Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    56s
  • max time network
    120s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/10/2023, 14:34

General

  • Target

    3a6e2de5b3de6e67229b11f6d74a4f9af70ccec85c2573a905df5a1f84a35446.exe

  • Size

    1.4MB

  • MD5

    5673c04d81969a6603184069b6846213

  • SHA1

    49fdd9c69f1c281d94486029dfaa5108dfc168bf

  • SHA256

    3a6e2de5b3de6e67229b11f6d74a4f9af70ccec85c2573a905df5a1f84a35446

  • SHA512

    c381630f7c9c72ca538679bef37b9e966ec2f906bd5eb36a42069e3742ddd57bd958d867ede257edc3244e40fa3a6c65c10cddd07dddfd89cc2085eef13291cb

  • SSDEEP

    24576:rq5TfcdHj4fmb9Ve9u2qTPIMeYyBMLlQjzCEzKJ9TtLzCwn1jAh0zQJ9TtDRli:rUTsamC9uxKjY5x1jAF5i

Score
7/10
upx

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • AutoIT Executable 2 IoCs

    AutoIT scripts compiled to PE executables.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3a6e2de5b3de6e67229b11f6d74a4f9af70ccec85c2573a905df5a1f84a35446.exe
    "C:\Users\Admin\AppData\Local\Temp\3a6e2de5b3de6e67229b11f6d74a4f9af70ccec85c2573a905df5a1f84a35446.exe"
    1⤵
    • Checks computer location settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4368
    • C:\Users\Admin\AppData\Local\Temp\DMR\dmr_72.exe
      "C:\Users\Admin\AppData\Local\Temp\DMR\dmr_72.exe" -install -54417509 -chipderedesign -a80c61fa351a416282afb39d6c109d6c - -BLUB2 -qpytxkehzrzdqslc -4368
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:952

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\DMR\dmr_72.exe

    Filesize

    508KB

    MD5

    da9e9a98a7cf8da14f9e3c9973328fb7

    SHA1

    42e37cbfa37877d247ebd37d9553cb6224d6bee6

    SHA256

    c1116053bbac19ab273dc120c2984c235d116cdcc9e3ac437951b55465fd7063

    SHA512

    ce98f1984a3db301df7c1078dc6014fc1a03a1643c5635ef59775ee8019fbae4e07c16e99ec3d1998f45947d57493ada96e5116c359a590b14573833eec17343

  • C:\Users\Admin\AppData\Local\Temp\DMR\dmr_72.exe

    Filesize

    508KB

    MD5

    da9e9a98a7cf8da14f9e3c9973328fb7

    SHA1

    42e37cbfa37877d247ebd37d9553cb6224d6bee6

    SHA256

    c1116053bbac19ab273dc120c2984c235d116cdcc9e3ac437951b55465fd7063

    SHA512

    ce98f1984a3db301df7c1078dc6014fc1a03a1643c5635ef59775ee8019fbae4e07c16e99ec3d1998f45947d57493ada96e5116c359a590b14573833eec17343

  • C:\Users\Admin\AppData\Local\Temp\DMR\dmr_72.exe

    Filesize

    508KB

    MD5

    da9e9a98a7cf8da14f9e3c9973328fb7

    SHA1

    42e37cbfa37877d247ebd37d9553cb6224d6bee6

    SHA256

    c1116053bbac19ab273dc120c2984c235d116cdcc9e3ac437951b55465fd7063

    SHA512

    ce98f1984a3db301df7c1078dc6014fc1a03a1643c5635ef59775ee8019fbae4e07c16e99ec3d1998f45947d57493ada96e5116c359a590b14573833eec17343

  • C:\Users\Admin\AppData\Local\Temp\DMR\qpytxkehzrzdqslc.dat

    Filesize

    161B

    MD5

    c800879c1c73dbbb198fc42669646aa7

    SHA1

    ab63307099961d43ebb2b64809b7f39d030bab7b

    SHA256

    4c4dd62b579e43dc1c4cf859299df3023409492281f173bc5c3d2cc00bb782d7

    SHA512

    0bc20e0c61f46a6c8eb0d8c276edc1f1901ac2f2800199d78490ba0b3c096e4cbf08a175ee19f663d7c13d56e7b6852f32478ea6c85f7829f6fd2880023213df

  • memory/952-13-0x00000000003B0000-0x0000000000434000-memory.dmp

    Filesize

    528KB

  • memory/952-15-0x00007FFEF2820000-0x00007FFEF32E1000-memory.dmp

    Filesize

    10.8MB

  • memory/952-16-0x000000001B1B0000-0x000000001B1C0000-memory.dmp

    Filesize

    64KB

  • memory/952-17-0x000000001B1B0000-0x000000001B1C0000-memory.dmp

    Filesize

    64KB

  • memory/952-18-0x000000001B1B0000-0x000000001B1C0000-memory.dmp

    Filesize

    64KB

  • memory/952-19-0x000000001B1B0000-0x000000001B1C0000-memory.dmp

    Filesize

    64KB

  • memory/952-22-0x00007FFEF2820000-0x00007FFEF32E1000-memory.dmp

    Filesize

    10.8MB

  • memory/4368-0-0x00000000009C0000-0x0000000000CBD000-memory.dmp

    Filesize

    3.0MB

  • memory/4368-20-0x00000000009C0000-0x0000000000CBD000-memory.dmp

    Filesize

    3.0MB

  • memory/4368-23-0x00000000009C0000-0x0000000000CBD000-memory.dmp

    Filesize

    3.0MB