Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    172s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/10/2023, 18:03

General

  • Target

    f49aaf1ed62dcd023375df4042aee4fe7602f3b797c6a40ff8d778eeff8571d9.exe

  • Size

    1.2MB

  • MD5

    62a86a77085baa4ca3e800e43b7f2849

  • SHA1

    a80cbeb997a512f14f619bf4cac8c27cca613f73

  • SHA256

    f49aaf1ed62dcd023375df4042aee4fe7602f3b797c6a40ff8d778eeff8571d9

  • SHA512

    11d55a3487527248bd694b00640fdede124e232d19bed4b082ba6eb89f301b6f882a09f30ee5022c95e830dccb0d230555fd3a750018e37aebaa81860408e239

  • SSDEEP

    24576:vlAzF5dI2vYKWb6Dsq3P3K4XY0esxUAUbwvaoslG45wyvCj8z7mwb:voep0hUbSklG45lvMcb

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 9 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 9 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of SetWindowsHookEx 18 IoCs
  • Suspicious use of WriteProcessMemory 48 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f49aaf1ed62dcd023375df4042aee4fe7602f3b797c6a40ff8d778eeff8571d9.exe
    "C:\Users\Admin\AppData\Local\Temp\f49aaf1ed62dcd023375df4042aee4fe7602f3b797c6a40ff8d778eeff8571d9.exe"
    1⤵
    • Checks computer location settings
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4632
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
      2⤵
      • Checks computer location settings
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:1168
      • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:976
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
      2⤵
      • Checks computer location settings
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:1412
      • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1516
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
      2⤵
      • Checks computer location settings
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:3336
      • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:3392
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
      2⤵
      • Checks computer location settings
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:4412
      • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:3760
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
      2⤵
      • Checks computer location settings
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:1676
      • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:3312
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
      2⤵
      • Checks computer location settings
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:548
      • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1464
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
      2⤵
      • Checks computer location settings
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:3448
      • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:3888
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
      2⤵
      • Checks computer location settings
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2660
      • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1500

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs

    Filesize

    753B

    MD5

    070398abde87329dc99086508eeb282b

    SHA1

    b79fa0849c4733cc30399dad0be83942963f39fd

    SHA256

    34d858f56ceb0424d9de15db0319fabdb2eaa3f870161874846ff0dd2f95d9e5

    SHA512

    c322d9cf1d02baeccfd64fb52fe29e19adb07bbb7aaf39916548309280f9e66d3e5fead309fa2ce779f03ca89775173eecb3fc2755a3a04dbc6ec786fae12a2a

  • C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs

    Filesize

    753B

    MD5

    070398abde87329dc99086508eeb282b

    SHA1

    b79fa0849c4733cc30399dad0be83942963f39fd

    SHA256

    34d858f56ceb0424d9de15db0319fabdb2eaa3f870161874846ff0dd2f95d9e5

    SHA512

    c322d9cf1d02baeccfd64fb52fe29e19adb07bbb7aaf39916548309280f9e66d3e5fead309fa2ce779f03ca89775173eecb3fc2755a3a04dbc6ec786fae12a2a

  • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe

    Filesize

    1.2MB

    MD5

    63f52005e41331b364137473d742cd39

    SHA1

    6ecfbe641b18caaf0e971a580c3e022e5e66bff7

    SHA256

    06eaf0e0a560ce4fa383ce769c0810479a96f942e9fc21ea506b2a2ab58b387a

    SHA512

    24897ce908d0839c4fa4a7c431f3e0bd911a36086d192c7c660ad2c6e5cca157a5a673bfae751412889d33796c090647be4a64901c0caa349d40690f54e4ca88

  • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe

    Filesize

    1.2MB

    MD5

    63f52005e41331b364137473d742cd39

    SHA1

    6ecfbe641b18caaf0e971a580c3e022e5e66bff7

    SHA256

    06eaf0e0a560ce4fa383ce769c0810479a96f942e9fc21ea506b2a2ab58b387a

    SHA512

    24897ce908d0839c4fa4a7c431f3e0bd911a36086d192c7c660ad2c6e5cca157a5a673bfae751412889d33796c090647be4a64901c0caa349d40690f54e4ca88

  • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe

    Filesize

    1.2MB

    MD5

    63f52005e41331b364137473d742cd39

    SHA1

    6ecfbe641b18caaf0e971a580c3e022e5e66bff7

    SHA256

    06eaf0e0a560ce4fa383ce769c0810479a96f942e9fc21ea506b2a2ab58b387a

    SHA512

    24897ce908d0839c4fa4a7c431f3e0bd911a36086d192c7c660ad2c6e5cca157a5a673bfae751412889d33796c090647be4a64901c0caa349d40690f54e4ca88

  • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe

    Filesize

    1.2MB

    MD5

    63f52005e41331b364137473d742cd39

    SHA1

    6ecfbe641b18caaf0e971a580c3e022e5e66bff7

    SHA256

    06eaf0e0a560ce4fa383ce769c0810479a96f942e9fc21ea506b2a2ab58b387a

    SHA512

    24897ce908d0839c4fa4a7c431f3e0bd911a36086d192c7c660ad2c6e5cca157a5a673bfae751412889d33796c090647be4a64901c0caa349d40690f54e4ca88

  • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe

    Filesize

    1.2MB

    MD5

    63f52005e41331b364137473d742cd39

    SHA1

    6ecfbe641b18caaf0e971a580c3e022e5e66bff7

    SHA256

    06eaf0e0a560ce4fa383ce769c0810479a96f942e9fc21ea506b2a2ab58b387a

    SHA512

    24897ce908d0839c4fa4a7c431f3e0bd911a36086d192c7c660ad2c6e5cca157a5a673bfae751412889d33796c090647be4a64901c0caa349d40690f54e4ca88

  • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe

    Filesize

    1.2MB

    MD5

    63f52005e41331b364137473d742cd39

    SHA1

    6ecfbe641b18caaf0e971a580c3e022e5e66bff7

    SHA256

    06eaf0e0a560ce4fa383ce769c0810479a96f942e9fc21ea506b2a2ab58b387a

    SHA512

    24897ce908d0839c4fa4a7c431f3e0bd911a36086d192c7c660ad2c6e5cca157a5a673bfae751412889d33796c090647be4a64901c0caa349d40690f54e4ca88

  • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe

    Filesize

    1.2MB

    MD5

    63f52005e41331b364137473d742cd39

    SHA1

    6ecfbe641b18caaf0e971a580c3e022e5e66bff7

    SHA256

    06eaf0e0a560ce4fa383ce769c0810479a96f942e9fc21ea506b2a2ab58b387a

    SHA512

    24897ce908d0839c4fa4a7c431f3e0bd911a36086d192c7c660ad2c6e5cca157a5a673bfae751412889d33796c090647be4a64901c0caa349d40690f54e4ca88

  • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe

    Filesize

    1.2MB

    MD5

    63f52005e41331b364137473d742cd39

    SHA1

    6ecfbe641b18caaf0e971a580c3e022e5e66bff7

    SHA256

    06eaf0e0a560ce4fa383ce769c0810479a96f942e9fc21ea506b2a2ab58b387a

    SHA512

    24897ce908d0839c4fa4a7c431f3e0bd911a36086d192c7c660ad2c6e5cca157a5a673bfae751412889d33796c090647be4a64901c0caa349d40690f54e4ca88

  • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe

    Filesize

    1.2MB

    MD5

    63f52005e41331b364137473d742cd39

    SHA1

    6ecfbe641b18caaf0e971a580c3e022e5e66bff7

    SHA256

    06eaf0e0a560ce4fa383ce769c0810479a96f942e9fc21ea506b2a2ab58b387a

    SHA512

    24897ce908d0839c4fa4a7c431f3e0bd911a36086d192c7c660ad2c6e5cca157a5a673bfae751412889d33796c090647be4a64901c0caa349d40690f54e4ca88