00c5c69078e9e1bd6fa1308652bf82a3

    SHA512

    adccd5520e01b673c2fc5c451305fe31b1a3e74891aece558f75fefc50218adf1fb81bb8c7f19969929d3fecb0fdb2cb5b564400d51e0a5a1ad8d5bc2d4eed53

  • C:\Windows\IMF\Windows Services.exe

    Filesize

    46KB

    MD5

    ad0ce1302147fbdfecaec58480eb9cf9

    SHA1

    874efbc76e5f91bc1425a43ea19400340f98d42b

    SHA256

    2c339b52b82e73b4698a0110cdfe310c00c5c69078e9e1bd6fa1308652bf82a3

    SHA512

    adccd5520e01b673c2fc5c451305fe31b1a3e74891aece558f75fefc50218adf1fb81bb8c7f19969929d3fecb0fdb2cb5b564400d51e0a5a1ad8d5bc2d4eed53

  • memory/772-244-0x00000293F1C40000-0x00000293F1C50000-memory.dmp

    Filesize

    64KB

  • memory/772-245-0x00000293F1C40000-0x00000293F1C50000-memory.dmp

    Filesize

    64KB

  • memory/772-146-0x00000293F1900000-0x00000293F1A86000-memory.dmp

    Filesize

    1.5MB

  • memory/772-180-0x00000293F1C40000-0x00000293F1C50000-memory.dmp

    Filesize

    64KB

  • memory/772-145-0x00000293EF370000-0x00000293EF378000-memory.dmp

    Filesize

    32KB

  • memory/772-153-0x00000293F1C40000-0x00000293F1C50000-memory.dmp

    Filesize

    64KB

  • memory/772-155-0x00000293F1B80000-0x00000293F1BD0000-memory.dmp

    Filesize

    320KB

  • memory/1564-216-0x0000000000B10000-0x0000000000B22000-memory.dmp

    Filesize

    72KB

  • memory/1564-247-0x0000000005470000-0x0000000005480000-memory.dmp

    Filesize

    64KB

  • memory/1564-232-0x0000000005470000-0x0000000005480000-memory.dmp

    Filesize

    64KB

  • memory/1792-137-0x0000000005770000-0x000000000577A000-memory.dmp

    Filesize

    40KB

  • memory/1792-136-0x00000000057F0000-0x0000000005882000-memory.dmp

    Filesize

    584KB

  • memory/1792-134-0x00000000056B0000-0x000000000574C000-memory.dmp

    Filesize

    624KB

  • memory/1792-135-0x0000000005D00000-0x00000000062A4000-memory.dmp

    Filesize

    5.6MB

  • memory/1792-139-0x00000000057C0000-0x00000000057D0000-memory.dmp

    Filesize

    64KB

  • memory/1792-138-0x0000000005A40000-0x0000000005A96000-memory.dmp

    Filesize

    344KB

  • memory/1792-133-0x0000000000E30000-0x0000000000E5A000-memory.dmp

    Filesize

    168KB

  • memory/3908-246-0x0000000005730000-0x0000000005740000-memory.dmp

    Filesize

    64KB

  • memory/3908-211-0x0000000005730000-0x0000000005740000-memory.dmp

    Filesize

    64KB

  • memory/3908-210-0x0000000000DE0000-0x0000000000DF2000-memory.dmp

    Filesize

    72KB

  • memory/3996-140-0x00000000007F0000-0x0000000000804000-memory.dmp

    Filesize

    80KB

  • memory/3996-144-0x00000000050E0000-0x00000000050F0000-memory.dmp

    Filesize

    64KB

  • memory/3996-195-0x0000000006F50000-0x0000000006F6E000-memory.dmp

    Filesize

    120KB

  • memory/3996-194-0x0000000006F70000-0x0000000006FE6000-memory.dmp

    Filesize

    472KB

  • memory/3996-142-0x00000000066F0000-0x000000000676E000-memory.dmp

    Filesize

    504KB

  • memory/3996-141-0x00000000050E0000-0x00000000050F0000-memory.dmp

    Filesize

    64KB

  • memory/4412-147-0x0000000004E80000-0x0000000004EB6000-memory.dmp

    Filesize

    216KB

  • memory/4412-212-0x0000000004F80000-0x0000000004F90000-memory.dmp

    Filesize

    64KB

  • memory/4412-171-0x0000000006420000-0x000000000643E000-memory.dmp

    Filesize

    120KB

  • memory/4412-158-0x0000000005DD0000-0x0000000005E36000-memory.dmp

    Filesize

    408KB

  • memory/4412-220-0x00000000069E0000-0x0000000006A12000-memory.dmp

    Filesize

    200KB

  • memory/4412-221-0x0000000074D40000-0x0000000074D8C000-memory.dmp

    Filesize

    304KB

  • memory/4412-231-0x00000000069B0000-0x00000000069CE000-memory.dmp

    Filesize

    120KB

  • memory/4412-157-0x0000000004F80000-0x0000000004F90000-memory.dmp

    Filesize

    64KB

  • memory/4412-233-0x000000007F350000-0x000000007F360000-memory.dmp

    Filesize

    64KB

  • memory/4412-234-0x0000000007D60000-0x00000000083DA000-memory.dmp

    Filesize

    6.5MB

  • memory/4412-235-0x0000000007720000-0x000000000773A000-memory.dmp

    Filesize

    104KB

  • memory/4412-237-0x0000000007790000-0x000000000779A000-memory.dmp

    Filesize

    40KB

  • memory/4412-238-0x00000000079A0000-0x0000000007A36000-memory.dmp

    Filesize

    600KB

  • memory/4412-239-0x0000000007950000-0x000000000795E000-memory.dmp

    Filesize

    56KB

  • memory/4412-240-0x0000000007A60000-0x0000000007A7A000-memory.dmp

    Filesize

    104KB

  • memory/4412-241-0x0000000007A40000-0x0000000007A48000-memory.dmp

    Filesize

    32KB

  • memory/4412-156-0x0000000004F80000-0x0000000004F90000-memory.dmp

    Filesize

    64KB

  • memory/4412-154-0x0000000005D60000-0x0000000005DC6000-memory.dmp

    Filesize

    408KB

  • memory/4412-152-0x0000000005440000-0x0000000005462000-memory.dmp

    Filesize

    136KB

  • memory/4412-149-0x00000000055C0000-0x0000000005BE8000-memory.dmp

    Filesize

    6.2MB