Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    141s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/07/2023, 02:55

General

  • Target

    6fa95e4e25eb2cf60595af08ca20573f260e87b40a8202bbcfeb439634f0aeb6.exe

  • Size

    1.8MB

  • MD5

    b15a0e59e709856f57c011a4110fae6b

  • SHA1

    53b9ba00065d07992fab361316441de49eda1626

  • SHA256

    6fa95e4e25eb2cf60595af08ca20573f260e87b40a8202bbcfeb439634f0aeb6

  • SHA512

    f79f92a8f6bbdb7902f676f712ebfb61ffc0ba14020c09bf397ea1ce56fc17f64227a345c61d0e63de51fe27d828c7d8961ed9026a556efe4815a9661e7012d3

  • SSDEEP

    49152:zereFL30O/xFBOFFW34tx9sZ7/3UY0nb5D:zueFF/xrMO4P9s10t

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6fa95e4e25eb2cf60595af08ca20573f260e87b40a8202bbcfeb439634f0aeb6.exe
    "C:\Users\Admin\AppData\Local\Temp\6fa95e4e25eb2cf60595af08ca20573f260e87b40a8202bbcfeb439634f0aeb6.exe"
    1⤵
    • Checks computer location settings
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:1576
    • C:\Windows\SysWOW64\control.exe
      "C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\LJtDWS~O.cpl",
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:744
      • C:\Windows\SysWOW64\rundll32.exe
        "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\LJtDWS~O.cpl",
        3⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:220
        • C:\Windows\system32\RunDll32.exe
          C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\LJtDWS~O.cpl",
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:716
          • C:\Windows\SysWOW64\rundll32.exe
            "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 "C:\Users\Admin\AppData\Local\Temp\LJtDWS~O.cpl",
            5⤵
            • Loads dropped DLL
            PID:1132

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\LJtDWS~O.cpl

    Filesize

    1.3MB

    MD5

    c18be9990d123202d3a6f04d2565c9fc

    SHA1

    15ffd3ff9f0d3b96e78d87cd2a8141f060c67902

    SHA256

    fe587e83e84faaaf71bce643c77b077a3c8162bb63973cc43831a0f9f4c7dbe9

    SHA512

    6000ad5d38b3ee99fd4391c01949ebc5a2b6243ad0c7062fc157926cece51abbff56526d5c8c350de5a492e60035b46b8b50b7217a348a1b5160caa82cc54296

  • C:\Users\Admin\AppData\Local\Temp\LjtdWS~o.cpl

    Filesize

    1.3MB

    MD5

    c18be9990d123202d3a6f04d2565c9fc

    SHA1

    15ffd3ff9f0d3b96e78d87cd2a8141f060c67902

    SHA256

    fe587e83e84faaaf71bce643c77b077a3c8162bb63973cc43831a0f9f4c7dbe9

    SHA512

    6000ad5d38b3ee99fd4391c01949ebc5a2b6243ad0c7062fc157926cece51abbff56526d5c8c350de5a492e60035b46b8b50b7217a348a1b5160caa82cc54296

  • C:\Users\Admin\AppData\Local\Temp\LjtdWS~o.cpl

    Filesize

    1.3MB

    MD5

    c18be9990d123202d3a6f04d2565c9fc

    SHA1

    15ffd3ff9f0d3b96e78d87cd2a8141f060c67902

    SHA256

    fe587e83e84faaaf71bce643c77b077a3c8162bb63973cc43831a0f9f4c7dbe9

    SHA512

    6000ad5d38b3ee99fd4391c01949ebc5a2b6243ad0c7062fc157926cece51abbff56526d5c8c350de5a492e60035b46b8b50b7217a348a1b5160caa82cc54296

  • C:\Users\Admin\AppData\Local\Temp\LjtdWS~o.cpl

    Filesize

    1.3MB

    MD5

    c18be9990d123202d3a6f04d2565c9fc

    SHA1

    15ffd3ff9f0d3b96e78d87cd2a8141f060c67902

    SHA256

    fe587e83e84faaaf71bce643c77b077a3c8162bb63973cc43831a0f9f4c7dbe9

    SHA512

    6000ad5d38b3ee99fd4391c01949ebc5a2b6243ad0c7062fc157926cece51abbff56526d5c8c350de5a492e60035b46b8b50b7217a348a1b5160caa82cc54296

  • memory/220-144-0x0000000000C90000-0x0000000000C96000-memory.dmp

    Filesize

    24KB

  • memory/220-147-0x0000000002D10000-0x0000000002E29000-memory.dmp

    Filesize

    1.1MB

  • memory/220-148-0x0000000002E30000-0x0000000002F2E000-memory.dmp

    Filesize

    1016KB

  • memory/220-151-0x0000000002E30000-0x0000000002F2E000-memory.dmp

    Filesize

    1016KB

  • memory/220-152-0x0000000002E30000-0x0000000002F2E000-memory.dmp

    Filesize

    1016KB

  • memory/220-145-0x0000000000400000-0x000000000054D000-memory.dmp

    Filesize

    1.3MB

  • memory/1132-154-0x0000000002710000-0x0000000002716000-memory.dmp

    Filesize

    24KB

  • memory/1132-157-0x0000000002F50000-0x0000000003069000-memory.dmp

    Filesize

    1.1MB

  • memory/1132-158-0x0000000003070000-0x000000000316E000-memory.dmp

    Filesize

    1016KB

  • memory/1132-161-0x0000000003070000-0x000000000316E000-memory.dmp

    Filesize

    1016KB

  • memory/1132-162-0x0000000003070000-0x000000000316E000-memory.dmp

    Filesize

    1016KB