Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    230s
  • max time network
    240s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/10/2023, 11:46

General

  • Target

    c8afae38821912b58591731a4198e4dd6d93cf5bd361152412189655afb29a8e.exe

  • Size

    2.9MB

  • MD5

    87b155e131e4c7b033a230b0e595f48c

  • SHA1

    b643fef8715d8d2610c04550522797a71208baaf

  • SHA256

    c8afae38821912b58591731a4198e4dd6d93cf5bd361152412189655afb29a8e

  • SHA512

    588f19de53ed7096b278b2dfc745d08479472b9b6afef64a12c9ad4ea23eb56b7153be333c0de2150a467f1b54780f6672e8fe0f174f361201f6fbacd7d504e6

  • SSDEEP

    49152:NGjG7j2KchZxCzi2bLi8RafI6Vm19pZz3+SbxQPEPIhFlZ3Lr/+UMSqmHngXuyt2:ow2z3fX8RAVm1lzu8xQPEAhHZ7r/+2qw

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 9 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Runs net.exe
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c8afae38821912b58591731a4198e4dd6d93cf5bd361152412189655afb29a8e.exe
    "C:\Users\Admin\AppData\Local\Temp\c8afae38821912b58591731a4198e4dd6d93cf5bd361152412189655afb29a8e.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2100
    • C:\Users\Admin\AppData\Local\Temp\is-NPF76.tmp\is-I6E8D.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-NPF76.tmp\is-I6E8D.tmp" /SL4 $6020E "C:\Users\Admin\AppData\Local\Temp\c8afae38821912b58591731a4198e4dd6d93cf5bd361152412189655afb29a8e.exe" 2842060 52224
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • Suspicious use of WriteProcessMemory
      PID:1632
      • C:\Windows\SysWOW64\net.exe
        "C:\Windows\system32\net.exe" helpmsg 27
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4316
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 helpmsg 27
          4⤵
            PID:2016
        • C:\Program Files (x86)\OSJMount\OSJMount.exe
          "C:\Program Files (x86)\OSJMount\OSJMount.exe" -i
          3⤵
          • Executes dropped EXE
          PID:2932
        • C:\Program Files (x86)\OSJMount\OSJMount.exe
          "C:\Program Files (x86)\OSJMount\OSJMount.exe" -s
          3⤵
          • Executes dropped EXE
          PID:4200

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\OSJMount\OSJMount.exe

      Filesize

      2.2MB

      MD5

      4746eadc0a046beaf547a5c6bda5709b

      SHA1

      adad4eacfd074ceaa7a0fdb7760346b819721b5e

      SHA256

      a171cd99b430ef890b625b53a0378693ae2014ff3d150e65f3bad367d8f84308

      SHA512

      e72ff48686028a4136d1e206c9db78e6b1050526c4bdfdb3f8b56a6fb341d37bbdfbc91dbbd8df0c379aa56b5351ce464842d568d70ff69f7b9dba29eb970df4

    • C:\Program Files (x86)\OSJMount\OSJMount.exe

      Filesize

      2.2MB

      MD5

      4746eadc0a046beaf547a5c6bda5709b

      SHA1

      adad4eacfd074ceaa7a0fdb7760346b819721b5e

      SHA256

      a171cd99b430ef890b625b53a0378693ae2014ff3d150e65f3bad367d8f84308

      SHA512

      e72ff48686028a4136d1e206c9db78e6b1050526c4bdfdb3f8b56a6fb341d37bbdfbc91dbbd8df0c379aa56b5351ce464842d568d70ff69f7b9dba29eb970df4

    • C:\Program Files (x86)\OSJMount\OSJMount.exe

      Filesize

      2.2MB

      MD5

      4746eadc0a046beaf547a5c6bda5709b

      SHA1

      adad4eacfd074ceaa7a0fdb7760346b819721b5e

      SHA256

      a171cd99b430ef890b625b53a0378693ae2014ff3d150e65f3bad367d8f84308

      SHA512

      e72ff48686028a4136d1e206c9db78e6b1050526c4bdfdb3f8b56a6fb341d37bbdfbc91dbbd8df0c379aa56b5351ce464842d568d70ff69f7b9dba29eb970df4

