Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    151s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231023-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/11/2023, 06:52

General

  • Target

    October'23 Statement of Account.exe

  • Size

    608KB

  • MD5

    67a443f6dfc350f6def3680b95c674de

  • SHA1

    0f3b4aae9491bba6f729a75b1824717921a8bb80

  • SHA256

    97863fc07fc27a0f99a2d434e307d7530364bfc137f8fd36a68674f1eae3533f

  • SHA512

    fb03f0070b6e411e318988313423a722650d6993c2ccb1542128a9d3edb220e91945d25d9ef035dd51ac9838f34e9aa794b4ca9a6a1b9c7d1e8832bf556d6c89

  • SSDEEP

    12288:x2lvgVn4eGFKe3LUfgJLFZpADKuojTFqVsUenPzNuVW:DnFGn3wfqLFZ86p3PzNus

Score
5/10

Malware Config

Signatures

  • Suspicious use of SetThreadContext 4 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 56 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:3100
    • C:\Users\Admin\AppData\Local\Temp\October'23 Statement of Account.exe
      "C:\Users\Admin\AppData\Local\Temp\October'23 Statement of Account.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3032
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        3⤵
          PID:2224
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
          3⤵
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          PID:4772
      • C:\Windows\SysWOW64\fontview.exe
        "C:\Windows\SysWOW64\fontview.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Modifies Internet Explorer settings
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of WriteProcessMemory
        PID:2884
        • C:\Program Files\Mozilla Firefox\Firefox.exe
          "C:\Program Files\Mozilla Firefox\Firefox.exe"
          3⤵
            PID:4984

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/2884-19-0x0000000000120000-0x000000000015A000-memory.dmp

        Filesize

        232KB

      • memory/2884-34-0x0000000000D50000-0x0000000000DF3000-memory.dmp

        Filesize

        652KB

      • memory/2884-27-0x0000000000120000-0x000000000015A000-memory.dmp

        Filesize

        232KB

      • memory/2884-24-0x0000000000D50000-0x0000000000DF3000-memory.dmp

        Filesize

        652KB

      • memory/2884-23-0x0000000000120000-0x000000000015A000-memory.dmp

        Filesize

        232KB

      • memory/2884-22-0x0000000002420000-0x000000000276A000-memory.dmp

        Filesize

        3.3MB

      • memory/2884-20-0x0000000000120000-0x000000000015A000-memory.dmp

        Filesize

        232KB

      • memory/3032-7-0x0000000005380000-0x000000000538E000-memory.dmp

        Filesize

        56KB

      • memory/3032-3-0x0000000004E90000-0x0000000004F22000-memory.dmp

        Filesize

        584KB

      • memory/3032-9-0x0000000006590000-0x000000000660E000-memory.dmp

        Filesize

        504KB

      • memory/3032-1-0x0000000000400000-0x000000000049E000-memory.dmp

        Filesize

        632KB

      • memory/3032-11-0x0000000074760000-0x0000000074F10000-memory.dmp

        Filesize

        7.7MB

      • memory/3032-13-0x0000000074760000-0x0000000074F10000-memory.dmp

        Filesize

        7.7MB

      • memory/3032-2-0x0000000005440000-0x00000000059E4000-memory.dmp

        Filesize

        5.6MB

      • memory/3032-8-0x00000000053A0000-0x00000000053AA000-memory.dmp

        Filesize

        40KB

      • memory/3032-4-0x0000000005100000-0x0000000005110000-memory.dmp

        Filesize

        64KB

      • memory/3032-5-0x0000000004F50000-0x0000000004F5A000-memory.dmp

        Filesize

        40KB

      • memory/3032-6-0x00000000051B0000-0x000000000524C000-memory.dmp

        Filesize

        624KB

      • memory/3032-0-0x0000000074760000-0x0000000074F10000-memory.dmp

        Filesize

        7.7MB

      • memory/3100-25-0x0000000008280000-0x00000000083A1000-memory.dmp

        Filesize

        1.1MB

      • memory/3100-26-0x0000000008280000-0x00000000083A1000-memory.dmp

        Filesize

        1.1MB

      • memory/3100-35-0x0000000008280000-0x00000000083A1000-memory.dmp

        Filesize

        1.1MB

      • memory/4772-18-0x00000000014D0000-0x00000000014F4000-memory.dmp

        Filesize

        144KB

      • memory/4772-21-0x0000000000400000-0x000000000043D000-memory.dmp

        Filesize

        244KB

      • memory/4772-17-0x0000000000400000-0x000000000043D000-memory.dmp

        Filesize

        244KB

      • memory/4772-16-0x0000000000400000-0x000000000043D000-memory.dmp

        Filesize

        244KB

      • memory/4772-15-0x0000000000400000-0x000000000043D000-memory.dmp

        Filesize

        244KB

      • memory/4772-14-0x0000000001500000-0x000000000184A000-memory.dmp

        Filesize

        3.3MB

      • memory/4772-10-0x0000000000400000-0x000000000043D000-memory.dmp

        Filesize

        244KB