Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    142s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/09/2023, 06:54

General

  • Target

    4ca9d6fc21d1f304b88ff024fc8131074a3be1cc0c147b2d1bb4193e364d0b97.exe

  • Size

    1.3MB

  • MD5

    851e5c879e22248f985170716734c35f

  • SHA1

    62e337a35f602214df52b0de96a45ce28b636e70

  • SHA256

    4ca9d6fc21d1f304b88ff024fc8131074a3be1cc0c147b2d1bb4193e364d0b97

  • SHA512

    ab8b494895d27eb8f12beecbd412fb9653ffcc1b6ef5a35c8eec8c9bbe3355e0e8d6a4cad47ad5a3dc05c42065d208ec91ebdcef50f77809cf6fea6573201070

  • SSDEEP

    24576:TVP4iQzePuruuXj/cjtkugLwnNM9bEjryZFmTcHAdyZbX62z9tywY3+Q:TWBj/cjt1OwNMhS+ZLgdIbX6K9tywq+

Score
7/10
upx

Malware Config

Signatures

  • Executes dropped EXE 4 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 54 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Runs ping.exe 1 TTPs 4 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 18 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4ca9d6fc21d1f304b88ff024fc8131074a3be1cc0c147b2d1bb4193e364d0b97.exe
    "C:\Users\Admin\AppData\Local\Temp\4ca9d6fc21d1f304b88ff024fc8131074a3be1cc0c147b2d1bb4193e364d0b97.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3412
    • C:\Users\Admin\AppData\Local\Temp\4ca9d6fc21d1f304b88ff024fc8131074a3be1cc0c147b2d1bb4193e364d0b97.exe
      PECMD**pecmd-cmd* PUTF "C:\Users\Admin\AppData\Local\Temp\~~3826132035043797866.tmp.exe",,"C:\Users\Admin\AppData\Local\Temp\4ca9d6fc21d1f304b88ff024fc8131074a3be1cc0c147b2d1bb4193e364d0b97.exe""#102|SCRIPT"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2652
    • C:\Users\Admin\AppData\Local\Temp\~~3826132035043797866.tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\~~3826132035043797866.tmp.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Windows directory
      • Suspicious use of WriteProcessMemory
      PID:1516
      • C:\Windows\svchost.exe
        "C:\Windows\svchost.exe" "C:\Users\Admin\AppData\Local\Temp\~~3826132035043797866.tmp.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:4876
        • C:\Users\Admin\AppData\Local\Temp\~~3826132035043797866.tmp.exe
          "C:\Users\Admin\AppData\Local\Temp\~~3826132035043797866.tmp.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          PID:4468
    • C:\Users\Admin\AppData\Local\Temp\4ca9d6fc21d1f304b88ff024fc8131074a3be1cc0c147b2d1bb4193e364d0b97.exe
      PECMD**pecmd-cmd* EXEC -wd:C: -hide cmd /c "C:\Users\Admin\AppData\Local\Temp\~8893492003406526727.cmd"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:452
      • C:\Windows\SYSTEM32\cmd.exe
        cmd /c "C:\Users\Admin\AppData\Local\Temp\~8893492003406526727.cmd"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2252
        • C:\Windows\system32\PING.EXE
          ping -n 2 127.0.0.1
          4⤵
          • Runs ping.exe
          PID:3696
        • C:\Windows\system32\PING.EXE
          ping -n 2 127.0.0.1
          4⤵
          • Runs ping.exe
          PID:2104
        • C:\Windows\system32\PING.EXE
          ping -n 2 127.0.0.1
          4⤵
          • Runs ping.exe
          PID:2076
        • C:\Windows\system32\PING.EXE
          ping -n 2 127.0.0.1
          4⤵
          • Runs ping.exe
          PID:4240
  • C:\Windows\svchost.exe
    C:\Windows\svchost.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Program Files directory
    PID:4148

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\~8893492003406526727.cmd

    Filesize

    404B

    MD5

    868086aaccdd8c75900f59f79ff3a930

    SHA1

    06814acaa40070d8d80c8746fd72bac81a3949f1

    SHA256

    664c9d720deb2d9cac39780d8549fd32632518eec1a904712334756b2c0bf14e

    SHA512

    c300fe647674d6c1bded7e95ad5a91e5b2dc8905a537e3b6de44873d88254a53418a7989457aa81577b9dd2a4d630b96fbf17928390b813911d4df6143c8fe4c

  • C:\Users\Admin\AppData\Local\Temp\~8893492003406526727.cmd

    Filesize

    404B

    MD5

    868086aaccdd8c75900f59f79ff3a930

    SHA1

    06814acaa40070d8d80c8746fd72bac81a3949f1

    SHA256

    664c9d720deb2d9cac39780d8549fd32632518eec1a904712334756b2c0bf14e

    SHA512

    c300fe647674d6c1bded7e95ad5a91e5b2dc8905a537e3b6de44873d88254a53418a7989457aa81577b9dd2a4d630b96fbf17928390b813911d4df6143c8fe4c

  • C:\Users\Admin\AppData\Local\Temp\~~3826132035043797866.tmp.exe

    Filesize

    1013KB

    MD5

    a681dcd188b1845fda9f078c1a3b2138

    SHA1

    c8552e6bd406397323490a2b01792f8878588183

    SHA256

    ebacd005c0b543bbf6fa1a8468285258be60c2b201ccf6e7b972f8f4645c4443

    SHA512

    350cc3e979c897af62271d6902b5598d8c5610524f45983913870f2aff62bf2552f552eb8894f74238fdfca565e769a605f48ddf3c8ff97a32f137ab5ea142bf

