Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    142s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/08/2023, 08:30

General

  • Target

    96ae93cedac45544172c20d2b513301dea9936f412b098b7dfc5592b9fd2a29e.exe

  • Size

    2.7MB

  • MD5

    7a79ef7c6cf5459d1bc9bbf354b88b6b

  • SHA1

    5ea850f0b9dac1c99c1505dec317b806e5b19a93

  • SHA256

    96ae93cedac45544172c20d2b513301dea9936f412b098b7dfc5592b9fd2a29e

  • SHA512

    2a2fc49d4a6937f6ecef3d643cc490eb052535cbe4ac6fabbe0c04c18560552a2278048f2d8d39e739fa7c677e7b0bd7974c095cf474b48a30872f064e17ebbc

  • SSDEEP

    49152:rLLWqo8KBZjPGdcxS6crimOoTIBn3Qd+d5xaKbhVCPf5clxevQd4:r+jbJG65QT+3QdcxaKvCPfvvQd4

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\96ae93cedac45544172c20d2b513301dea9936f412b098b7dfc5592b9fd2a29e.exe
    "C:\Users\Admin\AppData\Local\Temp\96ae93cedac45544172c20d2b513301dea9936f412b098b7dfc5592b9fd2a29e.exe"
    1⤵
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2584
    • C:\Windows\SysWOW64\control.exe
      "C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\S5eLJ.cPl",
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3540
      • C:\Windows\SysWOW64\rundll32.exe
        "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\S5eLJ.cPl",
        3⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:1208
        • C:\Windows\system32\RunDll32.exe
          C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\S5eLJ.cPl",
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:484
          • C:\Windows\SysWOW64\rundll32.exe
            "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 "C:\Users\Admin\AppData\Local\Temp\S5eLJ.cPl",
            5⤵
            • Loads dropped DLL
            PID:1524

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\S5eLJ.cPl

    Filesize

    2.4MB

    MD5

    abba001cf2118eee920cd99c5042b709

    SHA1

    b8941db07ed0819ee9dbd2a4a3f66d1d59ae2f05

    SHA256

    d06c0d095d910f3dda41d2f89a85e06d7f7b24a835712e9d6b51f4a9869aea10

    SHA512

    1283be779a3a03d89092f894705dc9a387e6713bd263f526294bbe4ccf773b92eed6a21ca1ce5af286db4e43a40798adb080eb22c61ec020220dd7df9848c1a1

  • C:\Users\Admin\AppData\Local\Temp\s5elJ.cpl

    Filesize

    2.4MB

    MD5

    abba001cf2118eee920cd99c5042b709

    SHA1

    b8941db07ed0819ee9dbd2a4a3f66d1d59ae2f05

    SHA256

    d06c0d095d910f3dda41d2f89a85e06d7f7b24a835712e9d6b51f4a9869aea10

    SHA512

    1283be779a3a03d89092f894705dc9a387e6713bd263f526294bbe4ccf773b92eed6a21ca1ce5af286db4e43a40798adb080eb22c61ec020220dd7df9848c1a1

  • C:\Users\Admin\AppData\Local\Temp\s5elJ.cpl

    Filesize

    2.4MB

    MD5

    abba001cf2118eee920cd99c5042b709

    SHA1

    b8941db07ed0819ee9dbd2a4a3f66d1d59ae2f05

    SHA256

    d06c0d095d910f3dda41d2f89a85e06d7f7b24a835712e9d6b51f4a9869aea10

    SHA512

    1283be779a3a03d89092f894705dc9a387e6713bd263f526294bbe4ccf773b92eed6a21ca1ce5af286db4e43a40798adb080eb22c61ec020220dd7df9848c1a1

  • C:\Users\Admin\AppData\Local\Temp\s5elJ.cpl

    Filesize

    2.4MB

    MD5

    abba001cf2118eee920cd99c5042b709

    SHA1

    b8941db07ed0819ee9dbd2a4a3f66d1d59ae2f05

    SHA256

    d06c0d095d910f3dda41d2f89a85e06d7f7b24a835712e9d6b51f4a9869aea10

    SHA512

    1283be779a3a03d89092f894705dc9a387e6713bd263f526294bbe4ccf773b92eed6a21ca1ce5af286db4e43a40798adb080eb22c61ec020220dd7df9848c1a1

  • memory/1208-144-0x0000000002F10000-0x0000000002F16000-memory.dmp

    Filesize

    24KB

  • memory/1208-148-0x0000000003290000-0x0000000003386000-memory.dmp

    Filesize

    984KB

  • memory/1208-149-0x0000000003390000-0x000000000346E000-memory.dmp

    Filesize

    888KB

  • memory/1208-152-0x0000000003390000-0x000000000346E000-memory.dmp

    Filesize

    888KB

  • memory/1208-153-0x0000000003390000-0x000000000346E000-memory.dmp

    Filesize

    888KB

  • memory/1208-145-0x0000000000400000-0x000000000066E000-memory.dmp

    Filesize

    2.4MB

  • memory/1524-155-0x0000000002B60000-0x0000000002B66000-memory.dmp

    Filesize

    24KB

  • memory/1524-160-0x0000000003020000-0x0000000003116000-memory.dmp

    Filesize

    984KB

  • memory/1524-161-0x0000000003120000-0x00000000031FE000-memory.dmp

    Filesize

    888KB

  • memory/1524-164-0x0000000003120000-0x00000000031FE000-memory.dmp

    Filesize

    888KB

  • memory/1524-165-0x0000000003120000-0x00000000031FE000-memory.dmp

    Filesize

    888KB