Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    45s
  • max time network
    79s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230831-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/09/2023, 06:34

General

  • Target

    9ac9567d900573922ecadc81a165acb92d638fbc2eafe98f2d574e0e7f8428b9.exe

  • Size

    889KB

  • MD5

    771b63756e09ab724dc4ae1c58d4cee4

  • SHA1

    891f864d16cdfe0e24e87089fed7ddd74de3f181

  • SHA256

    9ac9567d900573922ecadc81a165acb92d638fbc2eafe98f2d574e0e7f8428b9

  • SHA512

    596c07a404a1972e9892c288348fbc0605fdeb9a58af5df4be5cab86c1f1da5d073c64b5844314d595a1f6143a0c8567156d1d66e85b0d7f0fae9be74498fb2c

  • SSDEEP

    6144:PJ1etoAWIVpTiAKhft1JEqwLcEOkCybEaQRXr9HNdvOa7AXGSqLr4Eza:hAoo7i5FMqwTOkx2LIa0EC

Score
8/10
upx

Malware Config

Signatures

  • Drops file in Drivers directory 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • UPX packed file 10 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Unexpected DNS network traffic destination 1 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Drops file in System32 directory 14 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
  • Modifies data under HKEY_USERS 9 IoCs
  • Suspicious behavior: EnumeratesProcesses 21 IoCs
  • Suspicious behavior: LoadsDriver 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 16 IoCs
  • Suspicious use of WriteProcessMemory 29 IoCs

Processes

  • C:\Windows\system32\winlogon.exe
    winlogon.exe
    1⤵
      PID:640
    • C:\Windows\Explorer.EXE
      C:\Windows\Explorer.EXE
      1⤵
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:708
      • C:\Users\Admin\AppData\Local\Temp\9ac9567d900573922ecadc81a165acb92d638fbc2eafe98f2d574e0e7f8428b9.exe
        "C:\Users\Admin\AppData\Local\Temp\9ac9567d900573922ecadc81a165acb92d638fbc2eafe98f2d574e0e7f8428b9.exe"
        2⤵
        • Checks computer location settings
        • Drops file in System32 directory
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2108
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c timeout /t 1 & del /Q /F "C:\Users\Admin\AppData\Local\Temp\9ac9567d900573922ecadc81a165acb92d638fbc2eafe98f2d574e0e7f8428b9.exe"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:464
          • C:\Windows\SysWOW64\timeout.exe
            timeout /t 1
            4⤵
            • Delays execution with timeout.exe
            PID:3912
      • C:\Program Files\Common Files\cscript.exe
        "C:\Program Files\Common Files\cscript.exe"
        2⤵
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Checks SCSI registry key(s)
        • Modifies Internet Explorer settings
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1164
    • C:\Windows\Syswow64\a8699670
      C:\Windows\Syswow64\a8699670
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:812
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c timeout /t 1 & del /Q /F "C:\Windows\Syswow64\a8699670"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:3920
        • C:\Windows\SysWOW64\timeout.exe
          timeout /t 1
          3⤵
          • Delays execution with timeout.exe
          PID:4660

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files\Common Files\cscript.exe

      Filesize

      157KB

      MD5

      24590bf74bbbbfd7d7ac070f4e3c44fd

      SHA1

      cdfe517d07f18623778829aa98d6bbadd3f294cd

      SHA256

      ae37fd1b642e797b36b9ffcec8a6e986732d011681061800c6b74426c28a9d03

      SHA512

      ffaf2c86c9555513cdb51a7638f1fde3e8951a203aac63fd0aac62db297c853ac8c14e1a212c01d6b181df53e790f80489358489f6415d5c7fa53bfb8888bfa9

    • C:\Windows\SysWOW64\a8699670

      Filesize

      889KB

      MD5

      8ed893ae0e8f27f40880f9227cae26fa

      SHA1

      8c66c531d6a0529399ae89b666983b32a580a5e4

      SHA256

      8767cb968bedb583c5eeb3c389d6ea34389d35b33d241a5ee2afb28a87221baa

      SHA512

      ab1d0b3da2c21d0730b1d5975dbcbe486b91e0c2882b241ec4829c628235a4c2db7190b87c38c33b8aaf310b1eaf72b397dae3d4bc4e4c6b1549a8d489d8f7e4

    • C:\Windows\SysWOW64\a8699670

      Filesize

      889KB

      MD5

      8ed893ae0e8f27f40880f9227cae26fa

      SHA1

      8c66c531d6a0529399ae89b666983b32a580a5e4

      SHA256

      8767cb968bedb583c5eeb3c389d6ea34389d35b33d241a5ee2afb28a87221baa

      SHA512

      ab1d0b3da2c21d0730b1d5975dbcbe486b91e0c2882b241ec4829c628235a4c2db7190b87c38c33b8aaf310b1eaf72b397dae3d4bc4e4c6b1549a8d489d8f7e4

