Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/08/2023, 01:46

General

  • Target

    14a9face474f66456c37f4e95dd67dc6a35ab3b15549d9fca4d915fd7b39c765.exe

  • Size

    1.8MB

  • MD5

    b4152f43ee6f842cff2302aefe5eabef

  • SHA1

    24f38f6c202e08ffb39e2d6135c2ec6ed78885fe

  • SHA256

    14a9face474f66456c37f4e95dd67dc6a35ab3b15549d9fca4d915fd7b39c765

  • SHA512

    51b801bbab3bc0501ad0aedd30072714701dce19fe0f84331be3ff743221c015995f819c81d7baa31866184bf9b266990d57ec835488937d07876398cd595b72

  • SSDEEP

    49152:jxv9f3RO2Pmm0/d3rCLokmzIi4xx8q0dYTJ:jbBPmmWr5xMYHo

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 3 IoCs
  • VMProtect packed file 12 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Enumerates connected drives 3 TTPs 22 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Program crash 1 IoCs
  • Modifies data under HKEY_USERS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\14a9face474f66456c37f4e95dd67dc6a35ab3b15549d9fca4d915fd7b39c765.exe
    "C:\Users\Admin\AppData\Local\Temp\14a9face474f66456c37f4e95dd67dc6a35ab3b15549d9fca4d915fd7b39c765.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3244
    • C:\Users\Public\Videos\dDXtu_8\Browser.exe
      C:\Users\Public\Videos\dDXtu_8\\Browser.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Enumerates connected drives
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3536
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman
    1⤵
    • Modifies data under HKEY_USERS
    • Suspicious use of AdjustPrivilegeToken
    PID:468
  • C:\Users\Admin\Videos\12B2839A_8\mstsc.exe
    C:\Users\Admin\Videos\12B2839A_8\mstsc.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:864
    • C:\Users\Admin\Videos\12B2839A_8\mstsc.exe
      C:\Users\Admin\Videos\12B2839A_8\mstsc.exe -acsi
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:1336
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1336 -s 608
        3⤵
        • Program crash
        PID:3628
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 1336 -ip 1336
    1⤵
      PID:4320

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\Videos\12B2839A_8\Foundation.dll

      Filesize

      377KB

      MD5

      6b7cca9be87e20e63ebf0c146d4fe48c

      SHA1

      ba46f42dec2f388546e21bd94e97a00baf1e9a21

      SHA256

      fb671a9ae58fb0e9e619f7646f00468cd94dce34e1d52cbe047be11d4cc7b1de

      SHA512

      a637d9c3408a5fbcbdd84fd05e72a5779ef95c94405afdced9632dde05feaf5424c7f4bc9c050c26335c86159ff429c28995b7c6cef1d068f81f8f28ffcbedf2

    • C:\Users\Admin\Videos\12B2839A_8\Foundation.dll

      Filesize

      377KB

      MD5

      6b7cca9be87e20e63ebf0c146d4fe48c

      SHA1

      ba46f42dec2f388546e21bd94e97a00baf1e9a21

      SHA256

      fb671a9ae58fb0e9e619f7646f00468cd94dce34e1d52cbe047be11d4cc7b1de

      SHA512

      a637d9c3408a5fbcbdd84fd05e72a5779ef95c94405afdced9632dde05feaf5424c7f4bc9c050c26335c86159ff429c28995b7c6cef1d068f81f8f28ffcbedf2

    • C:\Users\Admin\Videos\12B2839A_8\Foundation.dll

      Filesize

      377KB

      MD5

      6b7cca9be87e20e63ebf0c146d4fe48c

      SHA1

      ba46f42dec2f388546e21bd94e97a00baf1e9a21

      SHA256

      fb671a9ae58fb0e9e619f7646f00468cd94dce34e1d52cbe047be11d4cc7b1de

      SHA512

      a637d9c3408a5fbcbdd84fd05e72a5779ef95c94405afdced9632dde05feaf5424c7f4bc9c050c26335c86159ff429c28995b7c6cef1d068f81f8f28ffcbedf2

