Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    142s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/10/2023, 14:18

General

  • Target

    3cde62c0d1ef60c043ccf1fc3dba7a22_JC.exe

  • Size

    356KB

  • MD5

    3cde62c0d1ef60c043ccf1fc3dba7a22

  • SHA1

    c05cc6eca17c0dac2df50368b6e62f0fd3a80c8a

  • SHA256

    224acb5f139a1ebf8add7f965c96b47c82e26f10a556e45361d0bc71308417ed

  • SHA512

    61f5f55ebb671ea2e07158f516ced63c119008e52bf7498e6d0c132cfbca2f648220c4521d0fed0b422b75ef937aa9577bd4d5fa16b0eb79804d569ca2b82cd7

  • SSDEEP

    6144:VuIlWqB+ihabs7Ch9KwyF5LeLodp2D1Mmakda0qL0qEks3ih1XGWy:Y6Wq4aaE6KwyF5L0Y2D1PqL0qC3c2t

Score
7/10
upx

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3cde62c0d1ef60c043ccf1fc3dba7a22_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\3cde62c0d1ef60c043ccf1fc3dba7a22_JC.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3496
    • C:\Windows\SysWOW64\commander.exe
      commander.exe /C at 9:00 /interactive C:\Windows\svhost.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:2716
      • C:\Windows\SysWOW64\at.exe
        at 9:00 /interactive C:\Windows\svhost.exe
        3⤵
          PID:4948
      • C:\Windows\SysWOW64\commander.exe
        commander.exe /C schtasks /run /tn at1
        2⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:5004
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /run /tn at1
          3⤵
            PID:4912
      • C:\Windows\system32\rundll32.exe
        "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
        1⤵
          PID:832
        • C:\Windows\System32\svchost.exe
          C:\Windows\System32\svchost.exe -k UnistackSvcGroup
          1⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:4224

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Windows\SysWOW64\commander.exe

          Filesize

          231KB

          MD5

          e6dabddee3cc5b3c84b2d60074f495fa

          SHA1

          0b2fa798a50b9301dbd4061fd8384b3cfecf44cd

          SHA256

          6c605598a0b4e6e885ef8649fc98ee7c22663010f5012e6c74394adf1408d5be

          SHA512

          0fb8220edef2d391115eb4defe2e67241f8b4ce76ecc3d2b3307d2761f578d1ce7e979132080bd7d5f462262cf9c38fd08cbf9bf6b26ff3b31109a26b3c3ea2c

        • C:\Windows\SysWOW64\commander.exe

          Filesize

          231KB

          MD5

          e6dabddee3cc5b3c84b2d60074f495fa

          SHA1

          0b2fa798a50b9301dbd4061fd8384b3cfecf44cd

          SHA256

          6c605598a0b4e6e885ef8649fc98ee7c22663010f5012e6c74394adf1408d5be

          SHA512

          0fb8220edef2d391115eb4defe2e67241f8b4ce76ecc3d2b3307d2761f578d1ce7e979132080bd7d5f462262cf9c38fd08cbf9bf6b26ff3b31109a26b3c3ea2c

        • memory/3496-0-0x0000000000400000-0x00000000004BA000-memory.dmp

          Filesize

          744KB

        • memory/3496-8-0x0000000000400000-0x00000000004BA000-memory.dmp

          Filesize

          744KB

        • memory/4224-9-0x0000015FB2940000-0x0000015FB2950000-memory.dmp

          Filesize

          64KB

        • memory/4224-25-0x0000015FB2A40000-0x0000015FB2A50000-memory.dmp

          Filesize

          64KB

        • memory/4224-41-0x0000015FBAD80000-0x0000015FBAD81000-memory.dmp

          Filesize

          4KB

        • memory/4224-43-0x0000015FBADB0000-0x0000015FBADB1000-memory.dmp

          Filesize

          4KB

        • memory/4224-44-0x0000015FBADB0000-0x0000015FBADB1000-memory.dmp

          Filesize

          4KB

        • memory/4224-45-0x0000015FBAEC0000-0x0000015FBAEC1000-memory.dmp

          Filesize

          4KB