Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

3

3b05d4bc57...73.exe

windows7-x64

8

3b05d4bc57...73.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    139s
  • max time network
    159s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/10/2023, 17:41

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    3b05d4bc5716abb5a6133003c01518caa75264231394e042f5d7c58d5de69c73.exe

  • Size

    2.9MB

  • MD5

    a529d2684ea3c446b2b77daf24fb9f50

  • SHA1

    ef0b4932469d7e382d2ff2c7a18f6cdd66e09c03

  • SHA256

    3b05d4bc5716abb5a6133003c01518caa75264231394e042f5d7c58d5de69c73

  • SHA512

    4d176107babf16502dda5c1da61dbccb13253739ed416a7104fb43a33550156c67cb6a25ac37801b83696be62c3cf108e5845f21ab43547bad370568670e1df9

  • SSDEEP

    49152:D7TvfU+8X9GrNOsva5RbKhF3ANkTTlqyxWdTZqGeZJt:Q+8X9G3vP3AMIykdsGuJt

Score
8/10
persistence

Malware Config

Signatures

  • Modifies Installed Components in the registry 2 TTPs 7 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 14 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 6 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\3b05d4bc5716abb5a6133003c01518caa75264231394e042f5d7c58d5de69c73.exe
    "C:\Users\Admin\AppData\Local\Temp\3b05d4bc5716abb5a6133003c01518caa75264231394e042f5d7c58d5de69c73.exe"
    1⤵
      PID:2080
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3516
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:228
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:5112
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:3488
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:3700
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SendNotifyMessage
      PID:1768
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:3964
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of SendNotifyMessage
      PID:4408
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:4944
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:3248
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      PID:3732
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:1636
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:3668
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      PID:4008
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:4496
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:1184
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies registry class
      PID:1372
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Modifies registry class
      PID:1588
    • C:\Windows\system32\werfault.exe
      werfault.exe /hc /shared Global\886fcc0b27a34f6c846b6aa97addc7af /t 4904 /p 4944
      1⤵
        PID:1648
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
          PID:3712
        • C:\Windows\explorer.exe
          explorer.exe
          1⤵
            PID:4128
          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
            1⤵
              PID:2272

            Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53
              Filesize

              471B

              MD5

              976ce2c91cbe61b98378e8e5c5ba4d53

              SHA1

              45b3e1eabb4e759bf46ffeb8f9722077a0d62c72

              SHA256

              255f312d16d7d080cf1a97d4eb255c236c7eee6c059d732d970e3c05c07c158e

              SHA512

              0065b7984960354aea85cd0c6792e019f40a2b359fabf7dcee438193c1bab47d74d59602627c8399df741864dffb0469d9cf8bc48907c1c67015c51d01a7b28a

              Download Submit

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53
              Filesize

              412B

              MD5

              7794786d594944c7cbf91dbe03bd0647

              SHA1

              d59919174b3935bc507b07a6fc4a079dd28a30e5

              SHA256

              d40e1006f1b689131b2c7bc7ba0ad1e8ddc81025723fb97818414cbd91648d7b

              SHA512

              15431957ebe16e1485f989947d5fb22930ac277c182e586e5ef553a93293f6537204097c7fad73196c598eae75bfab0e4ade1d61cb945922e56e5fcac56254f0

              Download Submit

            • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\46IOJ2Y1\microsoft.windows[1].xml
              Filesize

              96B

              MD5

              132893809ee21f6cc9bd8398d163fde8

              SHA1

              664b895e0f6ae4f8ed96f36dee355d4e554b29eb

              SHA256

              af9f28768de7e7f0f21d52b63003adb8fa1b563ab8e4a38bf361a7f51aa8d8d2

              SHA512

              a540b8cddd2684bf6d11480bc23200200414984b4520842db541e07021520fb6cf356492b7e2517cdd53718f4a8b6002d5268db4c085b5d1ab6ed3cc1973caa8

              Download Submit

            • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133392350707962340.txt
              Filesize

              75KB

              MD5

              62d81c2e1e8b21733f95af2a596e4b18

              SHA1

              91c005ecc5ae4171f450c43c02d1ba532b4474c6

              SHA256

              a5596f83717bf64653b95ffe6ec38f20e40fd928456d5e254a53a440804d80b6

              SHA512

              c7f349acf55694ff696750c30a25c265ff07ced95e4d2a88fa2829d047ca3b3007dc824613a8c403c7613085aca4212155afe03f8f237c0d7781fd87e1fb8a7c

