Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    135s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/06/2023, 15:22

General

  • Target

    update_dll.exe

  • Size

    1.6MB

  • MD5

    2ec19478c6e5f4ff9f373b275d1910c5

  • SHA1

    01112e3d156f802059575369d039a92f95bf9025

  • SHA256

    4e214aada010f0761062335b78a1bbddc879ca3bd696c7021bd3f5e8f5ab5e83

  • SHA512

    3ca2eec0dcaaedd548faa363e850855479ba045d68b4be7f70592ddeb3671daa10175b21579861b764440d1cbf02dc98fcc020c217801f71d4150c0699c13b2d

  • SSDEEP

    24576:y8Iog+CuyfdDCvi3c9FSgt4syKh8TVmRCE4kDXY1Ur3TfXK9QG0ILPp6MNvTxvwK:T6uyVex0c49KgVmWeMJXFVrJ3

Score
7/10
upx

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 4 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\update_dll.exe
    "C:\Users\Admin\AppData\Local\Temp\update_dll.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:3176
    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\p_update.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX0\p_update.exe" "shell" "update_dll.dll"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:2504
    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\p_update.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX0\p_update.exe" "shell" "update.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:2460

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\UpdateLog.log

    Filesize

    156B

    MD5

    ad58457f754ff037f6ed5b56f2edc292

    SHA1

    fcfbe7139368184246a04ba4d349a41b9724c7ea

    SHA256

    9c77e6aaf5157b7df9941505c7c47abf9147e14fd1660b34aaf8c24d81b8b9d7

    SHA512

    6f5029c5f9f806ad6cdb4e62435fd9a76853f429a6a1b240a13d89a7513eed3dbaee298901c93659c59f34113b4a96b24af221cd138da85043cb140b8495b264

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\UpdateLog.log

    Filesize

    156B

    MD5

    ad58457f754ff037f6ed5b56f2edc292

    SHA1

    fcfbe7139368184246a04ba4d349a41b9724c7ea

    SHA256

    9c77e6aaf5157b7df9941505c7c47abf9147e14fd1660b34aaf8c24d81b8b9d7

    SHA512

    6f5029c5f9f806ad6cdb4e62435fd9a76853f429a6a1b240a13d89a7513eed3dbaee298901c93659c59f34113b4a96b24af221cd138da85043cb140b8495b264

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\copy.dll

    Filesize

    1.0MB

    MD5

    f03d2e73d9f63bd3feb0d193da68577c

    SHA1

    2a4727aad2ae342498a1afb13fc2565152b8756c

    SHA256

    3995014823782fc301a8c837a24d407697343187c97ff11aebb402ad7b08d48b

    SHA512

    efbf81d84965bc4c01f03b97aef57712215721c84a6d3e7bc2e7204152acb8085c4526084235c7448b9bab526bf7345ff453d20e96b8b2aa5868b96770ee66dd

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\copy.dll

    Filesize

    1.0MB

    MD5

    f03d2e73d9f63bd3feb0d193da68577c

    SHA1

    2a4727aad2ae342498a1afb13fc2565152b8756c

    SHA256

    3995014823782fc301a8c837a24d407697343187c97ff11aebb402ad7b08d48b

    SHA512

    efbf81d84965bc4c01f03b97aef57712215721c84a6d3e7bc2e7204152acb8085c4526084235c7448b9bab526bf7345ff453d20e96b8b2aa5868b96770ee66dd

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\copy.dll

    Filesize

    1.0MB

    MD5

    f03d2e73d9f63bd3feb0d193da68577c

    SHA1

    2a4727aad2ae342498a1afb13fc2565152b8756c

    SHA256

    3995014823782fc301a8c837a24d407697343187c97ff11aebb402ad7b08d48b

    SHA512

    efbf81d84965bc4c01f03b97aef57712215721c84a6d3e7bc2e7204152acb8085c4526084235c7448b9bab526bf7345ff453d20e96b8b2aa5868b96770ee66dd

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\copy.dll

    Filesize

    1.0MB

    MD5

    f03d2e73d9f63bd3feb0d193da68577c

    SHA1

    2a4727aad2ae342498a1afb13fc2565152b8756c

    SHA256

    3995014823782fc301a8c837a24d407697343187c97ff11aebb402ad7b08d48b

    SHA512

    efbf81d84965bc4c01f03b97aef57712215721c84a6d3e7bc2e7204152acb8085c4526084235c7448b9bab526bf7345ff453d20e96b8b2aa5868b96770ee66dd

