Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

3

0dab94af35...a1.exe

windows7-x64

8

0dab94af35...a1.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    143s
  • max time network
    165s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/10/2023, 15:45

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0dab94af3539656681d40c837ac2ecd9a5591dac7d1560e6c85ac470e36513a1.exe

  • Size

    2.7MB

  • MD5

    927c677f40751645841f65cbfa50624f

  • SHA1

    73ef4ee8e515898ca85f55d317ebf785714f6b61

  • SHA256

    0dab94af3539656681d40c837ac2ecd9a5591dac7d1560e6c85ac470e36513a1

  • SHA512

    7f6cf461cec5fa0dd88c52195ba87ec0708be815451b0f6458b6b2ff546ba8907bcae7bc69b78cdee31f6a636d9c8379160b2a637a979052cdad58dea4fd4638

  • SSDEEP

    49152:D7TvfU+8X9GrNOsva5RbKhF3ANkTTloKOvEtxSBdK:Q+8X9G3vP3AMVhmE

Score
8/10
persistence

Malware Config

Signatures

  • Modifies Installed Components in the registry 2 TTPs 10 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 20 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 13 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\0dab94af3539656681d40c837ac2ecd9a5591dac7d1560e6c85ac470e36513a1.exe
    "C:\Users\Admin\AppData\Local\Temp\0dab94af3539656681d40c837ac2ecd9a5591dac7d1560e6c85ac470e36513a1.exe"
    1⤵
      PID:1684
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:436
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:3396
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:2028
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1180
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:3092
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2188
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:928
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3784
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:2944
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:4984
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of SendNotifyMessage
      PID:852
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:4840
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of SendNotifyMessage
      PID:1012
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:3764
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      PID:2276
    • C:\Windows\system32\werfault.exe
      werfault.exe /hc /shared Global\af4eced29f1342128347c9dee3665157 /t 3260 /p 3868
      1⤵
        PID:3516
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:4660
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:2732
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Modifies Installed Components in the registry
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        PID:2988
      • C:\Windows\system32\werfault.exe
        werfault.exe /hc /shared Global\5fb0733783a2455eb0730dcb597c63c0 /t 5060 /p 4992
        1⤵
          PID:768
        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
          1⤵
          • Suspicious use of SetWindowsHookEx
          PID:4752
        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
          1⤵
          • Modifies Internet Explorer settings
          • Modifies registry class
          • Suspicious use of SetWindowsHookEx
          PID:4368
        • C:\Windows\explorer.exe
          explorer.exe
          1⤵
          • Modifies Installed Components in the registry
          • Enumerates connected drives
          • Checks SCSI registry key(s)
          • Modifies registry class
          PID:1252
        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
          1⤵
          • Modifies registry class
          • Suspicious use of SetWindowsHookEx
          PID:2428
        • C:\Windows\explorer.exe
          explorer.exe
          1⤵
          • Modifies Installed Components in the registry
          • Enumerates connected drives
          • Checks SCSI registry key(s)
          • Modifies registry class
          PID:1632
        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
          1⤵
            PID:4984
          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
            1⤵
              PID:3272
            • C:\Windows\explorer.exe
              explorer.exe
              1⤵
                PID:3440
              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                1⤵
                  PID:2556

                Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53
                  Filesize

                  471B

                  MD5

                  ecc3c9de4f6c2909d80c9a355c58a995

                  SHA1

                  205eb3c15c1e0338dee194e6b3de88fc61e8a503

                  SHA256

                  2d8dd41275cee7e1fc715eaab2e020c74e4d4640c5c7b25db31aa3a98519b966

                  SHA512

                  1e7138e5770573cf06796ffdd1811d9978c9d43dbfae2250c69b79b6a3b5d51b0f7e1e4c9fca5105629454586164e2c52b9624dbde93e21ebb69694a18a3bbd3

                  Download Submit

                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53
                  Filesize

                  412B

                  MD5

                  68164f6ed932730adf9579a8c3307f96

                  SHA1

                  abd26f5ba7b4468d1905a976a2f0e8a79b4ca4ae

                  SHA256

                  343c94623f003cb3eb827a357744d878c4c0d23ed95b428c7626f26e5763fa1f

                  SHA512

                  b93ea8b77ed5e700f07deb4364c8abf7ba49d67e113f0d6d691f44768a7e1684f174e35b010ee2550faeeb08e56459b6b5412e991f5398ce9126ceb72a2349c0

                  Download Submit

                • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\9DNZSKKP\microsoft.windows[1].xml
                  Filesize

