Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

3

c8d39f53be...2d.exe

windows7-x64

8

c8d39f53be...2d.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    151s
  • max time network
    136s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/10/2023, 14:27

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    c8d39f53be5d8f577d4a285431d4179aafb98dc28e6146285ea068a2a0b6042d.exe

  • Size

    3.3MB

  • MD5

    6e6f4aa904f7394e7f1306c0d8ca17da

  • SHA1

    ce4d840724552ed1d62915835109cab1acf9a20b

  • SHA256

    c8d39f53be5d8f577d4a285431d4179aafb98dc28e6146285ea068a2a0b6042d

  • SHA512

    60c2a6a2995f3c9c9cb14e7d5569e37e7c42f337bf9409f9c9daa1e21cf2fbe6ec2488ba18b5bc996b31c74a3dd5706b6de937cb8c6bbb9be718be2839d2652a

  • SSDEEP

    49152:D7TvfU+8X9GrNOsva5RbKhF3ANkTTloGAv0+KSQ+vTvAsnWo7:Q+8X9G3vP3AMHt+jrjnX7

Score
8/10
persistence

Malware Config

Signatures

  • Modifies Installed Components in the registry 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 10 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 30 IoCs
  • Suspicious use of FindShellTrayWindow 24 IoCs
  • Suspicious use of SendNotifyMessage 13 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\c8d39f53be5d8f577d4a285431d4179aafb98dc28e6146285ea068a2a0b6042d.exe
    "C:\Users\Admin\AppData\Local\Temp\c8d39f53be5d8f577d4a285431d4179aafb98dc28e6146285ea068a2a0b6042d.exe"
    1⤵
      PID:1000
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:5096
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:3108
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Checks SCSI registry key(s)
      • Modifies registry class
      PID:2840
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:2112
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:4176
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
        PID:4156
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:2600
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:2512
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:4156
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:908
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies registry class
        PID:636

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\QVHQQQV3\microsoft.windows[1].xml
        Filesize

        97B

        MD5

        e403893cb1eff096a3a681a4e18bfc57

        SHA1

        2b77a9b05a98def1630f2d224077297c5aa719bc

        SHA256

        5a67e1471e50d3e01653afe33268399829528a3d7c0e41dcd2d1e0c66670d066

        SHA512

        c8da1987035c0ee26cf94ecac9436d2e4abe7a512471231666e7e1e25b48b9aa033ad4a68075e7f4a83c9a5229718906a15dec6a15c57d39a7e6d3bd99ecd564

        Download Submit

      • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{0A6AC72E-ED8C-C16F-38B6-05831557CF24}
        Filesize

        36KB

        MD5

        8aaad0f4eb7d3c65f81c6e6b496ba889

        SHA1

        231237a501b9433c292991e4ec200b25c1589050

        SHA256

        813c66ce7dec4cff9c55fb6f809eab909421e37f69ff30e4acaa502365a32bd1

        SHA512

        1a83ce732dc47853bf6e8f4249054f41b0dea8505cda73433b37dfa16114f27bfed3b4b3ba580aa9d53c3dcc8d48bf571a45f7c0468e6a0f2a227a7e59e17d62

        Download Submit

      • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_charmap_exe
        Filesize

        36KB

        MD5

        406347732c383e23c3b1af590a47bccd

        SHA1

        fae764f62a396f2503dd81eefd3c7f06a5fb8e5f

        SHA256

        e0a9f5c75706dc79a44d0c890c841b2b0b25af4ee60d0a16a7356b067210038e

        SHA512

        18905eaad8184bb3a7b0fe21ff37ed2ee72a3bd24bb90cbfcad222cf09e2fa74e886d5c687b21d81cd3aec1e6c05891c24f67a8f82bafd2aceb0e0dcb7672ce7

        Download Submit

      • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\QVHQQQV3\microsoft.windows[1].xml
        Filesize

        97B

        MD5

        e403893cb1eff096a3a681a4e18bfc57

        SHA1

        2b77a9b05a98def1630f2d224077297c5aa719bc

        SHA256

        5a67e1471e50d3e01653afe33268399829528a3d7c0e41dcd2d1e0c66670d066

        SHA512

        c8da1987035c0ee26cf94ecac9436d2e4abe7a512471231666e7e1e25b48b9aa033ad4a68075e7f4a83c9a5229718906a15dec6a15c57d39a7e6d3bd99ecd564

