Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    142s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/08/2023, 12:00

General

  • Target

    Remesas Aceptadas_PDF.exe

  • Size

    353KB

  • MD5

    5eac01eb48b833581db348bc8ab49932

  • SHA1

    76adbcf9ffd7c737a513c61412c74a8acb9832d2

  • SHA256

    b48a5ebf4d21ce938606b70952e053ff15581a50d96e1e2cec000a8173edade3

  • SHA512

    dddf71de0f660ef623811091c95f7779ffb14e1974b7fe83c37be570cd5c731470be3d6d2cf67ff2745e7c756acb6cd208c552428a9ddd86e66ff9487d636b2d

  • SSDEEP

    6144:kQ606xiZ8/J8UwuB58YjMo3LNkW0IqWNhPyXgeXyy4WUviQX2EMKedJje:fZ8/Sg8doLOWJd7DdevK

Score
10/10

Malware Config

Signatures

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

  • Checks QEMU agent file 2 TTPs 2 IoCs

    Checks presence of QEMU agent, possibly to detect virtualization.

  • Loads dropped DLL 2 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Remesas Aceptadas_PDF.exe
    "C:\Users\Admin\AppData\Local\Temp\Remesas Aceptadas_PDF.exe"
    1⤵
    • Checks QEMU agent file
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of SetThreadContext
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:3804
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe
      "C:\Users\Admin\AppData\Local\Temp\Remesas Aceptadas_PDF.exe"
      2⤵
      • Checks QEMU agent file
      • Suspicious use of NtCreateThreadExHideFromDebugger
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4388
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4388 -s 2540
        3⤵
        • Program crash
        PID:1704
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 4388 -ip 4388
    1⤵
      PID:4116

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\nsx80AA.tmp\System.dll

      Filesize

      11KB

      MD5

      9625d5b1754bc4ff29281d415d27a0fd

      SHA1

      80e85afc5cccd4c0a3775edbb90595a1a59f5ce0

      SHA256

      c2f405d7402f815d0c3fadd9a50f0bbbb1bab9aa38fe347823478a2587299448

      SHA512

      dce52b640897c2e8dbfd0a1472d5377fa91fb9cf1aeff62604d014bccbe5b56af1378f173132abeb0edd18c225b9f8f5e3d3e72434aed946661e036c779f165b

    • C:\Users\Admin\AppData\Local\Temp\nsx80AA.tmp\System.dll

      Filesize

      11KB

      MD5

      9625d5b1754bc4ff29281d415d27a0fd

      SHA1

      80e85afc5cccd4c0a3775edbb90595a1a59f5ce0

      SHA256

      c2f405d7402f815d0c3fadd9a50f0bbbb1bab9aa38fe347823478a2587299448

      SHA512

      dce52b640897c2e8dbfd0a1472d5377fa91fb9cf1aeff62604d014bccbe5b56af1378f173132abeb0edd18c225b9f8f5e3d3e72434aed946661e036c779f165b

    • C:\Users\Admin\AppData\Local\Temp\nsx80AA.tmp\System.dll

      Filesize

      11KB

      MD5

      9625d5b1754bc4ff29281d415d27a0fd

      SHA1

      80e85afc5cccd4c0a3775edbb90595a1a59f5ce0

      SHA256

      c2f405d7402f815d0c3fadd9a50f0bbbb1bab9aa38fe347823478a2587299448

      SHA512

      dce52b640897c2e8dbfd0a1472d5377fa91fb9cf1aeff62604d014bccbe5b56af1378f173132abeb0edd18c225b9f8f5e3d3e72434aed946661e036c779f165b

    • memory/3804-145-0x0000000002860000-0x0000000003D20000-memory.dmp

      Filesize

      20.8MB

    • memory/3804-146-0x0000000002860000-0x0000000003D20000-memory.dmp

      Filesize

      20.8MB

    • memory/3804-147-0x0000000077D31000-0x0000000077E51000-memory.dmp

      Filesize

      1.1MB

    • memory/3804-148-0x0000000010000000-0x0000000010006000-memory.dmp

      Filesize

      24KB

    • memory/4388-152-0x0000000073D10000-0x0000000074F64000-memory.dmp

      Filesize

      18.3MB

    • memory/4388-168-0x0000000072650000-0x0000000072E00000-memory.dmp

      Filesize

      7.7MB

    • memory/4388-151-0x0000000000B00000-0x0000000001FC0000-memory.dmp

      Filesize

      20.8MB

    • memory/4388-149-0x0000000000B00000-0x0000000001FC0000-memory.dmp

      Filesize

      20.8MB

    • memory/4388-153-0x0000000077DD5000-0x0000000077DD6000-memory.dmp

      Filesize

      4KB

    • memory/4388-166-0x0000000073D10000-0x0000000074F64000-memory.dmp

      Filesize

      18.3MB

    • memory/4388-167-0x0000000000B00000-0x0000000001FC0000-memory.dmp

      Filesize

      20.8MB

    • memory/4388-150-0x0000000077DB8000-0x0000000077DB9000-memory.dmp

      Filesize

      4KB

    • memory/4388-169-0x0000000073D10000-0x0000000073D54000-memory.dmp

      Filesize

      272KB

    • memory/4388-170-0x0000000034EC0000-0x0000000035464000-memory.dmp

      Filesize

      5.6MB

    • memory/4388-171-0x0000000077D31000-0x0000000077E51000-memory.dmp

      Filesize

      1.1MB

    • memory/4388-173-0x0000000034890000-0x00000000348F6000-memory.dmp

      Filesize

      408KB

    • memory/4388-174-0x00000000349F0000-0x0000000034A00000-memory.dmp

      Filesize

      64KB

    • memory/4388-175-0x0000000000B00000-0x0000000001FC0000-memory.dmp

      Filesize

      20.8MB

    • memory/4388-177-0x0000000072650000-0x0000000072E00000-memory.dmp

      Filesize

      7.7MB