              Download Submit

            • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\46IOJ2Y1\microsoft.windows[1].xml
              Filesize

              96B

              MD5

              132893809ee21f6cc9bd8398d163fde8

              SHA1

              664b895e0f6ae4f8ed96f36dee355d4e554b29eb

              SHA256

              af9f28768de7e7f0f21d52b63003adb8fa1b563ab8e4a38bf361a7f51aa8d8d2

              SHA512

              a540b8cddd2684bf6d11480bc23200200414984b4520842db541e07021520fb6cf356492b7e2517cdd53718f4a8b6002d5268db4c085b5d1ab6ed3cc1973caa8

              Download Submit

            • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\46IOJ2Y1\microsoft.windows[1].xml
              Filesize

              96B

              MD5

              132893809ee21f6cc9bd8398d163fde8

              SHA1

              664b895e0f6ae4f8ed96f36dee355d4e554b29eb

              SHA256

              af9f28768de7e7f0f21d52b63003adb8fa1b563ab8e4a38bf361a7f51aa8d8d2

              SHA512

              a540b8cddd2684bf6d11480bc23200200414984b4520842db541e07021520fb6cf356492b7e2517cdd53718f4a8b6002d5268db4c085b5d1ab6ed3cc1973caa8

              Download Submit

            • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\46IOJ2Y1\microsoft.windows[1].xml
              Filesize

              96B

              MD5

              132893809ee21f6cc9bd8398d163fde8

              SHA1

              664b895e0f6ae4f8ed96f36dee355d4e554b29eb

              SHA256

              af9f28768de7e7f0f21d52b63003adb8fa1b563ab8e4a38bf361a7f51aa8d8d2

              SHA512

              a540b8cddd2684bf6d11480bc23200200414984b4520842db541e07021520fb6cf356492b7e2517cdd53718f4a8b6002d5268db4c085b5d1ab6ed3cc1973caa8

              Download Submit

            • memory/1184-64-0x0000020CFED00000-0x0000020CFED20000-memory.dmp

              Filesize

              128KB

              Download

            • memory/1184-66-0x0000020CFE9C0000-0x0000020CFE9E0000-memory.dmp

              Filesize

              128KB

              Download

            • memory/1184-68-0x0000020CFF0D0000-0x0000020CFF0F0000-memory.dmp

              Filesize

              128KB

              Download

            • memory/1372-104-0x0000024E4C560000-0x0000024E4C580000-memory.dmp

              Filesize

              128KB

              Download

            • memory/1372-102-0x0000024E4C5A0000-0x0000024E4C5C0000-memory.dmp

              Filesize

              128KB

              Download

            • memory/1372-107-0x0000024E4CB80000-0x0000024E4CBA0000-memory.dmp

              Filesize

              128KB

              Download

            • memory/1588-94-0x00000000048E0000-0x00000000048E1000-memory.dmp

              Filesize

              4KB

              Download

            • memory/3248-44-0x000001ACEDDB0000-0x000001ACEDDD0000-memory.dmp

              Filesize

              128KB

              Download

            • memory/3248-41-0x000001ACED9A0000-0x000001ACED9C0000-memory.dmp

              Filesize

              128KB

              Download

            • memory/3248-38-0x000001ACED9E0000-0x000001ACEDA00000-memory.dmp

              Filesize

              128KB

              Download

            • memory/3700-18-0x0000025BEB780000-0x0000025BEB7A0000-memory.dmp

              Filesize

              128KB

              Download

            • memory/3700-16-0x0000025BEB270000-0x0000025BEB290000-memory.dmp

              Filesize

              128KB

              Download

            • memory/3700-14-0x0000025BEB2B0000-0x0000025BEB2D0000-memory.dmp

              Filesize

              128KB

              Download

            • memory/4008-56-0x0000000004EA0000-0x0000000004EA1000-memory.dmp

              Filesize

              4KB

              Download

            • memory/4408-30-0x0000000004A60000-0x0000000004A61000-memory.dmp

              Filesize

              4KB

              Download

            • memory/5112-7-0x0000000002880000-0x0000000002881000-memory.dmp

              Filesize

              4KB

              Download