Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

7

9285f051f3...32.exe

windows7-x64

8

9285f051f3...32.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    146s
  • max time network
    119s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230621-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/06/2023, 20:29

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    9285f051f34a6709c1255f8d243b474161074a4377120bb158c82e6c8e1ceb32.exe

  • Size

    174KB

  • MD5

    699f5196060a3124f55918b8f3d40227

  • SHA1

    775003cbb94339986e7a43afef3b8dffce714546

  • SHA256

    9285f051f34a6709c1255f8d243b474161074a4377120bb158c82e6c8e1ceb32

  • SHA512

    4b748eee1f430f6d9185a977e8361fa2e788b7ba844a2b02018b2e9d34649f11b05b9204a6d9e77341be57f9e33c4a9bec830bbd849f24b6e2a08c73e7f4a18c

  • SSDEEP

    3072:CYOoXSH2e5kqL7RJsgQKxF//tUPzsFst3rJ/g/9J5B+oQc5O1/EY7:CYfSr5khgQKD//C4FS3dg/XD+RTxE

Score
8/10
discoverypersistence

Malware Config

Signatures

  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks SCSI registry key(s) 3 TTPs 58 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies registry class 36 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 60 IoCs
  • Suspicious use of FindShellTrayWindow 53 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\9285f051f34a6709c1255f8d243b474161074a4377120bb158c82e6c8e1ceb32.exe
    "C:\Users\Admin\AppData\Local\Temp\9285f051f34a6709c1255f8d243b474161074a4377120bb158c82e6c8e1ceb32.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2728
    • C:\Windows\SysWOW64\regsvr32.exe
      regsvr32 /u /s "C:\Users\seewo\AppData\Local\YunPan\Bin\x64\YuWangExt.dll"
      2⤵
        PID:3284
      • C:\Windows\explorer.exe
        "C:\Windows\explorer.exe"
        2⤵
        • Modifies Installed Components in the registry
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        PID:1680
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:3088
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:1888

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{9053766B-1DA2-14CF-1B83-21855938BB42}
      Filesize

      36KB

      MD5

      8aaad0f4eb7d3c65f81c6e6b496ba889

      SHA1

      231237a501b9433c292991e4ec200b25c1589050

      SHA256

      813c66ce7dec4cff9c55fb6f809eab909421e37f69ff30e4acaa502365a32bd1

      SHA512

      1a83ce732dc47853bf6e8f4249054f41b0dea8505cda73433b37dfa16114f27bfed3b4b3ba580aa9d53c3dcc8d48bf571a45f7c0468e6a0f2a227a7e59e17d62

      Download Submit

    • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Windows_Explorer
      Filesize

      36KB

      MD5

      ab0262f72142aab53d5402e6d0cb5d24

      SHA1

      eaf95bb31ae1d4c0010f50e789bdc8b8e3116116

      SHA256

      20a108577209b2499cfdba77645477dd0d9771a77d42a53c6315156761efcfbb

      SHA512

      bf9580f3e5d1102cf758503e18a2cf98c799c4a252eedf9344f7c5626da3a1cf141353f01601a3b549234cc3f2978ad31f928068395b56f9f0885c07dbe81da1

      Download Submit

    • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133326305831159488.txt
      Filesize

      75KB

      MD5

      45b9fe0c8a715a7e5d787e28d63dfb31

      SHA1

      a10a98a8553958ab2f71f337a89d97daf69af8f0

      SHA256

      b643029e19de2599a5aa951c6dc6b300684d6c1410ae5639fab0b9683fb0480f

      SHA512

      240e899f9fbb71007c0814ea66c824a383c549a97662688945a63406c54631b86ae5b9c9b6271d2bd1c6909bb8ad04d74fa354250b7b540621fc75712415a03a

      Download Submit

    • memory/1680-145-0x00000000044F0000-0x00000000044F1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/1888-152-0x0000013D960D0000-0x0000013D960F0000-memory.dmp

      Filesize

      128KB

      Download

    • memory/1888-154-0x0000013D96090000-0x0000013D960B0000-memory.dmp

      Filesize

      128KB

      Download

    • memory/1888-158-0x0000013D966A0000-0x0000013D966C0000-memory.dmp

      Filesize

      128KB

      Download

    • memory/2728-137-0x00000000010B0000-0x00000000010B1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2728-133-0x0000000000AC0000-0x0000000000B28000-memory.dmp

      Filesize

      416KB

      Download

    • memory/2728-136-0x0000000000AC0000-0x0000000000B28000-memory.dmp

      Filesize

      416KB

      Download

    • memory/2728-272-0x0000000000AC0000-0x0000000000B28000-memory.dmp

      Filesize

      416KB

      Download

    • memory/2728-135-0x0000000000AC0000-0x0000000000B28000-memory.dmp

      Filesize

      416KB

      Download

    • memory/2728-134-0x0000000000AC0000-0x0000000000B28000-memory.dmp

      Filesize

      416KB

      Download