Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/12/2023, 14:27

General

  • Target

    00d20fcc8774b6b06941389c3dd24ea6.exe

  • Size

    346KB

  • MD5

    00d20fcc8774b6b06941389c3dd24ea6

  • SHA1

    c06d16f87055b17187d662403ef9f3dd31de6a0d

  • SHA256

    08b38a7c0008746e2b16eb062cd535ca3a4a7f01a51e10a2b4620300add8aca0

  • SHA512

    927d07bc84babfb621dafc1ab0a896c9a956c75ccd8030de716f521c907917c7c4ea3450f4d030f711bb5f6decf9ac28ed0b4bfc7aa950184ca388cd0c34e64d

  • SSDEEP

    6144:SY94NtgVD0lkv61My/nhzwdyVzwKoRfVSydIeyogA5oKKiZDoRSDzdPnaz8FnXj:R9OtgVD0jp/nSdyNgRfVDIeyXA5j8SgY

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 5 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

  • Drops file in System32 directory 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 46 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\00d20fcc8774b6b06941389c3dd24ea6.exe
    "C:\Users\Admin\AppData\Local\Temp\00d20fcc8774b6b06941389c3dd24ea6.exe"
    1⤵
    • Checks computer location settings
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1336
    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\rinst.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX0\rinst.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Drops file in System32 directory
      • Suspicious use of WriteProcessMemory
      PID:1056
      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\AutoTH.exe
        "C:\Users\Admin\AppData\Local\Temp\RarSFX0\AutoTH.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetWindowsHookEx
        PID:548
      • C:\Windows\SysWOW64\bpk.exe
        C:\Windows\system32\bpk.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Installs/modifies Browser Helper Object
        • Drops file in System32 directory
        • Modifies registry class
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        PID:5056

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\AutoTH.exe

    Filesize

    119KB

    MD5

    4ed0c73665adb0b7b817d7cf8d1f976a

    SHA1

    951aad76200170b801fc1706d51204ded11e15e2

    SHA256

    ae2651114fb3d2e2428cea8e946ebea7bf7949a6d1d73f3b5607add7ea485a15

    SHA512

    174deadd9cb2371b0b2f88094aebe8d90aee793a4e205209aac29744be6d1ebbdbec6a0063aa4b458212171dd359ef9927bd3d92882d48964517ab2446a33414

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\AutoTH.exe

    Filesize

    40KB

    MD5

    7d55501b0d3e95960577e761feb5858e

    SHA1

    acda33a598b1e517ccaf341199f3122e943b6e92

    SHA256

    fc901e040cc5115aabdb990f1c687cbf937c31ceaff17fc493acb35a9f4cbdf7

    SHA512

    cb002e781f2a58847f76b593396082245d54bde33061902d53fae0de98e4da61e2ec03eac6c65b4b42512de562814c406d55ca5f95b1bd7d09657905e1ccce5b

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\bpk.exe

    Filesize

    49KB

    MD5

    352ec26008014eb40c445f2273c8c46c

    SHA1

    fe312b092bf0116ebf1c4d5c9bd17c8325bbca4c

    SHA256

    a3c2aabd5933e2335dbd8ffc22f9782f094b15dc1310ddfe2d8eb886983a77a2

    SHA512

    186a791807ae13bd836e0babf6386fabd4cc37150adc71ff0db45c7e8e234c4c18b1e291d27eb4b5b75370329bf1b7d077b6bed22545bde30e26158962821594

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\bpkhk.dll

    Filesize

    24KB

    MD5

    5f289ddb7bd9fcc086ea15cf1b287738

    SHA1

    0cb59fae3271117d72362df41b021af1f0eead30

    SHA256

    ffb19aa5f20e357f0d740bcf00a0d5e63f906f7850c8e045bd0658be32c78c98

    SHA512

    65f88df24d577675e56dd5fa1e68700345fa2f8bd97969ae8ced0f3fe62e62cff34eb222892b6453657897121bfecc037cd7b6b5210281cc6f4f17b069447006