        Download Submit

      • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\QVHQQQV3\microsoft.windows[1].xml
        Filesize

        97B

        MD5

        e403893cb1eff096a3a681a4e18bfc57

        SHA1

        2b77a9b05a98def1630f2d224077297c5aa719bc

        SHA256

        5a67e1471e50d3e01653afe33268399829528a3d7c0e41dcd2d1e0c66670d066

        SHA512

        c8da1987035c0ee26cf94ecac9436d2e4abe7a512471231666e7e1e25b48b9aa033ad4a68075e7f4a83c9a5229718906a15dec6a15c57d39a7e6d3bd99ecd564

        Download Submit

      • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\QVHQQQV3\microsoft.windows[1].xml
        Filesize

        97B

        MD5

        e403893cb1eff096a3a681a4e18bfc57

        SHA1

        2b77a9b05a98def1630f2d224077297c5aa719bc

        SHA256

        5a67e1471e50d3e01653afe33268399829528a3d7c0e41dcd2d1e0c66670d066

        SHA512

        c8da1987035c0ee26cf94ecac9436d2e4abe7a512471231666e7e1e25b48b9aa033ad4a68075e7f4a83c9a5229718906a15dec6a15c57d39a7e6d3bd99ecd564

        Download Submit

      • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\QVHQQQV3\microsoft.windows[1].xml
        Filesize

        97B

        MD5

        e403893cb1eff096a3a681a4e18bfc57

        SHA1

        2b77a9b05a98def1630f2d224077297c5aa719bc

        SHA256

        5a67e1471e50d3e01653afe33268399829528a3d7c0e41dcd2d1e0c66670d066

        SHA512

        c8da1987035c0ee26cf94ecac9436d2e4abe7a512471231666e7e1e25b48b9aa033ad4a68075e7f4a83c9a5229718906a15dec6a15c57d39a7e6d3bd99ecd564

        Download Submit

      • memory/908-118-0x0000020D9B480000-0x0000020D9B4A0000-memory.dmp

        Filesize

        128KB

        Download

      • memory/908-114-0x0000020D9B030000-0x0000020D9B050000-memory.dmp

        Filesize

        128KB

        Download

      • memory/908-111-0x0000020D9B070000-0x0000020D9B090000-memory.dmp

        Filesize

        128KB

        Download

      • memory/2512-66-0x00000206212E0000-0x0000020621300000-memory.dmp

        Filesize

        128KB

        Download

      • memory/2512-68-0x00000206212A0000-0x00000206212C0000-memory.dmp

        Filesize

        128KB

        Download

      • memory/2512-70-0x00000206218C0000-0x00000206218E0000-memory.dmp

        Filesize

        128KB

        Download

      • memory/2600-55-0x000001B545FE0000-0x000001B546000000-memory.dmp

        Filesize

        128KB

        Download

      • memory/2600-51-0x000001B5459D0000-0x000001B5459F0000-memory.dmp

        Filesize

        128KB

        Download

      • memory/2600-48-0x000001B545C20000-0x000001B545C40000-memory.dmp

        Filesize

        128KB

        Download

      • memory/4156-37-0x000001ABC1580000-0x000001ABC15A0000-memory.dmp

        Filesize

        128KB

        Download

      • memory/4156-93-0x000001653D080000-0x000001653D0A0000-memory.dmp

        Filesize

        128KB

        Download

      • memory/4156-97-0x000001653D4D0000-0x000001653D4F0000-memory.dmp

        Filesize

        128KB

        Download

      • memory/4156-90-0x000001653D0C0000-0x000001653D0E0000-memory.dmp

        Filesize

        128KB

        Download

      • memory/4156-34-0x000001ABC1130000-0x000001ABC1150000-memory.dmp

        Filesize

        128KB

        Download

      • memory/4156-31-0x000001ABC1170000-0x000001ABC1190000-memory.dmp

        Filesize

        128KB

        Download

      • memory/4176-10-0x000002D0BDB90000-0x000002D0BDBB0000-memory.dmp

        Filesize

        128KB

        Download

      • memory/4176-14-0x000002D0BE030000-0x000002D0BE050000-memory.dmp

        Filesize

        128KB

        Download

      • memory/4176-12-0x000002D0BDB50000-0x000002D0BDB70000-memory.dmp

        Filesize

        128KB

        Download