Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
07/11/2023, 03:12
Static task
static1
Behavioral task
behavioral1
Sample
c420039639d20ed199f2250f5a8131bfff9f2b2fa44af8cd8472b325b48f40f2.exe
Resource
win10v2004-20231020-en
General
-
Target
c420039639d20ed199f2250f5a8131bfff9f2b2fa44af8cd8472b325b48f40f2.exe
-
Size
4.0MB
-
MD5
30aec56f64242ad6ed72f1f6a89bb627
-
SHA1
b29dcd847655ceaa1e81aec7de599233e342c30c
-
SHA256
c420039639d20ed199f2250f5a8131bfff9f2b2fa44af8cd8472b325b48f40f2
-
SHA512
2aa1030f5759945a58cf433d6d9d4e55ec8357167bd49d95049b5395a6075a21c385e4c59a63660ba75ae03626b726045ec7b2eef05be235c691c2adb8aa1cc5
-
SSDEEP
98304:jd6L0SvtWKyeH9P3gh9vgAfJyqzZb+PH18VEZHP2x7e:x6L0Svt4EP3gh9vgigqzZbHVmHc7e
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 1732 is-BB5UB.tmp 3592 VResource.exe 1852 VResource.exe -
Loads dropped DLL 3 IoCs
pid Process 1732 is-BB5UB.tmp 1732 is-BB5UB.tmp 1732 is-BB5UB.tmp -
Unexpected DNS network traffic destination 5 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 217.23.6.51 Destination IP 217.23.9.168 Destination IP 51.159.66.125 Destination IP 37.187.122.227 Destination IP 151.80.38.159 -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 30 IoCs
description ioc Process File created C:\Program Files (x86)\VResource\Lang\is-V0UOM.tmp is-BB5UB.tmp File created C:\Program Files (x86)\VResource\Plugins\is-4QIKM.tmp is-BB5UB.tmp File created C:\Program Files (x86)\VResource\is-ABAVD.tmp is-BB5UB.tmp File opened for modification C:\Program Files (x86)\VResource\VResource.exe is-BB5UB.tmp File created C:\Program Files (x86)\VResource\Lang\is-EHO9B.tmp is-BB5UB.tmp File created C:\Program Files (x86)\VResource\Online\is-9CK12.tmp is-BB5UB.tmp File created C:\Program Files (x86)\VResource\Plugins\is-7QDI2.tmp is-BB5UB.tmp File opened for modification C:\Program Files (x86)\VResource\unins000.dat is-BB5UB.tmp File created C:\Program Files (x86)\VResource\unins000.dat is-BB5UB.tmp File created C:\Program Files (x86)\VResource\Lang\is-38SA7.tmp is-BB5UB.tmp File created C:\Program Files (x86)\VResource\Lang\is-MJTLP.tmp is-BB5UB.tmp File created C:\Program Files (x86)\VResource\Plugins\is-HL84Q.tmp is-BB5UB.tmp File created C:\Program Files (x86)\VResource\Lang\is-QQ9AT.tmp is-BB5UB.tmp File created C:\Program Files (x86)\VResource\Lang\is-DHBNE.tmp is-BB5UB.tmp File created C:\Program Files (x86)\VResource\Lang\is-LQ2UU.tmp is-BB5UB.tmp File created C:\Program Files (x86)\VResource\Lang\is-S1O3L.tmp is-BB5UB.tmp File created C:\Program Files (x86)\VResource\Lang\is-AE7C9.tmp is-BB5UB.tmp File created C:\Program Files (x86)\VResource\Plugins\is-J2SK6.tmp is-BB5UB.tmp File created C:\Program Files (x86)\VResource\Lang\is-1M5KO.tmp is-BB5UB.tmp File created C:\Program Files (x86)\VResource\Lang\is-B1N9K.tmp is-BB5UB.tmp File created C:\Program Files (x86)\VResource\Lang\is-LRPS7.tmp is-BB5UB.tmp File created C:\Program Files (x86)\VResource\is-O5627.tmp is-BB5UB.tmp File created C:\Program Files (x86)\VResource\Lang\is-5NSL0.tmp is-BB5UB.tmp File created C:\Program Files (x86)\VResource\Lang\is-KCR1J.tmp is-BB5UB.tmp File created C:\Program Files (x86)\VResource\Lang\is-LNNOQ.tmp is-BB5UB.tmp File created C:\Program Files (x86)\VResource\Lang\is-QMFHS.tmp is-BB5UB.tmp File created C:\Program Files (x86)\VResource\Online\is-KSJ7H.tmp is-BB5UB.tmp File created C:\Program Files (x86)\VResource\Help\is-RURN2.tmp is-BB5UB.tmp File created C:\Program Files (x86)\VResource\Lang\is-FC3LP.tmp is-BB5UB.tmp File created C:\Program Files (x86)\VResource\Lang\is-CIR76.tmp is-BB5UB.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs net.exe
-
