Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    98s
  • max time network
    129s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/10/2023, 04:54

General

  • Target

    78ec3feb915e6426b1e0ac39d36429274e1a43601ac8e88ab5c0a9fa64fdffd2.exe

  • Size

    1.6MB

  • MD5

    5ef602e9059c1bb09594b28dcdc164e4

  • SHA1

    aa7d5f68fcf83c4e06237e8fadde070c660292e4

  • SHA256

    78ec3feb915e6426b1e0ac39d36429274e1a43601ac8e88ab5c0a9fa64fdffd2

  • SHA512

    b64a6b069a1ce2e6295541160ed6264f25580d196bc86c055c2e2a1550833d74f118e23badc0226130841d153ed57102b7cb6a21a16300a82dd9ac1147ead386

  • SSDEEP

    49152:CvxfXTMRuwHOWKw7kTtCTdxH/eSTdjYhCyU:CvxwRuw9Kw7k8Td9eSJYhCyU

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\78ec3feb915e6426b1e0ac39d36429274e1a43601ac8e88ab5c0a9fa64fdffd2.exe
    "C:\Users\Admin\AppData\Local\Temp\78ec3feb915e6426b1e0ac39d36429274e1a43601ac8e88ab5c0a9fa64fdffd2.exe"
    1⤵
    • Checks computer location settings
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2652
    • C:\Windows\SysWOW64\control.exe
      "C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\8EZ1I.CpL",
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3836
      • C:\Windows\SysWOW64\rundll32.exe
        "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\8EZ1I.CpL",
        3⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:2572
        • C:\Windows\system32\RunDll32.exe
          C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\8EZ1I.CpL",
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1832
          • C:\Windows\SysWOW64\rundll32.exe
            "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 "C:\Users\Admin\AppData\Local\Temp\8EZ1I.CpL",
            5⤵
            • Loads dropped DLL
            PID:4376

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\8EZ1I.CpL

    Filesize

    1.4MB

    MD5

    b98f29b60d2677d00e5707b844f6b298

    SHA1

    dce9c97e53cb59cec3f6f628d933d4be24f3c707

    SHA256

    aafad4410aaf5931ab4eda2a6095c099ba9ccc909debc859f31f6bd515ad3d35

    SHA512

    48498ee5800783ac0d2dde151813c5afe2411944490e683c40d8040442468a554ce651b8ac8b663f9fcfd2ca153fb174dcdef5f6b80c7f8f1813f9dd8730cbcb

  • C:\Users\Admin\AppData\Local\Temp\8ez1i.cpl

    Filesize

    1.4MB

    MD5

    b98f29b60d2677d00e5707b844f6b298

    SHA1

    dce9c97e53cb59cec3f6f628d933d4be24f3c707

    SHA256

    aafad4410aaf5931ab4eda2a6095c099ba9ccc909debc859f31f6bd515ad3d35

    SHA512

    48498ee5800783ac0d2dde151813c5afe2411944490e683c40d8040442468a554ce651b8ac8b663f9fcfd2ca153fb174dcdef5f6b80c7f8f1813f9dd8730cbcb

  • C:\Users\Admin\AppData\Local\Temp\8ez1i.cpl

    Filesize

    1.4MB

    MD5

    b98f29b60d2677d00e5707b844f6b298

    SHA1

    dce9c97e53cb59cec3f6f628d933d4be24f3c707

    SHA256

    aafad4410aaf5931ab4eda2a6095c099ba9ccc909debc859f31f6bd515ad3d35

    SHA512

    48498ee5800783ac0d2dde151813c5afe2411944490e683c40d8040442468a554ce651b8ac8b663f9fcfd2ca153fb174dcdef5f6b80c7f8f1813f9dd8730cbcb

  • C:\Users\Admin\AppData\Local\Temp\8ez1i.cpl

    Filesize

    1.4MB

    MD5

    b98f29b60d2677d00e5707b844f6b298

    SHA1

    dce9c97e53cb59cec3f6f628d933d4be24f3c707

    SHA256

    aafad4410aaf5931ab4eda2a6095c099ba9ccc909debc859f31f6bd515ad3d35

    SHA512

    48498ee5800783ac0d2dde151813c5afe2411944490e683c40d8040442468a554ce651b8ac8b663f9fcfd2ca153fb174dcdef5f6b80c7f8f1813f9dd8730cbcb

  • memory/2572-19-0x0000000003410000-0x00000000034FB000-memory.dmp

    Filesize

    940KB

  • memory/2572-15-0x0000000003300000-0x0000000003403000-memory.dmp

    Filesize

    1.0MB

  • memory/2572-16-0x0000000003410000-0x00000000034FB000-memory.dmp

    Filesize

    940KB

  • memory/2572-17-0x0000000003410000-0x00000000034FB000-memory.dmp

    Filesize

    940KB

  • memory/2572-12-0x0000000010000000-0x0000000010171000-memory.dmp

    Filesize

    1.4MB

  • memory/2572-20-0x0000000003410000-0x00000000034FB000-memory.dmp

    Filesize

    940KB

  • memory/2572-11-0x0000000002F00000-0x0000000002F06000-memory.dmp

    Filesize

    24KB

  • memory/4376-22-0x0000000002BF0000-0x0000000002BF6000-memory.dmp

    Filesize

    24KB

  • memory/4376-27-0x0000000002FB0000-0x00000000030B3000-memory.dmp

    Filesize

    1.0MB

  • memory/4376-28-0x00000000030C0000-0x00000000031AB000-memory.dmp

    Filesize

    940KB

  • memory/4376-29-0x00000000030C0000-0x00000000031AB000-memory.dmp

    Filesize

    940KB

  • memory/4376-31-0x00000000030C0000-0x00000000031AB000-memory.dmp

    Filesize

    940KB

  • memory/4376-32-0x00000000030C0000-0x00000000031AB000-memory.dmp

    Filesize

    940KB