Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230621-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/06/2023, 01:19

General

  • Target

    2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88.exe

  • Size

    8.2MB

  • MD5

    49821681a577c7aa118eca3400d71d53

  • SHA1

    e96ae5a5f90e3a4622b64e91d374bbbd102165d3

  • SHA256

    2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88

  • SHA512

    5985f9fe71814ebf41786ddb3c4d7a37cc31e79d81aab0d8008ab701325c404c1316a78eb96ace3f2be4394f3c4eed7249e1d54b526b1d8f6e84f00a18ef0002

  • SSDEEP

    196608:ihTb9B0BPrDz4pxgZZPy5RmStgxb/z6FDiSJXqeUh4mT:MTb9epDz4MZZ4RmxYDiScfhH

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88.exe
    "C:\Users\Admin\AppData\Local\Temp\2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88.exe"
    1⤵
    • Checks computer location settings
    • Drops startup file
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1512
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88.exe'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3440
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88.exe'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2500
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88.exe'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4760
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88" /tr "C:\Users\Admin\AppData\Roaming\2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88.exe"
      2⤵
      • Creates scheduled task(s)
      PID:680
  • C:\Users\Admin\AppData\Roaming\2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88.exe
    C:\Users\Admin\AppData\Roaming\2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:4148
  • C:\Users\Admin\AppData\Roaming\2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88.exe
    C:\Users\Admin\AppData\Roaming\2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88.exe
    1⤵
    • Executes dropped EXE
    PID:3428

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88.exe.log

    Filesize

    1KB

    MD5

    a9361ad30054d2f7665453449a9f03bf

    SHA1

    247f441df6e20cd1c128f017948d76e1bd21577a

    SHA256

    f85751be66e3fb20f9d61debb89a0e0d3e73e8d690b78f36b9877b9b8d5635c8

    SHA512

    24e171e8a44053f0579fac9cd418fcde158b21c1ee471fd75e30c90a269508a33c08b775b4ffd01363e07199fca26577667a92f38838051051e311febb98b53f

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

    Filesize

    2KB

    MD5

    968cb9309758126772781b83adb8a28f

    SHA1

    8da30e71accf186b2ba11da1797cf67f8f78b47c

    SHA256

    92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

    SHA512

    4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    18KB

    MD5

    1a63f2f51f6d662b5d9b83f8beb6ec22

    SHA1

    bdebcc8c56fd5d9ed3d84ca4cb3cce57aaa4cdc9

    SHA256

    da29d7cfa1eb5a97999243ccc6f35ce4de0ac70666c34f058cecfc25142180af

    SHA512

    55fac79e68cd367c6e6ab3a86a33c014b56ab7d26212d21ae24ff39e00076924fc5ab8e672cd202e91e671e6769445275810baec451cb89c7d6e0227adce77b0

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    18KB

    MD5

    80ddfffa32e4984a7f4fd257a412d572

    SHA1

    fa2dc15c8ca349e4dd4b60b871544ab627bed912

    SHA256

    ee48952638584bb64fbceebebf669f336ff3d6fc338f7a25bd9f23fa08ec0eda

    SHA512

    e8d89b577c81c23d26c45ff2a2c5122587053ef60a2ffda818d0cef8cdeda2233c969b83d4a867805242d422d8163103c742f437f72de3fee69c38c11d3322fa

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ciceukv5.zab.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • C:\Users\Admin\AppData\Roaming\2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88.exe

    Filesize

    8.2MB

    MD5

    49821681a577c7aa118eca3400d71d53

    SHA1

    e96ae5a5f90e3a4622b64e91d374bbbd102165d3

    SHA256

    2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88

    SHA512

    5985f9fe71814ebf41786ddb3c4d7a37cc31e79d81aab0d8008ab701325c404c1316a78eb96ace3f2be4394f3c4eed7249e1d54b526b1d8f6e84f00a18ef0002

  • C:\Users\Admin\AppData\Roaming\2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88.exe

    Filesize

    8.2MB

    MD5

    49821681a577c7aa118eca3400d71d53

    SHA1

    e96ae5a5f90e3a4622b64e91d374bbbd102165d3

    SHA256

    2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88

    SHA512

    5985f9fe71814ebf41786ddb3c4d7a37cc31e79d81aab0d8008ab701325c404c1316a78eb96ace3f2be4394f3c4eed7249e1d54b526b1d8f6e84f00a18ef0002

  • C:\Users\Admin\AppData\Roaming\2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88.exe

    Filesize

    8.2MB

    MD5

    49821681a577c7aa118eca3400d71d53

    SHA1

    e96ae5a5f90e3a4622b64e91d374bbbd102165d3

    SHA256

    2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88

    SHA512

    5985f9fe71814ebf41786ddb3c4d7a37cc31e79d81aab0d8008ab701325c404c1316a78eb96ace3f2be4394f3c4eed7249e1d54b526b1d8f6e84f00a18ef0002

  • C:\Users\Admin\AppData\Roaming\2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88.exe

    Filesize

    8.2MB

    MD5

    49821681a577c7aa118eca3400d71d53

    SHA1

    e96ae5a5f90e3a4622b64e91d374bbbd102165d3

    SHA256

    2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88

    SHA512

    5985f9fe71814ebf41786ddb3c4d7a37cc31e79d81aab0d8008ab701325c404c1316a78eb96ace3f2be4394f3c4eed7249e1d54b526b1d8f6e84f00a18ef0002