    • C:\Users\Admin\AppData\Local\Temp\is-NPF76.tmp\is-I6E8D.tmp

      Filesize

      652KB

      MD5

      f1b5055e1e80bf52a48683f85f9298ef

      SHA1

      26976cc0c690693084466d185c5e84da9870a778

      SHA256

      0b6381a1fc1ebc6594804042c8bf1ccfac7a9328bba3d3a487e571cbee298e50

      SHA512

      01290db6ac4dedb15d20fdc80a112b34cbce5c381c8fd262633c662e7927b314bca8063ad6109331d57feb50ed4045c05a7235347bb29edf401f9f867e9237ef

    • C:\Users\Admin\AppData\Local\Temp\is-NPF76.tmp\is-I6E8D.tmp

      Filesize

      652KB

      MD5

      f1b5055e1e80bf52a48683f85f9298ef

      SHA1

      26976cc0c690693084466d185c5e84da9870a778

      SHA256

      0b6381a1fc1ebc6594804042c8bf1ccfac7a9328bba3d3a487e571cbee298e50

      SHA512

      01290db6ac4dedb15d20fdc80a112b34cbce5c381c8fd262633c662e7927b314bca8063ad6109331d57feb50ed4045c05a7235347bb29edf401f9f867e9237ef

    • C:\Users\Admin\AppData\Local\Temp\is-T288K.tmp\_isetup\_iscrypt.dll

      Filesize

      2KB

      MD5

      a69559718ab506675e907fe49deb71e9

      SHA1

      bc8f404ffdb1960b50c12ff9413c893b56f2e36f

      SHA256

      2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

      SHA512

      e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

    • memory/1632-20-0x0000000000400000-0x00000000004B2000-memory.dmp

      Filesize

      712KB

    • memory/1632-21-0x0000000000620000-0x0000000000621000-memory.dmp

      Filesize

      4KB

    • memory/1632-33-0x0000000000400000-0x00000000004B2000-memory.dmp

      Filesize

      712KB

    • memory/1632-50-0x0000000000400000-0x00000000004B2000-memory.dmp

      Filesize

      712KB

    • memory/1632-7-0x0000000000620000-0x0000000000621000-memory.dmp

      Filesize

      4KB

    • memory/2100-17-0x0000000000400000-0x0000000000413000-memory.dmp

      Filesize

      76KB

    • memory/2100-1-0x0000000000400000-0x0000000000413000-memory.dmp

      Filesize

      76KB

    • memory/2932-39-0x0000000000400000-0x000000000063C000-memory.dmp

      Filesize

      2.2MB

    • memory/2932-40-0x0000000000400000-0x000000000063C000-memory.dmp

      Filesize

      2.2MB

    • memory/2932-43-0x0000000000400000-0x000000000063C000-memory.dmp

      Filesize

      2.2MB

    • memory/2932-44-0x0000000000400000-0x000000000063C000-memory.dmp

      Filesize

      2.2MB

    • memory/4200-47-0x0000000000400000-0x000000000063C000-memory.dmp

      Filesize

      2.2MB

    • memory/4200-48-0x0000000000400000-0x000000000063C000-memory.dmp

      Filesize

      2.2MB

    • memory/4200-54-0x0000000000400000-0x000000000063C000-memory.dmp

      Filesize

      2.2MB

    • memory/4200-57-0x0000000000400000-0x000000000063C000-memory.dmp

      Filesize

      2.2MB

    • memory/4200-60-0x0000000000400000-0x000000000063C000-memory.dmp

      Filesize

      2.2MB

    • memory/4200-63-0x0000000000400000-0x000000000063C000-memory.dmp

      Filesize

      2.2MB

    • memory/4200-66-0x0000000000400000-0x000000000063C000-memory.dmp

      Filesize

      2.2MB

    • memory/4200-69-0x0000000000400000-0x000000000063C000-memory.dmp

      Filesize

      2.2MB

    • memory/4200-73-0x0000000000840000-0x0000000000889000-memory.dmp

      Filesize

      292KB

    • memory/4200-72-0x0000000000840000-0x0000000000889000-memory.dmp

      Filesize

      292KB

    • memory/4200-74-0x0000000000400000-0x000000000063C000-memory.dmp

      Filesize

      2.2MB

    • memory/4200-77-0x0000000000400000-0x000000000063C000-memory.dmp

      Filesize

      2.2MB

    • memory/4200-83-0x0000000000840000-0x0000000000889000-memory.dmp

      Filesize

      292KB

    • memory/4200-84-0x0000000000400000-0x000000000063C000-memory.dmp

      Filesize

      2.2MB

    • memory/4200-87-0x0000000000400000-0x000000000063C000-memory.dmp

      Filesize

      2.2MB