                  97B

                  MD5

                  100b85d03c9a92f5de53e1f210dbd426

                  SHA1

                  f8f4f1693dd0158a5d715a6104cf88d5d8b2097b

                  SHA256

                  f42a921438bdea6baa25de36a2f4e7a25d21880514a0cecdd5e70914de65a630

                  SHA512

                  b66c1ef7b555cdc27afa1b62e618945ed41d2e32671b7155f05a81dcdf81d9c5b42d55fd993eaf3b83c60ff7a41198a3db8207367513f524f65ee37112405d91

                  Download Submit

                • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133392372789841235.txt
                  Filesize

                  75KB

                  MD5

                  62d81c2e1e8b21733f95af2a596e4b18

                  SHA1

                  91c005ecc5ae4171f450c43c02d1ba532b4474c6

                  SHA256

                  a5596f83717bf64653b95ffe6ec38f20e40fd928456d5e254a53a440804d80b6

                  SHA512

                  c7f349acf55694ff696750c30a25c265ff07ced95e4d2a88fa2829d047ca3b3007dc824613a8c403c7613085aca4212155afe03f8f237c0d7781fd87e1fb8a7c

                  Download Submit

                • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133392372789841235.txt
                  Filesize

                  75KB

                  MD5

                  62d81c2e1e8b21733f95af2a596e4b18

                  SHA1

                  91c005ecc5ae4171f450c43c02d1ba532b4474c6

                  SHA256

                  a5596f83717bf64653b95ffe6ec38f20e40fd928456d5e254a53a440804d80b6

                  SHA512

                  c7f349acf55694ff696750c30a25c265ff07ced95e4d2a88fa2829d047ca3b3007dc824613a8c403c7613085aca4212155afe03f8f237c0d7781fd87e1fb8a7c

                  Download Submit

                • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\9DNZSKKP\microsoft.windows[1].xml
                  Filesize

                  97B

                  MD5

                  100b85d03c9a92f5de53e1f210dbd426

                  SHA1

                  f8f4f1693dd0158a5d715a6104cf88d5d8b2097b

                  SHA256

                  f42a921438bdea6baa25de36a2f4e7a25d21880514a0cecdd5e70914de65a630

                  SHA512

                  b66c1ef7b555cdc27afa1b62e618945ed41d2e32671b7155f05a81dcdf81d9c5b42d55fd993eaf3b83c60ff7a41198a3db8207367513f524f65ee37112405d91

                  Download Submit

                • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\9DNZSKKP\microsoft.windows[1].xml
                  Filesize

                  97B

                  MD5

                  100b85d03c9a92f5de53e1f210dbd426

                  SHA1

                  f8f4f1693dd0158a5d715a6104cf88d5d8b2097b

                  SHA256

                  f42a921438bdea6baa25de36a2f4e7a25d21880514a0cecdd5e70914de65a630

                  SHA512

                  b66c1ef7b555cdc27afa1b62e618945ed41d2e32671b7155f05a81dcdf81d9c5b42d55fd993eaf3b83c60ff7a41198a3db8207367513f524f65ee37112405d91

                  Download Submit

                • memory/1252-50-0x0000000003F20000-0x0000000003F21000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/1632-74-0x00000000042D0000-0x00000000042D1000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/2276-12-0x00000000047F0000-0x00000000047F1000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/2732-19-0x000001F4229E0000-0x000001F422A00000-memory.dmp

                  Filesize

                  128KB

                  Download

                • memory/2732-26-0x000001F423030000-0x000001F423050000-memory.dmp

                  Filesize

                  128KB

                  Download

                • memory/2732-21-0x000001F422F30000-0x000001F422F50000-memory.dmp

                  Filesize

                  128KB

                  Download

                • memory/3272-82-0x000002BB57BC0000-0x000002BB57BE0000-memory.dmp

                  Filesize

                  128KB

                  Download

                • memory/3272-83-0x000002BB57B80000-0x000002BB57BA0000-memory.dmp

                  Filesize

                  128KB

                  Download

                • memory/3272-86-0x000002BB57F90000-0x000002BB57FB0000-memory.dmp

                  Filesize

                  128KB

                  Download

                • memory/4368-64-0x000001C5326E0000-0x000001C532700000-memory.dmp

                  Filesize

                  128KB

                  Download

                • memory/4368-60-0x000001C5320C0000-0x000001C5320E0000-memory.dmp

                  Filesize

                  128KB

                  Download

                • memory/4368-58-0x000001C532100000-0x000001C532120000-memory.dmp

                  Filesize

                  128KB

                  Download