Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    141s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/08/2023, 01:01

General

  • Target

    e1d2116fbcb690a0b015961eb71ff0a942601170a3371dab1c65f965861bf6f3.exe

  • Size

    620KB

  • MD5

    159d5fc953b4f50ba36c98edd6fd6c81

  • SHA1

    ee0a0d42ea26dab26f9e71483f5e6537e74934a6

  • SHA256

    e1d2116fbcb690a0b015961eb71ff0a942601170a3371dab1c65f965861bf6f3

  • SHA512

    10a54fa8bbedb0136d7e8748c93b121ea5a8dc1dbf1fbc4e6d5a76c5637c59b9853b6144ee79fe4454b430eeb4fef52a8d73a590db14533ae8bf3c2f6fabb952

  • SSDEEP

    12288:v0Dl+C42xjWYXEsWYGzxfk+PdnBGFaSj29jwX9np3BkA+5CTXgJT1HLE+tki:gTXwY6xH1nu+wXrBkA+5eQJTVLE+t

Score
7/10

Malware Config

Signatures

  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e1d2116fbcb690a0b015961eb71ff0a942601170a3371dab1c65f965861bf6f3.exe
    "C:\Users\Admin\AppData\Local\Temp\e1d2116fbcb690a0b015961eb71ff0a942601170a3371dab1c65f965861bf6f3.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3292
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\e1d2116fbcb690a0b015961eb71ff0a942601170a3371dab1c65f965861bf6f3.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1968
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\olHNjIyLhh.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3896
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\olHNjIyLhh" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1661.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:5020
    • C:\Users\Admin\AppData\Local\Temp\e1d2116fbcb690a0b015961eb71ff0a942601170a3371dab1c65f965861bf6f3.exe
      "C:\Users\Admin\AppData\Local\Temp\e1d2116fbcb690a0b015961eb71ff0a942601170a3371dab1c65f965861bf6f3.exe"
      2⤵
        PID:4964
      • C:\Users\Admin\AppData\Local\Temp\e1d2116fbcb690a0b015961eb71ff0a942601170a3371dab1c65f965861bf6f3.exe
        "C:\Users\Admin\AppData\Local\Temp\e1d2116fbcb690a0b015961eb71ff0a942601170a3371dab1c65f965861bf6f3.exe"
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2064

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

      Filesize

      18KB

      MD5

      3130d060ee4af7b597f6287113dd3a32

      SHA1

      c3ab3c46570c9e3523332185068edd3caf00edb2

      SHA256

      407c2fddaab46591e5598bf7e1e0ac491b7589c91ac5987893eebd63d4b61b8d

      SHA512

      2fc7d6eb250f93912fa0d486ccd87b04331fe1b79a0dad675aa587348c0a1938d77c9ff75ba6b30557291a890ba2c955cf3c0dc27a70d1ff7fe78e42d53ae13a

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_a0v3s3xa.ojs.ps1

      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • C:\Users\Admin\AppData\Local\Temp\tmp1661.tmp

      Filesize

      1KB

      MD5

      9839d852f521ac12b7d9b27d08995ba4

      SHA1

      6a673016a427eed3ba64bb18138f3c918ad0665b

      SHA256

      f971df02a51e2f0a1b00b1268d0b3a8730178fcc4e7b8a8eff456921f3573b8a

      SHA512

      3f4015274e4f1cb7e2c2737536832ea0ed9a81c0ec5930cbe8ff185196244f2c65724025b109d84266ef8b2d14184e382d5e1c9a48f48cae8ade4d9a03e344d7