  • C:\Users\Admin\AppData\Local\Temp\~~3826132035043797866.tmp.exe

    Filesize

    1013KB

    MD5

    a681dcd188b1845fda9f078c1a3b2138

    SHA1

    c8552e6bd406397323490a2b01792f8878588183

    SHA256

    ebacd005c0b543bbf6fa1a8468285258be60c2b201ccf6e7b972f8f4645c4443

    SHA512

    350cc3e979c897af62271d6902b5598d8c5610524f45983913870f2aff62bf2552f552eb8894f74238fdfca565e769a605f48ddf3c8ff97a32f137ab5ea142bf

  • C:\Users\Admin\AppData\Local\Temp\~~3826132035043797866.tmp.exe

    Filesize

    1.0MB

    MD5

    1d886abc09404b92a7ff409f702ab5e3

    SHA1

    0ce1d79cecd30972f65ba36ba8764a61c59bbfaa

    SHA256

    313000d7b516c9213eea24411c564e65fd717819f678f702efeb8e485b06a66b

    SHA512

    276db90a7ad862afeb37e2a205276979603507f8d4a56b86bb114931db9f65f902e4643220737c8eb86829457273b838f26585da14cb766cfe432d2297975f92

  • C:\Users\Admin\AppData\Local\Temp\~~3826132035043797866.tmp.exe

    Filesize

    1.0MB

    MD5

    1d886abc09404b92a7ff409f702ab5e3

    SHA1

    0ce1d79cecd30972f65ba36ba8764a61c59bbfaa

    SHA256

    313000d7b516c9213eea24411c564e65fd717819f678f702efeb8e485b06a66b

    SHA512

    276db90a7ad862afeb37e2a205276979603507f8d4a56b86bb114931db9f65f902e4643220737c8eb86829457273b838f26585da14cb766cfe432d2297975f92

  • C:\Windows\svchost.exe

    Filesize

    35KB

    MD5

    13e083a9d53e948803694a603e69081a

    SHA1

    5f0926b43c970edad8b969cbec9cfebb5ad0a971

    SHA256

    305485ffc5c72617b5b4d6af8a69bc77574c05df4b21829e08bb3a6a2ffd16c5

    SHA512

    a2b4073ba2edafae7f276c2fb1279dd19f2be6dbe67ed1c9f94a082afca70286493b9c33e1fb705d7e1bab3fe66afc84173e9490751611b5c628970892d08814

  • C:\Windows\svchost.exe

    Filesize

    35KB

    MD5

    13e083a9d53e948803694a603e69081a

    SHA1

    5f0926b43c970edad8b969cbec9cfebb5ad0a971

    SHA256

    305485ffc5c72617b5b4d6af8a69bc77574c05df4b21829e08bb3a6a2ffd16c5

    SHA512

    a2b4073ba2edafae7f276c2fb1279dd19f2be6dbe67ed1c9f94a082afca70286493b9c33e1fb705d7e1bab3fe66afc84173e9490751611b5c628970892d08814

  • C:\Windows\svchost.exe

    Filesize

    35KB

    MD5

    13e083a9d53e948803694a603e69081a

    SHA1

    5f0926b43c970edad8b969cbec9cfebb5ad0a971

    SHA256

    305485ffc5c72617b5b4d6af8a69bc77574c05df4b21829e08bb3a6a2ffd16c5

    SHA512

    a2b4073ba2edafae7f276c2fb1279dd19f2be6dbe67ed1c9f94a082afca70286493b9c33e1fb705d7e1bab3fe66afc84173e9490751611b5c628970892d08814

  • memory/452-36-0x0000000000400000-0x00000000005D8000-memory.dmp

    Filesize

    1.8MB

  • memory/452-35-0x0000000000400000-0x00000000005D8000-memory.dmp

    Filesize

    1.8MB

  • memory/1516-10-0x0000000000400000-0x000000000043F000-memory.dmp

    Filesize

    252KB

  • memory/1516-5-0x0000000000400000-0x000000000043F000-memory.dmp

    Filesize

    252KB

  • memory/2652-2-0x0000000000400000-0x00000000005D8000-memory.dmp

    Filesize

    1.8MB

  • memory/3412-34-0x0000000000400000-0x00000000005D8000-memory.dmp

    Filesize

    1.8MB

  • memory/3412-0-0x0000000000400000-0x00000000005D8000-memory.dmp

    Filesize

    1.8MB

  • memory/3412-33-0x0000000000400000-0x00000000005D8000-memory.dmp

    Filesize

    1.8MB

  • memory/4148-38-0x0000000000400000-0x000000000040D000-memory.dmp

    Filesize

    52KB

  • memory/4148-43-0x0000000000400000-0x000000000040D000-memory.dmp

    Filesize

    52KB

  • memory/4148-47-0x0000000000400000-0x000000000040D000-memory.dmp

    Filesize

    52KB

  • memory/4876-17-0x0000000000400000-0x000000000040D000-memory.dmp

    Filesize

    52KB

  • memory/4876-9-0x0000000000400000-0x000000000040D000-memory.dmp

    Filesize

    52KB