    • C:\Users\Admin\Videos\12B2839A_8\ZP.log

      Filesize

      148KB

      MD5

      81c3afd83c9ad4dfe2ef851c8b36776c

      SHA1

      de120038e0ea1fc4605f87b2d12b5e438455b3df

      SHA256

      2584fca73c9e414327f23d18b161ddabec47c40f07fa3a9f01143b21df3e77ff

      SHA512

      479e07b77fb7ee2161ed4776d9a9c2f9dfc63e1f520a5b1365a1f16b83893deb0b41dbc2012d3b5faee6279920517005a20fbdbdbeaf8cfaccecf6eccf9b9a95

    • C:\Users\Admin\Videos\12B2839A_8\mstsc.exe

      Filesize

      529KB

      MD5

      a683bcd9e78f8b37dd5173fd92695a7d

      SHA1

      a40ef4c407c0c85318af6c8700a0bdc8b54de01a

      SHA256

      d4d63d20fb6aec60348b0a8d1b46086a26e00ed3d743badc93ba773722f18d9f

      SHA512

      c2a08dadb0f738476f9219f98d6e939548bf3a33b6c84ca1315cdfe181457250f4fed7195c31b11af14a20c9ac61908d403a896c6dd1654993e2c4c75cb27a37

    • C:\Users\Admin\Videos\12B2839A_8\mstsc.exe

      Filesize

      529KB

      MD5

      a683bcd9e78f8b37dd5173fd92695a7d

      SHA1

      a40ef4c407c0c85318af6c8700a0bdc8b54de01a

      SHA256

      d4d63d20fb6aec60348b0a8d1b46086a26e00ed3d743badc93ba773722f18d9f

      SHA512

      c2a08dadb0f738476f9219f98d6e939548bf3a33b6c84ca1315cdfe181457250f4fed7195c31b11af14a20c9ac61908d403a896c6dd1654993e2c4c75cb27a37

    • C:\Users\Admin\Videos\12B2839A_8\mstsc.exe

      Filesize

      529KB

      MD5

      a683bcd9e78f8b37dd5173fd92695a7d

      SHA1

      a40ef4c407c0c85318af6c8700a0bdc8b54de01a

      SHA256

      d4d63d20fb6aec60348b0a8d1b46086a26e00ed3d743badc93ba773722f18d9f

      SHA512

      c2a08dadb0f738476f9219f98d6e939548bf3a33b6c84ca1315cdfe181457250f4fed7195c31b11af14a20c9ac61908d403a896c6dd1654993e2c4c75cb27a37

    • C:\Users\Public\Videos\dDXtu_8\Browser.exe

      Filesize

      529KB

      MD5

      a683bcd9e78f8b37dd5173fd92695a7d

      SHA1

      a40ef4c407c0c85318af6c8700a0bdc8b54de01a

      SHA256

      d4d63d20fb6aec60348b0a8d1b46086a26e00ed3d743badc93ba773722f18d9f

      SHA512

      c2a08dadb0f738476f9219f98d6e939548bf3a33b6c84ca1315cdfe181457250f4fed7195c31b11af14a20c9ac61908d403a896c6dd1654993e2c4c75cb27a37

    • C:\Users\Public\Videos\dDXtu_8\Browser.exe

      Filesize

      529KB

      MD5

      a683bcd9e78f8b37dd5173fd92695a7d

      SHA1

      a40ef4c407c0c85318af6c8700a0bdc8b54de01a

      SHA256

      d4d63d20fb6aec60348b0a8d1b46086a26e00ed3d743badc93ba773722f18d9f

      SHA512

      c2a08dadb0f738476f9219f98d6e939548bf3a33b6c84ca1315cdfe181457250f4fed7195c31b11af14a20c9ac61908d403a896c6dd1654993e2c4c75cb27a37

    • C:\Users\Public\Videos\dDXtu_8\Foundation.dll

      Filesize

      377KB

      MD5

      6b7cca9be87e20e63ebf0c146d4fe48c

      SHA1

      ba46f42dec2f388546e21bd94e97a00baf1e9a21

      SHA256

      fb671a9ae58fb0e9e619f7646f00468cd94dce34e1d52cbe047be11d4cc7b1de

      SHA512

      a637d9c3408a5fbcbdd84fd05e72a5779ef95c94405afdced9632dde05feaf5424c7f4bc9c050c26335c86159ff429c28995b7c6cef1d068f81f8f28ffcbedf2