    • memory/1968-182-0x0000000004BD0000-0x0000000004BE0000-memory.dmp

      Filesize

      64KB

    • memory/1968-156-0x0000000004BD0000-0x0000000004BE0000-memory.dmp

      Filesize

      64KB

    • memory/1968-209-0x0000000007240000-0x000000000724A000-memory.dmp

      Filesize

      40KB

    • memory/1968-211-0x0000000074AC0000-0x0000000075270000-memory.dmp

      Filesize

      7.7MB

    • memory/1968-186-0x0000000075320000-0x000000007536C000-memory.dmp

      Filesize

      304KB

    • memory/1968-184-0x0000000006490000-0x00000000064C2000-memory.dmp

      Filesize

      200KB

    • memory/1968-146-0x00000000025A0000-0x00000000025D6000-memory.dmp

      Filesize

      216KB

    • memory/1968-147-0x0000000074AC0000-0x0000000075270000-memory.dmp

      Filesize

      7.7MB

    • memory/1968-149-0x0000000005210000-0x0000000005838000-memory.dmp

      Filesize

      6.2MB

    • memory/1968-148-0x0000000004BD0000-0x0000000004BE0000-memory.dmp

      Filesize

      64KB

    • memory/1968-181-0x0000000005ED0000-0x0000000005EEE000-memory.dmp

      Filesize

      120KB

    • memory/1968-196-0x0000000006470000-0x000000000648E000-memory.dmp

      Filesize

      120KB

    • memory/1968-214-0x0000000004BD0000-0x0000000004BE0000-memory.dmp

      Filesize

      64KB

    • memory/1968-223-0x0000000074AC0000-0x0000000075270000-memory.dmp

      Filesize

      7.7MB

    • memory/2064-180-0x0000000004FD0000-0x0000000004FE0000-memory.dmp

      Filesize

      64KB

    • memory/2064-178-0x0000000074AC0000-0x0000000075270000-memory.dmp

      Filesize

      7.7MB

    • memory/2064-225-0x0000000074AC0000-0x0000000075270000-memory.dmp

      Filesize

      7.7MB

    • memory/2064-226-0x0000000004FD0000-0x0000000004FE0000-memory.dmp

      Filesize

      64KB

    • memory/2064-212-0x0000000005ED0000-0x0000000005F20000-memory.dmp

      Filesize

      320KB

    • memory/2064-176-0x0000000000400000-0x0000000000442000-memory.dmp

      Filesize

      264KB

    • memory/3292-179-0x0000000074AC0000-0x0000000075270000-memory.dmp

      Filesize

      7.7MB

    • memory/3292-134-0x0000000074AC0000-0x0000000075270000-memory.dmp

      Filesize

      7.7MB

    • memory/3292-136-0x0000000004E30000-0x0000000004EC2000-memory.dmp

      Filesize

      584KB

    • memory/3292-135-0x0000000005490000-0x0000000005A34000-memory.dmp

      Filesize

      5.6MB

    • memory/3292-137-0x0000000004FD0000-0x0000000004FE0000-memory.dmp

      Filesize

      64KB

    • memory/3292-141-0x0000000008D20000-0x0000000008DBC000-memory.dmp

      Filesize

      624KB

    • memory/3292-133-0x00000000003D0000-0x0000000000470000-memory.dmp

      Filesize

      640KB

    • memory/3292-140-0x0000000004FD0000-0x0000000004FE0000-memory.dmp

      Filesize

      64KB

    • memory/3292-139-0x0000000074AC0000-0x0000000075270000-memory.dmp

      Filesize

      7.7MB

    • memory/3292-138-0x0000000005000000-0x000000000500A000-memory.dmp

      Filesize

      40KB

    • memory/3896-216-0x0000000074AC0000-0x0000000075270000-memory.dmp

      Filesize

      7.7MB

    • memory/3896-207-0x0000000007B50000-0x00000000081CA000-memory.dmp

      Filesize

      6.5MB

    • memory/3896-208-0x0000000007500000-0x000000000751A000-memory.dmp

      Filesize

      104KB

    • memory/3896-197-0x0000000075320000-0x000000007536C000-memory.dmp

      Filesize

      304KB

    • memory/3896-210-0x0000000007780000-0x0000000007816000-memory.dmp

      Filesize

      600KB

    • memory/3896-185-0x000000007F5D0000-0x000000007F5E0000-memory.dmp

      Filesize

      64KB

    • memory/3896-152-0x0000000002910000-0x0000000002920000-memory.dmp

      Filesize

      64KB

    • memory/3896-213-0x0000000007730000-0x000000000773E000-memory.dmp

      Filesize

      56KB

    • memory/3896-155-0x0000000005B30000-0x0000000005B96000-memory.dmp

      Filesize

      408KB

    • memory/3896-215-0x0000000007840000-0x000000000785A000-memory.dmp

      Filesize

      104KB

    • memory/3896-217-0x0000000002910000-0x0000000002920000-memory.dmp

      Filesize

      64KB

    • memory/3896-183-0x0000000002910000-0x0000000002920000-memory.dmp

      Filesize

      64KB

    • memory/3896-218-0x0000000002910000-0x0000000002920000-memory.dmp

      Filesize

      64KB

    • memory/3896-219-0x0000000007820000-0x0000000007828000-memory.dmp

      Filesize

      32KB

    • memory/3896-157-0x0000000005BA0000-0x0000000005C06000-memory.dmp

      Filesize

      408KB

    • memory/3896-154-0x0000000005140000-0x0000000005162000-memory.dmp

      Filesize

      136KB

    • memory/3896-224-0x0000000074AC0000-0x0000000075270000-memory.dmp

      Filesize

      7.7MB

    • memory/3896-153-0x0000000002910000-0x0000000002920000-memory.dmp

      Filesize

      64KB

    • memory/3896-150-0x0000000074AC0000-0x0000000075270000-memory.dmp

      Filesize

      7.7MB