  • memory/1512-140-0x0000000009B70000-0x0000000009B8E000-memory.dmp

    Filesize

    120KB

  • memory/1512-242-0x000000000D860000-0x000000000DE04000-memory.dmp

    Filesize

    5.6MB

  • memory/1512-142-0x0000000005990000-0x00000000059A0000-memory.dmp

    Filesize

    64KB

  • memory/1512-141-0x000000000A020000-0x000000000A0BC000-memory.dmp

    Filesize

    624KB

  • memory/1512-139-0x0000000008DD0000-0x0000000008DD8000-memory.dmp

    Filesize

    32KB

  • memory/1512-138-0x0000000008B90000-0x0000000008B98000-memory.dmp

    Filesize

    32KB

  • memory/1512-137-0x00000000072F0000-0x0000000007366000-memory.dmp

    Filesize

    472KB

  • memory/1512-244-0x000000000D2F0000-0x000000000D2FA000-memory.dmp

    Filesize

    40KB

  • memory/1512-243-0x000000000D350000-0x000000000D3E2000-memory.dmp

    Filesize

    584KB

  • memory/1512-143-0x000000000A0C0000-0x000000000A126000-memory.dmp

    Filesize

    408KB

  • memory/1512-136-0x0000000003450000-0x0000000003458000-memory.dmp

    Filesize

    32KB

  • memory/1512-135-0x0000000005AC0000-0x0000000005ADA000-memory.dmp

    Filesize

    104KB

  • memory/1512-134-0x0000000005990000-0x00000000059A0000-memory.dmp

    Filesize

    64KB

  • memory/1512-133-0x00000000008E0000-0x0000000001126000-memory.dmp

    Filesize

    8.3MB

  • memory/2500-196-0x0000000002880000-0x0000000002890000-memory.dmp

    Filesize

    64KB

  • memory/2500-195-0x0000000002880000-0x0000000002890000-memory.dmp

    Filesize

    64KB

  • memory/2500-194-0x0000000002880000-0x0000000002890000-memory.dmp

    Filesize

    64KB

  • memory/2500-197-0x000000006FEC0000-0x000000006FF0C000-memory.dmp

    Filesize

    304KB

  • memory/2500-207-0x000000007F7C0000-0x000000007F7D0000-memory.dmp

    Filesize

    64KB

  • memory/3440-176-0x0000000007270000-0x000000000727A000-memory.dmp

    Filesize

    40KB

  • memory/3440-157-0x0000000004A10000-0x0000000004A20000-memory.dmp

    Filesize

    64KB

  • memory/3440-180-0x0000000007520000-0x0000000007528000-memory.dmp

    Filesize

    32KB

  • memory/3440-178-0x0000000007430000-0x000000000743E000-memory.dmp

    Filesize

    56KB

  • memory/3440-177-0x0000000007480000-0x0000000007516000-memory.dmp

    Filesize

    600KB

  • memory/3440-175-0x0000000007200000-0x000000000721A000-memory.dmp

    Filesize

    104KB

  • memory/3440-174-0x000000007F240000-0x000000007F250000-memory.dmp

    Filesize

    64KB

  • memory/3440-173-0x0000000007840000-0x0000000007EBA000-memory.dmp

    Filesize

    6.5MB

  • memory/3440-172-0x00000000064B0000-0x00000000064CE000-memory.dmp

    Filesize

    120KB

  • memory/3440-162-0x000000006FEC0000-0x000000006FF0C000-memory.dmp

    Filesize

    304KB

  • memory/3440-144-0x00000000048A0000-0x00000000048D6000-memory.dmp

    Filesize

    216KB

  • memory/3440-145-0x0000000005050000-0x0000000005678000-memory.dmp

    Filesize

    6.2MB

  • memory/3440-161-0x0000000006EA0000-0x0000000006ED2000-memory.dmp

    Filesize

    200KB

  • memory/3440-146-0x0000000004FB0000-0x0000000004FD2000-memory.dmp

    Filesize

    136KB

  • memory/3440-147-0x0000000005680000-0x00000000056E6000-memory.dmp

    Filesize

    408KB

  • memory/3440-179-0x0000000007540000-0x000000000755A000-memory.dmp

    Filesize

    104KB

  • memory/3440-160-0x0000000004A10000-0x0000000004A20000-memory.dmp

    Filesize

    64KB

  • memory/3440-159-0x0000000005F00000-0x0000000005F1E000-memory.dmp

    Filesize

    120KB

  • memory/3440-158-0x0000000004A10000-0x0000000004A20000-memory.dmp

    Filesize

    64KB

  • memory/4148-248-0x0000000005170000-0x0000000005180000-memory.dmp

    Filesize

    64KB

  • memory/4760-232-0x000000007F250000-0x000000007F260000-memory.dmp

    Filesize

    64KB

  • memory/4760-231-0x00000000050A0000-0x00000000050B0000-memory.dmp

    Filesize

    64KB

  • memory/4760-221-0x000000006FEC0000-0x000000006FF0C000-memory.dmp

    Filesize

    304KB

  • memory/4760-219-0x00000000050A0000-0x00000000050B0000-memory.dmp

    Filesize

    64KB

  • memory/4760-218-0x00000000050A0000-0x00000000050B0000-memory.dmp

    Filesize

    64KB