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 4436 wrote to memory of 1732 4436 c420039639d20ed199f2250f5a8131bfff9f2b2fa44af8cd8472b325b48f40f2.exe 90 PID 4436 wrote to memory of 1732 4436 c420039639d20ed199f2250f5a8131bfff9f2b2fa44af8cd8472b325b48f40f2.exe 90 PID 4436 wrote to memory of 1732 4436 c420039639d20ed199f2250f5a8131bfff9f2b2fa44af8cd8472b325b48f40f2.exe 90 PID 1732 wrote to memory of 3328 1732 is-BB5UB.tmp 92 PID 1732 wrote to memory of 3328 1732 is-BB5UB.tmp 92 PID 1732 wrote to memory of 3328 1732 is-BB5UB.tmp 92 PID 1732 wrote to memory of 3592 1732 is-BB5UB.tmp 94 PID 1732 wrote to memory of 3592 1732 is-BB5UB.tmp 94 PID 1732 wrote to memory of 3592 1732 is-BB5UB.tmp 94 PID 3328 wrote to memory of 3380 3328 net.exe 95 PID 3328 wrote to memory of 3380 3328 net.exe 95 PID 3328 wrote to memory of 3380 3328 net.exe 95 PID 1732 wrote to memory of 1852 1732 is-BB5UB.tmp 96 PID 1732 wrote to memory of 1852 1732 is-BB5UB.tmp 96 PID 1732 wrote to memory of 1852 1732 is-BB5UB.tmp 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\c420039639d20ed199f2250f5a8131bfff9f2b2fa44af8cd8472b325b48f40f2.exe"C:\Users\Admin\AppData\Local\Temp\c420039639d20ed199f2250f5a8131bfff9f2b2fa44af8cd8472b325b48f40f2.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4436 -
C:\Users\Admin\AppData\Local\Temp\is-37QIU.tmp\is-BB5UB.tmp"C:\Users\Admin\AppData\Local\Temp\is-37QIU.tmp\is-BB5UB.tmp" /SL4 $90090 "C:\Users\Admin\AppData\Local\Temp\c420039639d20ed199f2250f5a8131bfff9f2b2fa44af8cd8472b325b48f40f2.exe" 3846675 1464322⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 63⤵
- Suspicious use of WriteProcessMemory
PID:3328 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 64⤵PID:3380
-
-
-
C:\Program Files (x86)\VResource\VResource.exe"C:\Program Files (x86)\VResource\VResource.exe" -i3⤵
- Executes dropped EXE
PID:3592
-
-
C:\Program Files (x86)\VResource\VResource.exe"C:\Program Files (x86)\VResource\VResource.exe" -s3⤵
- Executes dropped EXE
PID:1852
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.0MB
MD56897be111971ca604343fdd030e1af87
SHA1eb55a7d0afb543961bfb27147d0969bbcf8cb80a
SHA2560c5960241693e0f5e10a189db324ca89c1555eaae8e3f1ba8297b787354fc10d
SHA512b32a370dec0473d9a70c754609a526673ce9de1d43f513f92ef8351bd2324caae31b187bed5777b8037c11cdc44cc6e46803b5b4877275b5563ea0f4067ea28b
-
Filesize
2.0MB
MD56897be111971ca604343fdd030e1af87
SHA1eb55a7d0afb543961bfb27147d0969bbcf8cb80a
SHA2560c5960241693e0f5e10a189db324ca89c1555eaae8e3f1ba8297b787354fc10d
SHA512b32a370dec0473d9a70c754609a526673ce9de1d43f513f92ef8351bd2324caae31b187bed5777b8037c11cdc44cc6e46803b5b4877275b5563ea0f4067ea28b
-
Filesize
2.0MB
MD56897be111971ca604343fdd030e1af87
SHA1eb55a7d0afb543961bfb27147d0969bbcf8cb80a
SHA2560c5960241693e0f5e10a189db324ca89c1555eaae8e3f1ba8297b787354fc10d
SHA512b32a370dec0473d9a70c754609a526673ce9de1d43f513f92ef8351bd2324caae31b187bed5777b8037c11cdc44cc6e46803b5b4877275b5563ea0f4067ea28b
-
Filesize
643KB
MD5a991510c12f20ccf8a5231a32a7958c3
SHA1122724d1a4fdea39af3aa427e4941158d7e91dfa
SHA2560c3ab280e156e9ff6a325267bc5d721f71dcb12490a53a03a033d932272f9198
SHA5128f387a6189f6fa51f84004706589ed1706dfd08dfc38c1f8ce3ce010f37efac085fd241396ab69bc25c86174a4637492163bf3cb26f88639551dc9fa0c52eafa
-
Filesize
643KB
MD5a991510c12f20ccf8a5231a32a7958c3
SHA1122724d1a4fdea39af3aa427e4941158d7e91dfa
SHA2560c3ab280e156e9ff6a325267bc5d721f71dcb12490a53a03a033d932272f9198
SHA5128f387a6189f6fa51f84004706589ed1706dfd08dfc38c1f8ce3ce010f37efac085fd241396ab69bc25c86174a4637492163bf3cb26f88639551dc9fa0c52eafa
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
32KB
MD5b4786eb1e1a93633ad1b4c112514c893
SHA1734750b771d0809c88508e4feb788d7701e6dada
SHA2562ae4169f721beb389a661e6dbb18bc84ef38556af1f46807da9d87aec2a6f06f
SHA5120882d2aa163ece22796f837111db0d55158098035005e57cd2e9b8d59dc2e582207840bf98bee534b81c368acf60ab5d8ecbe762209273bda067a215cdb2c0c6
-
Filesize
32KB
MD5b4786eb1e1a93633ad1b4c112514c893
SHA1734750b771d0809c88508e4feb788d7701e6dada
SHA2562ae4169f721beb389a661e6dbb18bc84ef38556af1f46807da9d87aec2a6f06f
SHA5120882d2aa163ece22796f837111db0d55158098035005e57cd2e9b8d59dc2e582207840bf98bee534b81c368acf60ab5d8ecbe762209273bda067a215cdb2c0c6