    • memory/640-27-0x000001B078800000-0x000001B078801000-memory.dmp

      Filesize

      4KB

    • memory/640-28-0x000001B0787A0000-0x000001B0787C8000-memory.dmp

      Filesize

      160KB

    • memory/640-62-0x000001B078800000-0x000001B078801000-memory.dmp

      Filesize

      4KB

    • memory/708-10-0x0000000002A00000-0x0000000002A03000-memory.dmp

      Filesize

      12KB

    • memory/708-9-0x0000000002A00000-0x0000000002A03000-memory.dmp

      Filesize

      12KB

    • memory/708-8-0x0000000002A00000-0x0000000002A03000-memory.dmp

      Filesize

      12KB

    • memory/708-11-0x0000000007B90000-0x0000000007C87000-memory.dmp

      Filesize

      988KB

    • memory/708-15-0x0000000002A30000-0x0000000002A31000-memory.dmp

      Filesize

      4KB

    • memory/708-30-0x0000000002A30000-0x0000000002A31000-memory.dmp

      Filesize

      4KB

    • memory/708-25-0x0000000007B90000-0x0000000007C87000-memory.dmp

      Filesize

      988KB

    • memory/812-7-0x0000000000B10000-0x0000000000B9E000-memory.dmp

      Filesize

      568KB

    • memory/812-64-0x0000000000B10000-0x0000000000B9E000-memory.dmp

      Filesize

      568KB

    • memory/812-61-0x0000000000B10000-0x0000000000B9E000-memory.dmp

      Filesize

      568KB

    • memory/812-4-0x0000000000B10000-0x0000000000B9E000-memory.dmp

      Filesize

      568KB

    • memory/812-23-0x0000000000B10000-0x0000000000B9E000-memory.dmp

      Filesize

      568KB

    • memory/1164-31-0x000001BA58C70000-0x000001BA58D3B000-memory.dmp

      Filesize

      812KB

    • memory/1164-67-0x000001BA5ADD0000-0x000001BA5ADD1000-memory.dmp

      Filesize

      4KB

    • memory/1164-80-0x000001BA5AF00000-0x000001BA5AF01000-memory.dmp

      Filesize

      4KB

    • memory/1164-20-0x000001BA58C70000-0x000001BA58D3B000-memory.dmp

      Filesize

      812KB

    • memory/1164-79-0x000001BA5AEF0000-0x000001BA5AEF1000-memory.dmp

      Filesize

      4KB

    • memory/1164-41-0x000001BA58D80000-0x000001BA58D81000-memory.dmp

      Filesize

      4KB

    • memory/1164-60-0x00007FFDBB1A0000-0x00007FFDBB1B0000-memory.dmp

      Filesize

      64KB

    • memory/1164-19-0x000001BA58C70000-0x000001BA58D3B000-memory.dmp

      Filesize

      812KB

    • memory/1164-17-0x000001BA589E0000-0x000001BA589E3000-memory.dmp

      Filesize

      12KB

    • memory/1164-63-0x000001BA5ABA0000-0x000001BA5ABA2000-memory.dmp

      Filesize

      8KB

    • memory/1164-78-0x000001BA5AEF0000-0x000001BA5AEF1000-memory.dmp

      Filesize

      4KB

    • memory/1164-65-0x000001BA5ADB0000-0x000001BA5ADB1000-memory.dmp

      Filesize

      4KB

    • memory/1164-66-0x000001BA5ADB0000-0x000001BA5ADBA000-memory.dmp

      Filesize

      40KB

    • memory/1164-21-0x00007FFDBB1A0000-0x00007FFDBB1B0000-memory.dmp

      Filesize

      64KB

    • memory/1164-68-0x000001BA5ADB0000-0x000001BA5ADB1000-memory.dmp

      Filesize

      4KB

    • memory/1164-69-0x000001BA5ADC0000-0x000001BA5ADC1000-memory.dmp

      Filesize

      4KB

    • memory/1164-70-0x000001BA5ADB0000-0x000001BA5ADB1000-memory.dmp

      Filesize

      4KB

    • memory/1164-71-0x000001BA5ADB0000-0x000001BA5ADBA000-memory.dmp

      Filesize

      40KB

    • memory/1164-72-0x000001BA5ADC0000-0x000001BA5ADCF000-memory.dmp

      Filesize

      60KB

    • memory/1164-73-0x000001BA5ADC0000-0x000001BA5ADC1000-memory.dmp

      Filesize

      4KB

    • memory/1164-74-0x000001BA5ADD0000-0x000001BA5ADD1000-memory.dmp

      Filesize

      4KB

    • memory/1164-75-0x000001BA5ADB0000-0x000001BA5ADB1000-memory.dmp

      Filesize

      4KB

    • memory/1164-76-0x000001BA5AE10000-0x000001BA5AEB0000-memory.dmp

      Filesize

      640KB

    • memory/1164-77-0x000001BA5ADB0000-0x000001BA5ADB2000-memory.dmp

      Filesize

      8KB

    • memory/2108-5-0x0000000000580000-0x000000000060E000-memory.dmp

      Filesize

      568KB

    • memory/2108-0-0x0000000000580000-0x000000000060E000-memory.dmp

      Filesize

      568KB

    • memory/2108-29-0x0000000000580000-0x000000000060E000-memory.dmp

      Filesize

      568KB