    • C:\Users\Public\Videos\dDXtu_8\Foundation.dll

      Filesize

      377KB

      MD5

      6b7cca9be87e20e63ebf0c146d4fe48c

      SHA1

      ba46f42dec2f388546e21bd94e97a00baf1e9a21

      SHA256

      fb671a9ae58fb0e9e619f7646f00468cd94dce34e1d52cbe047be11d4cc7b1de

      SHA512

      a637d9c3408a5fbcbdd84fd05e72a5779ef95c94405afdced9632dde05feaf5424c7f4bc9c050c26335c86159ff429c28995b7c6cef1d068f81f8f28ffcbedf2

    • C:\Users\Public\Videos\dDXtu_8\ZP.log

      Filesize

      148KB

      MD5

      81c3afd83c9ad4dfe2ef851c8b36776c

      SHA1

      de120038e0ea1fc4605f87b2d12b5e438455b3df

      SHA256

      2584fca73c9e414327f23d18b161ddabec47c40f07fa3a9f01143b21df3e77ff

      SHA512

      479e07b77fb7ee2161ed4776d9a9c2f9dfc63e1f520a5b1365a1f16b83893deb0b41dbc2012d3b5faee6279920517005a20fbdbdbeaf8cfaccecf6eccf9b9a95

    • memory/864-172-0x0000000000C40000-0x0000000000C97000-memory.dmp

      Filesize

      348KB

    • memory/864-167-0x0000000000C40000-0x0000000000C97000-memory.dmp

      Filesize

      348KB

    • memory/864-170-0x0000000000C40000-0x0000000000C97000-memory.dmp

      Filesize

      348KB

    • memory/864-169-0x0000000000C40000-0x0000000000C97000-memory.dmp

      Filesize

      348KB

    • memory/864-168-0x0000000000C40000-0x0000000000C97000-memory.dmp

      Filesize

      348KB

    • memory/864-163-0x0000000053E20000-0x0000000054E20000-memory.dmp

      Filesize

      16.0MB

    • memory/864-174-0x0000000000C40000-0x0000000000C97000-memory.dmp

      Filesize

      348KB

    • memory/1336-177-0x0000000053E20000-0x0000000054E20000-memory.dmp

      Filesize

      16.0MB

    • memory/1336-180-0x0000000000B90000-0x0000000000BE7000-memory.dmp

      Filesize

      348KB

    • memory/1336-181-0x0000000000B90000-0x0000000000BE7000-memory.dmp

      Filesize

      348KB

    • memory/3244-134-0x0000000000400000-0x0000000000896000-memory.dmp

      Filesize

      4.6MB

    • memory/3244-145-0x0000000000400000-0x0000000000896000-memory.dmp

      Filesize

      4.6MB

    • memory/3244-133-0x0000000000400000-0x0000000000896000-memory.dmp

      Filesize

      4.6MB

    • memory/3244-149-0x0000000000400000-0x0000000000896000-memory.dmp

      Filesize

      4.6MB

    • memory/3244-136-0x0000000077000000-0x0000000077001000-memory.dmp

      Filesize

      4KB

    • memory/3536-146-0x0000000064690000-0x0000000065690000-memory.dmp

      Filesize

      16.0MB

    • memory/3536-171-0x00000000033B0000-0x0000000003407000-memory.dmp

      Filesize

      348KB

    • memory/3536-152-0x00000000033B0000-0x0000000003407000-memory.dmp

      Filesize

      348KB

    • memory/3536-150-0x00000000033B0000-0x0000000003407000-memory.dmp

      Filesize

      348KB

    • memory/3536-176-0x00000000033B0000-0x0000000003407000-memory.dmp

      Filesize

      348KB

    • memory/3536-151-0x00000000033B0000-0x0000000003407000-memory.dmp

      Filesize

      348KB

    • memory/3536-154-0x00000000033B0000-0x0000000003407000-memory.dmp

      Filesize

      348KB

    • memory/3536-153-0x00000000033B0000-0x0000000003407000-memory.dmp

      Filesize

      348KB

    • memory/3536-182-0x00000000033B0000-0x0000000003407000-memory.dmp

      Filesize

      348KB

    • memory/3536-183-0x00000000033B0000-0x0000000003407000-memory.dmp

      Filesize

      348KB

    • memory/3536-184-0x00000000033B0000-0x0000000003407000-memory.dmp

      Filesize

      348KB

    • memory/3536-185-0x00000000033B0000-0x0000000003407000-memory.dmp

      Filesize

      348KB