Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
15s -
max time network
18s -
platform
windows10-1703_x64 -
resource
win10-20230703-en -
resource tags
arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system -
submitted
19/08/2023, 18:24
Static task
static1
Behavioral task
behavioral1
Sample
Memcheck.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
Memcheck.exe
Resource
win10-20230703-en
Behavioral task
behavioral3
Sample
Memcheck.exe
Resource
win10v2004-20230703-en
General
-
Target
Memcheck.exe
-
Size
3.9MB
-
MD5
ea3726dec12657f20ad2c861464dd434
-
SHA1
36eb78d12e0c211ca72de08a2267a1a82e6a0dc5
-
SHA256
1f44175232113cf3f570e863f8e9e0db15b1d30364498c93cdeccf0d768f3cfe
-
SHA512
85399babecf1b3a96b2a500d19776547d43c282995d77dbf2c2586f6055da498667872fd1f5790c74b62a23e7efb56494f51d0990434ef75e64fe01f77230c19
-
SSDEEP
98304:wAsJ5SFdzBuyzlPQP2RUhfXzOP2sIR4Ajsg6WBj02N/GmmAVSMb:wAs/SZuyzUtfXKP2sMlvbb
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 3328 Memcheck.exe 3616 Memcheck.exe -
Loads dropped DLL 2 IoCs
pid Process 3616 Memcheck.exe 3616 Memcheck.exe -
Drops file in System32 directory 46 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\msvcrt.dll Memcheck.exe File opened for modification C:\Windows\SysWOW64\windows.storage.dll Memcheck.exe File opened for modification C:\Windows\SysWOW64\ntdll.dll Memcheck.exe File opened for modification C:\Windows\SysWOW64\oleaut32.dll Memcheck.exe File opened for modification C:\Windows\SysWOW64\msvcp_win.dll Memcheck.exe File opened for modification C:\Windows\SysWOW64\RPCRT4.dll Memcheck.exe File opened for modification C:\Windows\SysWOW64\user32.dll Memcheck.exe File opened for modification C:\Windows\SysWOW64\ucrtbase.dll Memcheck.exe File opened for modification C:\Windows\SysWOW64\kernel.appcore.dll Memcheck.exe File opened for modification C:\Windows\SysWOW64\clbcatq.dll Memcheck.exe File opened for modification C:\Windows\SysWOW64\advapi32.dll Memcheck.exe File opened for modification C:\Windows\SysWOW64\powrprof.dll Memcheck.exe File opened for modification C:\Windows\SysWOW64\profapi.dll Memcheck.exe File opened for modification C:\Windows\SysWOW64\imm32.dll Memcheck.exe File opened for modification C:\Windows\SysWOW64\wsock32.dll Memcheck.exe File opened for modification C:\Windows\SysWOW64\MSCTF.dll Memcheck.exe File opened for modification C:\Windows\SysWOW64\apphelp.dll Memcheck.exe File opened for modification C:\Windows\SysWOW64\combase.dll Memcheck.exe File opened for modification C:\Windows\SysWOW64\GDI32.dll Memcheck.exe File opened for modification C:\Windows\SysWOW64\shcore.dll Memcheck.exe File opened for modification C:\Windows\SysWOW64\wininet.dll Memcheck.exe File opened for modification C:\Windows\SysWOW64\GLU32.dll Memcheck.exe File opened for modification C:\Windows\SysWOW64\msimg32.dll Memcheck.exe File opened for modification C:\Windows\SysWOW64\PROPSYS.dll Memcheck.exe File opened for modification C:\Windows\SysWOW64\KERNELBASE.dll Memcheck.exe File opened for modification C:\Windows\SysWOW64\CRYPTBASE.dll Memcheck.exe File opened for modification C:\Windows\SysWOW64\shell32.dll Memcheck.exe File opened for modification C:\Windows\SysWOW64\ws2_32.dll Memcheck.exe File opened for modification C:\Windows\SysWOW64\version.dll Memcheck.exe File opened for modification C:\Windows\SysWOW64\KERNEL32.DLL