Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
230s -
max time network
240s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
11/10/2023, 11:46
Static task
static1
Behavioral task
behavioral1
Sample
c8afae38821912b58591731a4198e4dd6d93cf5bd361152412189655afb29a8e.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
c8afae38821912b58591731a4198e4dd6d93cf5bd361152412189655afb29a8e.exe
Resource
win10v2004-20230915-en
General
-
Target
c8afae38821912b58591731a4198e4dd6d93cf5bd361152412189655afb29a8e.exe
-
Size
2.9MB
-
MD5
87b155e131e4c7b033a230b0e595f48c
-
SHA1
b643fef8715d8d2610c04550522797a71208baaf
-
SHA256
c8afae38821912b58591731a4198e4dd6d93cf5bd361152412189655afb29a8e
-
SHA512
588f19de53ed7096b278b2dfc745d08479472b9b6afef64a12c9ad4ea23eb56b7153be333c0de2150a467f1b54780f6672e8fe0f174f361201f6fbacd7d504e6
-
SSDEEP
49152:NGjG7j2KchZxCzi2bLi8RafI6Vm19pZz3+SbxQPEPIhFlZ3Lr/+UMSqmHngXuyt2:ow2z3fX8RAVm1lzu8xQPEAhHZ7r/+2qw
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 1632 is-I6E8D.tmp 2932 OSJMount.exe 4200 OSJMount.exe -
Loads dropped DLL 1 IoCs
pid Process 1632 is-I6E8D.tmp -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 9 IoCs
description ioc Process File created C:\Program Files (x86)\OSJMount\is-CN0J8.tmp is-I6E8D.tmp File created C:\Program Files (x86)\OSJMount\is-CU3HK.tmp is-I6E8D.tmp File created C:\Program Files (x86)\OSJMount\is-0VQTQ.tmp is-I6E8D.tmp File created C:\Program Files (x86)\OSJMount\is-77N06.tmp is-I6E8D.tmp File created C:\Program Files (x86)\OSJMount\is-04H1C.tmp is-I6E8D.tmp File created C:\Program Files (x86)\OSJMount\unins000.dat is-I6E8D.tmp File created C:\Program Files (x86)\OSJMount\is-EF8NP.tmp is-I6E8D.tmp File opened for modification C:\Program Files (x86)\OSJMount\unins000.dat is-I6E8D.tmp File opened for modification C:\Program Files (x86)\OSJMount\OSJMount.exe is-I6E8D.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs net.exe
-
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 2100 wrote to memory of 1632 2100 c8afae38821912b58591731a4198e4dd6d93cf5bd361152412189655afb29a8e.exe 89 PID 2100 wrote to memory of 1632 2100 c8afae38821912b58591731a4198e4dd6d93cf5bd361152412189655afb29a8e.exe 89 PID 2100 wrote to memory of 1632 2100 c8afae38821912b58591731a4198e4dd6d93cf5bd361152412189655afb29a8e.exe 89 PID 1632 wrote to memory of 4316 1632 is-I6E8D.tmp 91 PID 1632 wrote to memory of 4316 1632 is-I6E8D.tmp 91 PID 1632 wrote to memory of 4316 1632 is-I6E8D.tmp 91 PID 1632 wrote to memory of 2932 1632 is-I6E8D.tmp 93 PID 1632 wrote to memory of 2932 1632 is-I6E8D.tmp 93 PID 1632 wrote to memory of 2932 1632 is-I6E8D.tmp 93 PID 4316 wrote to memory of 2016 4316 net.exe 94 PID 4316 wrote to memory of 2016 4316 net.exe 94 PID 4316 wrote to memory of 2016 4316 net.exe 94 PID 1632 wrote to memory of 4200 1632 is-I6E8D.tmp 95 PID 1632 wrote to memory of 4200 1632 is-I6E8D.tmp 95 PID 1632 wrote to memory of 4200 1632 is-I6E8D.tmp 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\c8afae38821912b58591731a4198e4dd6d93cf5bd361152412189655afb29a8e.exe"C:\Users\Admin\AppData\Local\Temp\c8afae38821912b58591731a4198e4dd6d93cf5bd361152412189655afb29a8e.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\is-NPF76.tmp\is-I6E8D.tmp"C:\Users\Admin\AppData\Local\Temp\is-NPF76.tmp\is-I6E8D.tmp" /SL4 $6020E "C:\Users\Admin\AppData\Local\Temp\c8afae38821912b58591731a4198e4dd6d93cf5bd361152412189655afb29a8e.exe" 2842060 522242⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 273⤵
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 274⤵PID:2016
-
-
-
C:\Program Files (x86)\OSJMount\OSJMount.exe"C:\Program Files (x86)\OSJMount\OSJMount.exe" -i3⤵
- Executes dropped EXE
PID:2932
-
-
C:\Program Files (x86)\OSJMount\OSJMount.exe"C:\Program Files (x86)\OSJMount\OSJMount.exe" -s3⤵
- Executes dropped EXE
PID:4200
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.2MB
MD54746eadc0a046beaf547a5c6bda5709b
SHA1adad4eacfd074ceaa7a0fdb7760346b819721b5e
SHA256a171cd99b430ef890b625b53a0378693ae2014ff3d150e65f3bad367d8f84308
SHA512e72ff48686028a4136d1e206c9db78e6b1050526c4bdfdb3f8b56a6fb341d37bbdfbc91dbbd8df0c379aa56b5351ce464842d568d70ff69f7b9dba29eb970df4
-
Filesize
2.2MB
MD54746eadc0a046beaf547a5c6bda5709b
SHA1adad4eacfd074ceaa7a0fdb7760346b819721b5e
SHA256a171cd99b430ef890b625b53a0378693ae2014ff3d150e65f3bad367d8f84308
SHA512e72ff48686028a4136d1e206c9db78e6b1050526c4bdfdb3f8b56a6fb341d37bbdfbc91dbbd8df0c379aa56b5351ce464842d568d70ff69f7b9dba29eb970df4
-
Filesize
2.2MB
MD54746eadc0a046beaf547a5c6bda5709b
SHA1adad4eacfd074ceaa7a0fdb7760346b819721b5e
SHA256a171cd99b430ef890b625b53a0378693ae2014ff3d150e65f3bad367d8f84308
SHA512e72ff48686028a4136d1e206c9db78e6b1050526c4bdfdb3f8b56a6fb341d37bbdfbc91dbbd8df0c379aa56b5351ce464842d568d70ff69f7b9dba29eb970df4
-
Filesize
652KB
MD5f1b5055e1e80bf52a48683f85f9298ef
SHA126976cc0c690693084466d185c5e84da9870a778
SHA2560b6381a1fc1ebc6594804042c8bf1ccfac7a9328bba3d3a487e571cbee298e50
SHA51201290db6ac4dedb15d20fdc80a112b34cbce5c381c8fd262633c662e7927b314bca8063ad6109331d57feb50ed4045c05a7235347bb29edf401f9f867e9237ef
-
Filesize
652KB
MD5f1b5055e1e80bf52a48683f85f9298ef
SHA126976cc0c690693084466d185c5e84da9870a778
SHA2560b6381a1fc1ebc6594804042c8bf1ccfac7a9328bba3d3a487e571cbee298e50
SHA51201290db6ac4dedb15d20fdc80a112b34cbce5c381c8fd262633c662e7927b314bca8063ad6109331d57feb50ed4045c05a7235347bb29edf401f9f867e9237ef
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63