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\bpkwb.dll

    Filesize

    12KB

    MD5

    eee461966f13e6ce1b3fefab2b34b80d

    SHA1

    fdb16b02d7f96f654f8bb29e106f8f25ac257762

    SHA256

    b95e85a8df4f5fc43d07c8283ebc735b8506cfa516a5901eec859403c1b7f2a3

    SHA512

    959167b4762caa64e6e7ded4eaffd29b95d6d909e644bfa7b38ba002e631102500190a303d6f8f4c88897b7d9340e0339800859433e98444edc5e1bd4825e7bc

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\inst.dat

    Filesize

    996B

    MD5

    59a67ba7ab2692a2115258bc8e784851

    SHA1

    b59852853f5c8234106deaff200aa93d178e5fbd

    SHA256

    edfbed04cd7accd7fc6020b35e8deffc27e20db785251e0ada1fbe542cfb754b

    SHA512

    f01594e7ce11e815b3eb27a99758a926e88a6ee3418c9c21037869558dcdb1af6aece5f6959cf6641649c4aedac1c96742687c85cb66b0959c5007037daa19cf

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\mc.dat

    Filesize

    13B

    MD5

    97bf1237c5b58aa6a79e5f85e8ceaa34

    SHA1

    90cd0a53e8bcb2b85c8b33376e4d2fc314757797

    SHA256

    e79e4b84d17a0f92cdeaeddab47df78b1d8edd527c63551166ffd488ea28cd64

    SHA512

    93eaa01d17804cbe4fc466bb2852fdd23e247e55f417e7bdfdf7ebae3a4a242f8d03d4c23457cbbd33206b24c1b825513482f2dbfdb81d882fb3facb701ae576

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\pk.bin

    Filesize

    4KB

    MD5

    a26d6380724f1d83898286ac85abb40e

    SHA1

    1ddc1cc337a348211af4dff4da42b47f27fa1af1

    SHA256

    b5278003c43956c8476bd722abb4e17dfc31bcf5fd580dbca28b2cf5b04852b1

    SHA512

    7f6b4584b874061908cd36c606d55d97e7f3723f976df6589355bd2d15d8359fd0d324885f5754ebb21a0e3c63f79abfe4d4f3c49a0f8dca79a7a9ff2d22d6dd

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\rinst.exe

    Filesize

    7KB

    MD5

    fbe4bab53f74d3049ef4b306d4cd8742

    SHA1

    6504b63908997a71a65997fa31eda4ae4de013e7

    SHA256

    446658dd5af649857fff445c600f26cdc1d0c19c86a080f312b89b1890182092

    SHA512

    d458ab806a3ed3d1494a13ad8a75df874a0b227cb4f337996cb82df3c4a26dc9c4fe48a664b53b052a4af123ea8d89911d9d9493870e6b5992d5621a32260c2f

  • C:\Windows\SysWOW64\bpk.exe

    Filesize

    40KB

    MD5

    07de5b6f42eaf5950c8cefd83cfca753

    SHA1

    c68d4903c7bfd0361d4d98921757d0f91d9ffe58

    SHA256

    34582a0bec7e4cb584258b6791ed51fbccee7dd600e61fd32400b7df48289f46

    SHA512

    4137e29484b3b86eabb7d15dfb4c77e355448a447ce229336d765fd2f77a0d7529756c4f870a865b9559dad14085f4663455a895c96523ad3c8fe7d65be039fe

  • C:\Windows\SysWOW64\bpk.exe

    Filesize

    73KB

    MD5

    613d68e872cf2191319d9e07cd720f8e

    SHA1

    69f86b9bf01ee1b6d6716019d42ca85ea043aab8

    SHA256

    5326bc8e94b58148407305e47fdd6113f6add6468a34f04deeae748bcb340451

    SHA512

    2c559ea791e071f86e4fe47998083855c5a5c0deee1b3b3d7fc7088d95dc48306d954000f6753a22b0c0aace2b8f940ef338426d0c661cf75bdeab206110e63d

