Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231127-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/12/2023, 11:59

General

  • Target

    4e71c0eb909b58239ff9a12e3abbed336c126e61ffb24e052ad68b4b6863ee01.exe

  • Size

    2.4MB

  • MD5

    59f79fe64de3c9562ea00c7e41f65d85

  • SHA1

    f93f2bec00acde7beb74bd02ff74a164ce7c7b9e

  • SHA256

    4e71c0eb909b58239ff9a12e3abbed336c126e61ffb24e052ad68b4b6863ee01

  • SHA512

    c562e59b5e953b05b21cb95b57f7364834ed155ad12a52dc10faf2da2e69f851c2425b05fb547de4e6098cb6655ff741025c989627b482d22e9127ac52d83100

  • SSDEEP

    49152:mrX4ppAYG3aZCwHUA1k3XKL73AxUCQLRWqJ8BaXKL73AxUCQLRWqJ8B:mT4ppAY/Ck+qL73x7sqJIDL73x7sqJI

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4e71c0eb909b58239ff9a12e3abbed336c126e61ffb24e052ad68b4b6863ee01.exe
    "C:\Users\Admin\AppData\Local\Temp\4e71c0eb909b58239ff9a12e3abbed336c126e61ffb24e052ad68b4b6863ee01.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3172
    • C:\Users\Admin\AppData\Local\Temp\csrss1.exe
      C:\Users\Admin\AppData\Local\Temp\csrss1.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4788
      • C:\Windows\SysWOW64\ctfmon.exe
        ctfmon.exe
        3⤵
        • Checks processor information in registry
        PID:1796
  • C:\Windows\SysWOW64\ctfmon.exe
    C:\Windows\SysWOW64\ctfmon.exe
    1⤵
    • Modifies data under HKEY_USERS
    PID:4992
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 760
      2⤵
      • Program crash
      PID:1456
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4992 -ip 4992
    1⤵
      PID:4476
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
      1⤵
        PID:2040
      • C:\Windows\System32\svchost.exe
        C:\Windows\System32\svchost.exe -k UnistackSvcGroup
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2756

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Comms\UnistoreDB\store.jfm

        Filesize

        16KB

        MD5

        429b6684526538b3c06f7d9c542a020e

        SHA1

        4d0c1fe78b6b023eec55d18d30b3c3a287138128

        SHA256

        007a7815bde982ac0f87bf842f444310955fcc7273798dc7329a75b5ad598ee7

        SHA512

        a83a6228a457fc14ea3c9c9617ecad634be046b5a52a5a40f39e276e48e43630a698f895c103b64a5e4eb20e0b01e61125c0b52a42723de1961767a086dc1ee2

      • C:\Users\Admin\AppData\Local\Temp\csrss1.exe

        Filesize

        375KB

        MD5

        1a6e00d9a2de724b77dd0c386cf0e08a

        SHA1

        b2523f9ed765c850525e5414f8fb79e1e9fab444

        SHA256

        5bb683bf31a54e202b6f06d3120a3664cf666e54da2d6388beb003ccc1277eaa

        SHA512

        6fc43f2e1ec89c4911117e3a5d003fb30ffb3776afad1c4e9c8c268923fab123a802a3929247f9bcc75b916087d0427db85ab1ace098a666ebb4a9347d697d9d

      • memory/1796-12-0x0000000000400000-0x000000000041B000-memory.dmp

        Filesize

        108KB

      • memory/1796-16-0x0000000010000000-0x000000001000F000-memory.dmp

        Filesize

        60KB

      • memory/1796-15-0x0000000000400000-0x000000000041B000-memory.dmp

        Filesize

        108KB

      • memory/1796-13-0x0000000000400000-0x000000000041B000-memory.dmp

        Filesize

        108KB

      • memory/1796-10-0x0000000000400000-0x000000000041B000-memory.dmp

        Filesize

        108KB

      • memory/1796-11-0x0000000000400000-0x000000000041B000-memory.dmp

        Filesize

        108KB

      • memory/2756-55-0x00000245C8FD0000-0x00000245C8FD1000-memory.dmp

        Filesize

        4KB

      • memory/2756-60-0x00000245C8FD0000-0x00000245C8FD1000-memory.dmp

        Filesize

        4KB

      • memory/2756-90-0x00000245C8E40000-0x00000245C8E41000-memory.dmp

        Filesize

        4KB

      • memory/2756-89-0x00000245C8D30000-0x00000245C8D31000-memory.dmp

        Filesize

        4KB

      • memory/2756-88-0x00000245C8D30000-0x00000245C8D31000-memory.dmp

        Filesize

        4KB

      • memory/2756-86-0x00000245C8D20000-0x00000245C8D21000-memory.dmp

        Filesize

        4KB

      • memory/2756-74-0x00000245C8B20000-0x00000245C8B21000-memory.dmp

        Filesize

        4KB

      • memory/2756-22-0x00000245C08B0000-0x00000245C08C0000-memory.dmp

        Filesize

        64KB

      • memory/2756-38-0x00000245C09B0000-0x00000245C09C0000-memory.dmp

        Filesize

        64KB

      • memory/2756-54-0x00000245C8FA0000-0x00000245C8FA1000-memory.dmp

        Filesize

        4KB

      • memory/2756-71-0x00000245C8BE0000-0x00000245C8BE1000-memory.dmp

        Filesize

        4KB

      • memory/2756-56-0x00000245C8FD0000-0x00000245C8FD1000-memory.dmp

        Filesize

        4KB

      • memory/2756-57-0x00000245C8FD0000-0x00000245C8FD1000-memory.dmp

        Filesize

        4KB

      • memory/2756-58-0x00000245C8FD0000-0x00000245C8FD1000-memory.dmp

        Filesize

        4KB

      • memory/2756-59-0x00000245C8FD0000-0x00000245C8FD1000-memory.dmp

        Filesize

        4KB

      • memory/2756-68-0x00000245C8BF0000-0x00000245C8BF1000-memory.dmp

        Filesize

        4KB

      • memory/2756-61-0x00000245C8FD0000-0x00000245C8FD1000-memory.dmp

        Filesize

        4KB

      • memory/2756-62-0x00000245C8FD0000-0x00000245C8FD1000-memory.dmp

        Filesize

        4KB

      • memory/2756-63-0x00000245C8FD0000-0x00000245C8FD1000-memory.dmp

        Filesize

        4KB

      • memory/2756-64-0x00000245C8FD0000-0x00000245C8FD1000-memory.dmp

        Filesize

        4KB

      • memory/2756-65-0x00000245C8BF0000-0x00000245C8BF1000-memory.dmp

        Filesize

        4KB

      • memory/2756-66-0x00000245C8BE0000-0x00000245C8BE1000-memory.dmp

        Filesize

        4KB

      • memory/3172-0-0x0000000000400000-0x00000000005C7000-memory.dmp

        Filesize

        1.8MB

      • memory/3172-19-0x0000000000400000-0x00000000005C7000-memory.dmp

        Filesize

        1.8MB

      • memory/4788-9-0x0000000000400000-0x0000000000595000-memory.dmp

        Filesize

        1.6MB

      • memory/4788-21-0x00000000005F0000-0x00000000005F1000-memory.dmp

        Filesize

        4KB

      • memory/4788-7-0x0000000000400000-0x0000000000595000-memory.dmp

        Filesize

        1.6MB

      • memory/4788-20-0x0000000000400000-0x0000000000595000-memory.dmp

        Filesize

        1.6MB

      • memory/4788-6-0x00000000005F0000-0x00000000005F1000-memory.dmp

        Filesize

        4KB

      • memory/4788-5-0x0000000000400000-0x0000000000595000-memory.dmp

        Filesize

        1.6MB