Memcheck.exe File opened for modification C:\Windows\SysWOW64\imagehlp.dll Memcheck.exe File opened for modification C:\Windows\SysWOW64\opengl32.dll Memcheck.exe File opened for modification C:\Windows\SysWOW64\uxtheme.dll Memcheck.exe File opened for modification C:\Windows\SysWOW64\psapi.dll Memcheck.exe File opened for modification C:\Windows\SysWOW64\bcryptPrimitives.dll Memcheck.exe File opened for modification C:\Windows\SysWOW64\sechost.dll Memcheck.exe File opened for modification C:\Windows\SysWOW64\win32u.dll Memcheck.exe File opened for modification C:\Windows\SysWOW64\ole32.dll Memcheck.exe File opened for modification C:\Windows\SysWOW64\cfgmgr32.dll Memcheck.exe File opened for modification C:\Windows\SysWOW64\explorerframe.dll Memcheck.exe File opened for modification C:\Windows\SysWOW64\shfolder.dll Memcheck.exe File opened for modification C:\Windows\SysWOW64\SspiCli.dll Memcheck.exe File opened for modification C:\Windows\SysWOW64\gdi32full.dll Memcheck.exe File opened for modification C:\Windows\SysWOW64\shlwapi.dll Memcheck.exe File opened for modification C:\Windows\SysWOW64\comdlg32.dll Memcheck.exe File opened for modification C:\Windows\SysWOW64\hhctrl.ocx Memcheck.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.15063.0_none_583b8639f462029f\comctl32.dll Memcheck.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3616 Memcheck.exe 3616 Memcheck.exe -
Suspicious use of AdjustPrivilegeToken 15 IoCs
description pid Process Token: SeDebugPrivilege 3616 Memcheck.exe Token: SeTcbPrivilege 3616 Memcheck.exe Token: SeTcbPrivilege 3616 Memcheck.exe Token: SeLoadDriverPrivilege 3616 Memcheck.exe Token: SeCreateGlobalPrivilege 3616 Memcheck.exe Token: 33 3616 Memcheck.exe Token: SeSecurityPrivilege 3616 Memcheck.exe Token: SeTakeOwnershipPrivilege 3616 Memcheck.exe Token: SeManageVolumePrivilege 3616 Memcheck.exe Token: SeBackupPrivilege 3616 Memcheck.exe Token: SeCreatePagefilePrivilege 3616 Memcheck.exe Token: SeShutdownPrivilege 3616 Memcheck.exe Token: SeRestorePrivilege 3616 Memcheck.exe Token: 33 3616 Memcheck.exe Token: SeIncBasePriorityPrivilege 3616 Memcheck.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3616 Memcheck.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4524 wrote to memory of 3328 4524 Memcheck.exe 70 PID 4524 wrote to memory of 3328 4524 Memcheck.exe 70 PID 4524 wrote to memory of 3328 4524 Memcheck.exe 70 PID 3328 wrote to memory of 3616 3328 Memcheck.exe 71 PID 3328 wrote to memory of 3616 3328 Memcheck.exe 71 PID 3328 wrote to memory of 3616 3328 Memcheck.exe 71
Processes
-
C:\Users\Admin\AppData\Local\Temp\Memcheck.exe"C:\Users\Admin\AppData\Local\Temp\Memcheck.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\cetrainers\CET82CC.tmp\Memcheck.exe"C:\Users\Admin\AppData\Local\Temp\cetrainers\CET82CC.tmp\Memcheck.exe" -ORIGIN:"C:\Users\Admin\AppData\Local\Temp\"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3328 -
C:\Users\Admin\AppData\Local\Temp\cetrainers\CET82CC.tmp\extracted\Memcheck.exeC:\Users\Admin\AppData\Local\Temp\cetrainers\CET82CC.tmp\extracted\Memcheck.exe "C:\Users\Admin\AppData\Local\Temp\cetrainers\CET82CC.tmp\extracted\CET_TRAINER.CETRAINER" "-ORIGIN:C:\Users\Admin\AppData\Local\Temp\"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3616
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.7MB