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\copy.dll

    Filesize

    1.0MB

    MD5

    f03d2e73d9f63bd3feb0d193da68577c

    SHA1

    2a4727aad2ae342498a1afb13fc2565152b8756c

    SHA256

    3995014823782fc301a8c837a24d407697343187c97ff11aebb402ad7b08d48b

    SHA512

    efbf81d84965bc4c01f03b97aef57712215721c84a6d3e7bc2e7204152acb8085c4526084235c7448b9bab526bf7345ff453d20e96b8b2aa5868b96770ee66dd

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\p_update.exe

    Filesize

    582KB

    MD5

    4d01a17f0cf89fcfc80406728717548a

    SHA1

    370fde5d6de249e174f1c90acfc4cdfd621005c3

    SHA256

    06af5d8ad366df7abf725bb5b0e78c7731aa74e3594620984c415db6dbda8431

    SHA512

    ffe1b9cd356c21e6d98d6b1ecd76261dda07f935d84efb0de6d8a18269c004d530697054216c2354492203c8ef1aa0bd3bba013ced3c009ea9950ce8b3260adb

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\p_update.exe

    Filesize

    582KB

    MD5

    4d01a17f0cf89fcfc80406728717548a

    SHA1

    370fde5d6de249e174f1c90acfc4cdfd621005c3

    SHA256

    06af5d8ad366df7abf725bb5b0e78c7731aa74e3594620984c415db6dbda8431

    SHA512

    ffe1b9cd356c21e6d98d6b1ecd76261dda07f935d84efb0de6d8a18269c004d530697054216c2354492203c8ef1aa0bd3bba013ced3c009ea9950ce8b3260adb

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\p_update.exe

    Filesize

    582KB

    MD5

    4d01a17f0cf89fcfc80406728717548a

    SHA1

    370fde5d6de249e174f1c90acfc4cdfd621005c3

    SHA256

    06af5d8ad366df7abf725bb5b0e78c7731aa74e3594620984c415db6dbda8431

    SHA512

    ffe1b9cd356c21e6d98d6b1ecd76261dda07f935d84efb0de6d8a18269c004d530697054216c2354492203c8ef1aa0bd3bba013ced3c009ea9950ce8b3260adb

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\p_update.exe

    Filesize

    582KB

    MD5

    4d01a17f0cf89fcfc80406728717548a

    SHA1

    370fde5d6de249e174f1c90acfc4cdfd621005c3

    SHA256

    06af5d8ad366df7abf725bb5b0e78c7731aa74e3594620984c415db6dbda8431

    SHA512

    ffe1b9cd356c21e6d98d6b1ecd76261dda07f935d84efb0de6d8a18269c004d530697054216c2354492203c8ef1aa0bd3bba013ced3c009ea9950ce8b3260adb

  • memory/2460-161-0x0000000002540000-0x000000000264D000-memory.dmp

    Filesize

    1.1MB

  • memory/2460-164-0x0000000000550000-0x0000000000551000-memory.dmp

    Filesize

    4KB

  • memory/2460-165-0x0000000000400000-0x000000000049C000-memory.dmp

    Filesize

    624KB

  • memory/2460-166-0x0000000002540000-0x000000000264D000-memory.dmp

    Filesize

    1.1MB

  • memory/2504-156-0x0000000000400000-0x000000000049C000-memory.dmp

    Filesize

    624KB

  • memory/2504-157-0x0000000002500000-0x000000000260D000-memory.dmp

    Filesize

    1.1MB

  • memory/2504-152-0x0000000002500000-0x000000000260D000-memory.dmp

    Filesize

    1.1MB

  • memory/2504-154-0x0000000002320000-0x0000000002321000-memory.dmp

    Filesize

    4KB

  • memory/3176-133-0x0000000000400000-0x0000000000422000-memory.dmp

    Filesize

    136KB

  • memory/3176-155-0x0000000000400000-0x0000000000422000-memory.dmp

    Filesize

    136KB

  • memory/3176-170-0x0000000000400000-0x0000000000422000-memory.dmp

    Filesize

    136KB