Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    77s
  • max time network
    81s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/07/2023, 19:05

General

  • Target

    WinRAddRd.exe

  • Size

    669KB

  • MD5

    a5be759450ca107d0ae80a275b697c8a

  • SHA1

    0896ddf9cc0d6ab5a3e94d1509e5883592485e87

  • SHA256

    e7f4bae5fd7a15bd269b0460c395f9f3b0168a5012e47ceabd48748b5aec2411

  • SHA512

    7f85c07c04c9dac7f14a4a15d248976bc755a63141bc20adc0da378608458c59ddf7300e651b3cf5adc523f08668887f1558d039028af31a6a59e723932597dc

  • SSDEEP

    12288:jvJvdzf4U7b90FO9zafsx2zDK0e0HO0mI5jYxAuFHV2:DJVTjf90FO92fsiFe0HOgyxHb2

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Delays execution with timeout.exe 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 23 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\WinRAddRd.exe
    "C:\Users\Admin\AppData\Local\Temp\WinRAddRd.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5072
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "WinRAddRd" /tr '"C:\Users\Admin\AppData\Roaming\WinRAddRd.exe"' & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1268
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /f /sc onlogon /rl highest /tn "WinRAddRd" /tr '"C:\Users\Admin\AppData\Roaming\WinRAddRd.exe"'
        3⤵
        • Creates scheduled task(s)
        PID:4800
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpAC1E.tmp.bat""
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4704
      • C:\Windows\SysWOW64\timeout.exe
        timeout 3
        3⤵
        • Delays execution with timeout.exe
        PID:3292
      • C:\Users\Admin\AppData\Roaming\WinRAddRd.exe
        "C:\Users\Admin\AppData\Roaming\WinRAddRd.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious use of AdjustPrivilegeToken
        PID:3228

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\WinRAddRd.exe.log

    Filesize

    1KB

    MD5

    07967bd4c2a64c0682130e1ba7040bc6

    SHA1

    7526bfccff20563ad0b83df1efed65f6443af2bc

    SHA256

    4989255ecb2159d09433043d875c3c28b74bd7de9f3589c6fe6b8ca3de5c2fe3

    SHA512

    147c362e1c6e00b3ca3914fb88bb74b4ef8a60c2d6ed8ecb41d9babcdaa20e1ceabd32fa24697a5de9812e68f1480fb87b4ef6d5aad91adc3fce7b1d46bc3ab4

  • C:\Users\Admin\AppData\Local\Temp\tmpAC1E.tmp.bat

    Filesize

    153B

    MD5

    fd004817795654265efe272a9bc58866

    SHA1

    1ae042cb55d9b6d3ef48a7feb5977652bc5f839e

    SHA256

    43157cc4cce04360a68e6a4172b4b71df8d9c1e5b17e96f91480365d304b83cd

    SHA512

    c387a29283c75f83a7600d09e89b4a6cb146224b8a19cc83be2d3cdb8c4c29454b9aa658851befac2a33f5a853de6700496d05fc264d7913deec669e930fb2f4

  • C:\Users\Admin\AppData\Roaming\WinRAddRd.exe

    Filesize

    669KB

    MD5

    a5be759450ca107d0ae80a275b697c8a

    SHA1

    0896ddf9cc0d6ab5a3e94d1509e5883592485e87

    SHA256

    e7f4bae5fd7a15bd269b0460c395f9f3b0168a5012e47ceabd48748b5aec2411

    SHA512

    7f85c07c04c9dac7f14a4a15d248976bc755a63141bc20adc0da378608458c59ddf7300e651b3cf5adc523f08668887f1558d039028af31a6a59e723932597dc

  • C:\Users\Admin\AppData\Roaming\WinRAddRd.exe

    Filesize

    669KB

    MD5

    a5be759450ca107d0ae80a275b697c8a

    SHA1

    0896ddf9cc0d6ab5a3e94d1509e5883592485e87

    SHA256

    e7f4bae5fd7a15bd269b0460c395f9f3b0168a5012e47ceabd48748b5aec2411

    SHA512

    7f85c07c04c9dac7f14a4a15d248976bc755a63141bc20adc0da378608458c59ddf7300e651b3cf5adc523f08668887f1558d039028af31a6a59e723932597dc

  • memory/3228-156-0x0000000004CB0000-0x0000000004CC0000-memory.dmp

    Filesize

    64KB

  • memory/3228-155-0x0000000074D30000-0x00000000754E0000-memory.dmp

    Filesize

    7.7MB

  • memory/3228-154-0x0000000004CB0000-0x0000000004CC0000-memory.dmp

    Filesize

    64KB

  • memory/3228-152-0x0000000074D30000-0x00000000754E0000-memory.dmp

    Filesize

    7.7MB

  • memory/5072-137-0x0000000005C40000-0x0000000005CD2000-memory.dmp

    Filesize

    584KB

  • memory/5072-146-0x0000000074DE0000-0x0000000075590000-memory.dmp

    Filesize

    7.7MB

  • memory/5072-141-0x0000000005E80000-0x0000000005EE6000-memory.dmp

    Filesize

    408KB

  • memory/5072-140-0x0000000005E00000-0x0000000005E76000-memory.dmp

    Filesize

    472KB

  • memory/5072-139-0x0000000006330000-0x00000000068D4000-memory.dmp

    Filesize

    5.6MB

  • memory/5072-138-0x0000000005CE0000-0x0000000005D7C000-memory.dmp

    Filesize

    624KB

  • memory/5072-133-0x0000000074DE0000-0x0000000075590000-memory.dmp

    Filesize

    7.7MB

  • memory/5072-136-0x0000000003340000-0x0000000003350000-memory.dmp

    Filesize

    64KB

  • memory/5072-135-0x0000000003190000-0x0000000003191000-memory.dmp

    Filesize

    4KB

  • memory/5072-134-0x0000000000C80000-0x0000000000DB6000-memory.dmp

    Filesize

    1.2MB