MD5fcfcc486e4c100f20d99df8f71f63d2e
SHA1390702a8db8af3cc3a608747e28aeb350af50ad7
SHA256e8608c6bd3e575965e1a4cceba36fc6be4e9be86d479fc8ce4aa2a3f97611acc
SHA512090de36e6c28783bc58b89a671ecf78d63cb5c5918d30f81312270c5a1fc7977d23990319ca57b7a2bd57910dfac12783765388515aed0a7a9f205e5d0ee9564
-
Filesize
193KB
MD56852660b8cbb67ee3f1e31bf2f1e0afd
SHA1c1b790e062f3a13d3e2f90c58e92ded585abbe3b
SHA256cd86234cf14dfc0e66ae9e575326fd0cf74723a5a60337f7079c0540b6da5c8b
SHA5125722ebf6bef799721464094c6d6a81931bf8f78bdd1fbe12b153cf7b0e4e9e7307fa7a01e0cc16ce885c20c3a0a3cc95d6a7d86413f0c61cca3450fa565dd6a8
-
Filesize
193KB
MD56852660b8cbb67ee3f1e31bf2f1e0afd
SHA1c1b790e062f3a13d3e2f90c58e92ded585abbe3b
SHA256cd86234cf14dfc0e66ae9e575326fd0cf74723a5a60337f7079c0540b6da5c8b
SHA5125722ebf6bef799721464094c6d6a81931bf8f78bdd1fbe12b153cf7b0e4e9e7307fa7a01e0cc16ce885c20c3a0a3cc95d6a7d86413f0c61cca3450fa565dd6a8
-
Filesize
823B
MD50770967b7c5f87672aa6d81b0e18108d
SHA1d0d391759180ca631ccbfdb029fe4e4466549a81
SHA25601edf510a69848e82eb6ab0cb3488d81fc529cde186f7d928a1fb3c9a359fe0c
SHA5122a2afe48dc47d65d125dedf6384d655731bfa857f70b88f07e8e4deda327362b6c9ae787986c89fe1756b92bdeee642475d74bc7c7bfe42d94215daac3424ed7
-
Filesize
7.6MB
MD56302f6714dc29921a6bf886fcd4d8a6c
SHA1df012bad4ef9b4e2a2554891ced21632a699deb5
SHA256cfd5367ffbf2211e819423ba186e5e35389eb84597bd610fba7653e19d945b13
SHA5125247a4e7f5f04a83d0c3e36215feaec7b0db409503437b1daf069f2ba5d7cd04ca715fd0796fbbe3b52b4440f50a7f8e73ce6d8e1e812013cf293fa9b5bb3078
-
Filesize
7.6MB
MD56302f6714dc29921a6bf886fcd4d8a6c
SHA1df012bad4ef9b4e2a2554891ced21632a699deb5
SHA256cfd5367ffbf2211e819423ba186e5e35389eb84597bd610fba7653e19d945b13
SHA5125247a4e7f5f04a83d0c3e36215feaec7b0db409503437b1daf069f2ba5d7cd04ca715fd0796fbbe3b52b4440f50a7f8e73ce6d8e1e812013cf293fa9b5bb3078
-
Filesize
5KB
MD51dc41a0a351e745085fcc98a3933d91f
SHA1bf1e7d333e6d7b3d4bfe5cdcada19af1931dbe15
SHA256a2e02dd32f0245ff31190288b368b3efbbe7c48a95dd22c321231c2f46597d9b
SHA51276f171411d028e72613859332f381f8f26e85d1844c143a8888e4937ca72d7b38ffe66ce617eee5e8155ba034dcc559a9417b5def056bb74227b9bae392d1440
-
Filesize
491KB
MD5c8f47a0e750e07d86a47b3296fb59a97
SHA11f894c9aa88dd2448e50ab5e7277cd4b4c629c6d
SHA256dcfd91f21dee9e70179337a85d21b3ca925f1a6c21de9576aa5219732b7c7a86
SHA512e154a097e8e174a47fea76c96d1c27d93cf9bfbdc47eeef56486cc3d2e661649a1d7da5cfe0ce220ea172f4646ab4eecbd2e1594011d0a8ca1eb416cd84b8b2a
-
Filesize
1.2MB
MD59139604740814e53298a5e8428ba29d7
SHA1c7bf8947e9276a311c4807ea4a57b504f95703c9
SHA256150782fca5e188762a41603e2d5c7aad6b6419926bcadf350ebf84328e50948f
SHA5120b99259e9c0ee566d55cc53c4a7eabf025ed95973edc80ded594023a33f8273cd5d3f3053993f771f9db8a9d234e988cba73845c19ddc6e629e15a243c54cd5d
-
Filesize
491KB
MD5c8f47a0e750e07d86a47b3296fb59a97
SHA11f894c9aa88dd2448e50ab5e7277cd4b4c629c6d
SHA256dcfd91f21dee9e70179337a85d21b3ca925f1a6c21de9576aa5219732b7c7a86
SHA512e154a097e8e174a47fea76c96d1c27d93cf9bfbdc47eeef56486cc3d2e661649a1d7da5cfe0ce220ea172f4646ab4eecbd2e1594011d0a8ca1eb416cd84b8b2a
-
Filesize
1.2MB
MD59139604740814e53298a5e8428ba29d7
SHA1c7bf8947e9276a311c4807ea4a57b504f95703c9
SHA256150782fca5e188762a41603e2d5c7aad6b6419926bcadf350ebf84328e50948f
SHA5120b99259e9c0ee566d55cc53c4a7eabf025ed95973edc80ded594023a33f8273cd5d3f3053993f771f9db8a9d234e988cba73845c19ddc6e629e15a243c54cd5d