  • C:\Windows\SysWOW64\bpkhk.dll

    Filesize

    8KB

    MD5

    87f17a0181b958f1e76814cb661a93f1

    SHA1

    6d56ec48639af4d6cfcf9954564c8b72fa4d998f

    SHA256

    4801c9ee28b4328f85facf3348c1486ee6ed818520e12f8a767b6e6e87ae73c5

    SHA512

    ae16d0b593f097872d71256bc57acbfee190d6148f7c72f9d4093f18fe5546a7af4f62277d73a41cf0c6e9e93c24fba8ca59d9a8546ea5d6ee5d4cda0601edbe

  • C:\Windows\SysWOW64\bpkhk.dll

    Filesize

    24KB

    MD5

    9ac9028338d1b353a7cacb563bb91df7

    SHA1

    a20c5dee8f05c91686324cec2d5b092bafe58339

    SHA256

    93c0e7f41d5d74217189e4cc2d5cdb8f97d8e5eeef0a0dcf4cecd67e3393682c

    SHA512

    ac83c8f7b6fe913487015d8d7a2e430e917d230b6b2907150f6c4a73bf64c3a02320dddc29fea03db5df8ac5620d8a902fe7be80ba1b1bd1e6f5b8b1b016ddfe

  • C:\Windows\SysWOW64\bpkwb.dll

    Filesize

    1KB

    MD5

    26a2096f316994955b20cce440400f27

    SHA1

    8aeaea309459406b0c8f2a9305a79eff2e14702c

    SHA256

    9401e3d735173178ee158be774f4fd2833f70792bbad67ff43dc8c28e7d68cbf

    SHA512

    0e11a33f8bd7a7fa5c98656a92fd728fa0adff574e481d0deb1cbc8fb26a191434fb5d37e38220c3f488cc2d82b245de0605905d81c09130d07098700816fc96

  • C:\Windows\SysWOW64\bpkwb.dll

    Filesize

    6KB

    MD5

    7a9f84c02f46232f1aa93e3893a9e65f

    SHA1

    2d9b870694fd29bb245023449d4c7645b78d162c

    SHA256

    e8847ffb8887d05ef48d1effe8e0f5d044bc58aa4048f57a3a1256e309ce7c93

    SHA512

    b7b19aff17fab5c84074ea6cf71bdf1ea6c241a9144a5e06dfdb923a4306ce379b953c03e35ee9ab392ded7a963781200da47cfcc4a6af65983068338a6bc617

  • C:\Windows\SysWOW64\bpkwb.dll

    Filesize

    29KB

    MD5

    b3621ea027928f5e39a8612d61b3a550

    SHA1

    90bd209b28d9d2349bc519fb7aea8d34525b4c99

    SHA256

    ab2e4c4f9f17853a99c9f95f95e29964f2b2c4e5e07b4bb2229d0c95988d7d84

    SHA512

    cdaf5e02eece7a47ac7fdb74d83679b9ec5285cda505855585d740d414db7dd769b12688071d2ba0aae468b3bfc86a4924ab8d4a0b95999d88d2d3421de8693d

  • C:\Windows\SysWOW64\mc.dat

    Filesize

    13B

    MD5

    6d40bc78f0f60f7f4cb79dbe4bf4e859

    SHA1

    c0ff2a8603f5c9457738e02f4a782d23cd9ce5c8

    SHA256

    94879d9a09d496cb6d4fde906803d9c1ab48cbd43d7948dc3a3725f7360d59cd

    SHA512

    31338964cfa607dba7a73ea3395f7a8e38bf4ba6db5816eb07b7296ede5e9fcd23534b481e7fbd603a9560329d5919ebedc0a4b4712d26be35cd364c4c044f81

  • C:\Windows\SysWOW64\pk.bin

    Filesize

    4KB

    MD5

    8c638a380f5a6317eb32b078e94ef03d

    SHA1

    7dedae8aa12a5c729af2b39b75c007aae3d10461

    SHA256

    a3b7fb386769fbc4dd232bfa7677b2c1093f71352d444c2733e89c9aa062cc3f

    SHA512

    b28bedb7be6312306be6a0eb5545430806d3e10a33480b6fd945116b6a2e2be64be431f1ecb58c8e4234d4960fee86a3792848e861ad73f95fef84dd19e7d85e

  • memory/1336-56-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB