Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
02/10/2023, 08:19
General
-
Target
219b8ecb49ab73378fc40ed08171a05765db0194ffc300e198dcbe698773f573.exe
-
Size
274KB
-
MD5
5f78b5cb52e44a34c8403dc025eb9c86
-
SHA1
06d1ed39ebf8ecab97b1e0d493508423dc6c1819
-
SHA256
219b8ecb49ab73378fc40ed08171a05765db0194ffc300e198dcbe698773f573
-
SHA512
37fc19419918f6cedb14267a395babbff6ed649741b31c7bbdc50a4598302d2ebf2d7ab591393babeefb63e816f6b798b9d228d77a3ab01ddb086d8e77160578
-
SSDEEP
6144:abTirrfykiiUjh6QH/cEOkCybEaQRXr9HNdvOa:aPcrfR6ZnOkx2LIa
Malware Config
Signatures
-
Drops file in Drivers directory 9 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
UPX packed file 8 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Unexpected DNS network traffic destination 6 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
VMProtect packed file 4 IoCs
Detects executables packed with VMProtect commercial packer.
-
Drops file in System32 directory 9 IoCs
-
Drops file in Program Files directory 21 IoCs
-
Drops file in Windows directory 10 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Delays execution with timeout.exe 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: LoadsDriver 59 IoCs
-
Suspicious use of AdjustPrivilegeToken 21 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\219b8ecb49ab73378fc40ed08171a05765db0194ffc300e198dcbe698773f573.exe"C:\Users\Admin\AppData\Local\Temp\219b8ecb49ab73378fc40ed08171a05765db0194ffc300e198dcbe698773f573.exe"2⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 & del /Q /F "C:\Users\Admin\AppData\Local\Temp\219b8ecb49ab73378fc40ed08171a05765db0194ffc300e198dcbe698773f573.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout /t 14⤵
- Delays execution with timeout.exe
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD52818084a9e9c1a6ea4afcabc2addedaa
SHA113c59025d416f769fffeb9e239b2e16c8b5f7868
SHA2566f4fa276959221d8e18c0531d8d6e374bc3630f0d2a9cb3bc53d9332b31fe4f0
SHA5122c0222371add59a2f3dc64fc5fc8e4a72076c279c2f8697fe84afc948b2d9f8033b5e47a67f2167fc65b6749c2c558b672fad16b683f5d4769678a434821577b
-
Filesize
1KB
MD591a2dd953cb6f8edfa3c5a3b7c680f68
SHA145fabdf01269f6ff34cee0a3304d97e8dbb74486
SHA2569806b25d68e91516099c89be4870be1aadc6be2de5611dc24e426026ebf5ffbd
SHA512f1555dc73fe7e5a137385fbb158c587651345f2cb8c28ff11590fe65accdb8cf753b775e804f3f33d30e4c3cd94331356715f63b7856ad567ac98bec639f0bda
-
Filesize
599B
MD5a87c1c0bd5b4f68755a9cc6b52c6c2be
SHA123d9859148cd758aa9eac8e5e5b3fa7b16968b28
SHA25644b9e82998f53b67924b619840930d3c0e22877283dd612da9b55a36ea034666
SHA51293c5fb66c5a95440be30a29ec04a09e3a174af66e584bd8fbcb2aabe74d643fba82f5ec6915b5d1fa3ba4d3eae7c60f8d5dc46438e420b4a46924c203e601cac
-
Filesize
484B
MD551caa4a21324fde45fd8efda093e8582
SHA1b74eaf01caa8c2a71384c192161ac730de672352
SHA256c4fdc69ff617fea0d396a913288c46db42e926e39a788ff55113f3b208198789
SHA512d119ea45dae3c0d8fabe6ec24034e02d0f63b400c9d1577b8f8e20dbc5a2e82cf43b56523ddd032476aa20c46627a732cdd9b355fb20d41399a24344bbe1f7b2
-
Filesize
482B
MD58b961725f00df1e5bff7251100656833
SHA16930180a7e48e3980499bc3393a4317ad19d4b72
SHA256dc7c55cb96eb93d5aa66d2cbb0b34e9bcd2c992f2bbc956e541b97c011aa531a
SHA512e21c6aa32303444cb62a1e596486d895c6750cb5d54fb4302551984987caa6c0aa1f8753ce0367fc73085a39da5a75325bc594bdb60a9158a6f55b482103fc60
-
Filesize
504B
MD54253995ec9af5c9cde64ef9a5eb8e3b4
SHA11bfed69d683cfe7d0aaa2b946709d46f76ae518b
SHA2563be6405acb58a5990c6ed69bef73bf08e163fbd154d4e0aaf8646ee0b83d81ce
SHA512dd220dcee09e9cc745e62dde876de91c2649c0b73bfe7b784acd2edd05c575c84efe89dd275357640900de50d06f1ba622243836603faddb5a1a6ba4f5cdf640
-
Filesize
415KB
MD564bc1983743c584a9ad09dacf12792e5
SHA10f14098f523d21f11129c4df09451413ddff6d61
SHA256057ec356f1577fe86b706e5aeb74e3bdd6fe04d22586fecf69b866f8f72db7f5
SHA5129ab4ddb64bd97dd1a7ee15613a258edf1d2eba880a0896a91487c47a32c9bd1118cde18211053a5b081216d123d5f901b454a525cbba01d8067c31babd8c8c3c
-
Filesize
447KB
MD5587168dfb4f83975c6491b896e7ca89f
SHA1657108fc554b8d696a49d95746b7a9eb919915ea
SHA256529d5a31f6268d0a46bd1df0c236d8f9345cb71e53df1633d14a0cff247e18c5
SHA5127292a29fdcbed7fbe1f927479699e3982f84ba3d3b31496cc7635c94d31ee17413a96b1135e19aef9d24839b8919c8364898e990e6f6d48c9ce538a44433a32a
-
Filesize
447KB
MD5d15f5f23df8036bd5089ce8d151b0e0d
SHA14066ff4d92ae189d92fcdfb8c11a82cc9db56bb2
SHA256f2c40dde6f40beaa3c283b66791ff27e6f06d66c8dd6eff5262f51e02ee26520
SHA512feaec8a00346b0a74c530859785e1b280da5833bf3113083bf4664ebee85b14ceca648499f36d266d329d602349f9ad0fc21a10e605377b3a2c24b456f3a9bd9
-
Filesize
415KB
MD5f5fb6bb3a700a814054ce952e8c3b6a1
SHA13fa8a291e42667ccde09064ed1cf4f8582c3710f
SHA256d186b3eedd548e159ee39c075acb4d145539ecfbeb647bda3d821741c6e72379
SHA512c0b894e30588f23d80f6308bb6573c9b55c52c6d0889cae08e811da8db6e5fa59401e821781812f714674f0346893dffce2fdd38ca696762d98466346404201a
-
Filesize
12KB
-
Filesize
16KB
-
Filesize
700KB
-
Filesize
12KB
-
Filesize
12KB
-
Filesize
700KB
-
Filesize
4KB
-
Filesize
160KB
-
Filesize
560KB
-
Filesize
560KB
-
Filesize
560KB
-
Filesize
560KB
-
Filesize
560KB
-
Filesize
560KB
-
Filesize
560KB
-
Filesize
560KB
-
Filesize
4KB
-
Filesize
12KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
700KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
708KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
700KB
-
Filesize
4KB
-
Filesize
708KB
-
Filesize
4KB
-
Filesize
12KB
-
Filesize
4KB
-
Filesize
12KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
16KB
-
Filesize
708KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB