Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    181s
  • max time network
    200s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/12/2023, 00:11

General

  • Target

    1bfb30639d02336395de9a01866d63b0.exe

  • Size

    425KB

  • MD5

    1bfb30639d02336395de9a01866d63b0

  • SHA1

    6f1139516c8b5a7fd8a36fcfcc52d0e93fa15111

  • SHA256

    20ba3ad626dca31c666bfff0ff3d1d2cf71b664383cb7c775b7f4a9725989b89

  • SHA512

    2bced330d656d43ecbb89fc13e42cac77c125ce1f879f2e80f5032d02755da15ab70e99fe789b66d980dc72ec235e906ffc0734e07551aef291290da03871ed1

  • SSDEEP

    1536:2TJjMefFvUW9jjaZoSbdD2DDo/wwyI5GM0M7eSB3/OizN+jsgevhWqLegb0hp:utMeN8W9jLS5D2g/Ry6GSB33Fge5ySo

Score
7/10
upx

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 6 IoCs
  • UPX packed file 17 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious use of SetThreadContext 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 4 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 57 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1bfb30639d02336395de9a01866d63b0.exe
    "C:\Users\Admin\AppData\Local\Temp\1bfb30639d02336395de9a01866d63b0.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1384
    • C:\Windows\SysWOW64\svchost.exe
      C:\Windows\system32\\svchost.exe
      2⤵
        PID:4216
      • C:\Users\Admin\AppData\Local\Temp\1bfb30639d02336395de9a01866d63b0.exe
        2⤵
        • Checks computer location settings
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3644
        • C:\Users\Admin\E696D64614\winlogon.exe
          "C:\Users\Admin\E696D64614\winlogon.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:1880
          • C:\Windows\SysWOW64\svchost.exe
            C:\Windows\system32\\svchost.exe
            4⤵
              PID:5108
            • C:\Users\Admin\E696D64614\winlogon.exe
              4⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:548
              • C:\Users\Admin\E696D64614\winlogon.exe
                "C:\Users\Admin\E696D64614\winlogon.exe"
                5⤵
                • Executes dropped EXE
                PID:2972
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 2972 -s 12
                  6⤵
                  • Program crash
                  PID:3672
              • C:\Users\Admin\E696D64614\winlogon.exe
                "C:\Users\Admin\E696D64614\winlogon.exe"
                5⤵
                • Executes dropped EXE
                PID:3176
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 3176 -s 12
                  6⤵
                  • Program crash
                  PID:3068
              • C:\Users\Admin\E696D64614\winlogon.exe
                "C:\Users\Admin\E696D64614\winlogon.exe"
                5⤵
                • Executes dropped EXE
                PID:4300
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 4300 -s 12
                  6⤵
                  • Program crash
                  PID:4328
              • C:\Users\Admin\E696D64614\winlogon.exe
                "C:\Users\Admin\E696D64614\winlogon.exe"
                5⤵
                • Executes dropped EXE
                PID:1552
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 1552 -s 12
                  6⤵
                  • Program crash
                  PID:1076
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2972 -ip 2972
        1⤵
          PID:4960
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 3176 -ip 3176
          1⤵
            PID:844
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4300 -ip 4300
            1⤵
              PID:2796
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 1552 -ip 1552
              1⤵
                PID:3752

              Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\E696D64614\winlogon.exe

                Filesize

                425KB

                MD5

                1bfb30639d02336395de9a01866d63b0

                SHA1

                6f1139516c8b5a7fd8a36fcfcc52d0e93fa15111

                SHA256

                20ba3ad626dca31c666bfff0ff3d1d2cf71b664383cb7c775b7f4a9725989b89

                SHA512

                2bced330d656d43ecbb89fc13e42cac77c125ce1f879f2e80f5032d02755da15ab70e99fe789b66d980dc72ec235e906ffc0734e07551aef291290da03871ed1

              • memory/548-26-0x0000000000400000-0x000000000041C000-memory.dmp

                Filesize

                112KB

              • memory/548-49-0x0000000000400000-0x000000000041C000-memory.dmp

                Filesize

                112KB

              • memory/548-42-0x0000000000400000-0x000000000041C000-memory.dmp

                Filesize

                112KB

              • memory/548-37-0x0000000000400000-0x000000000041C000-memory.dmp

                Filesize

                112KB

              • memory/548-30-0x0000000000400000-0x000000000041C000-memory.dmp

                Filesize

                112KB

              • memory/548-29-0x0000000000400000-0x000000000041C000-memory.dmp

                Filesize

                112KB

              • memory/548-22-0x0000000000400000-0x000000000041C000-memory.dmp

                Filesize

                112KB

              • memory/548-23-0x0000000000400000-0x000000000041C000-memory.dmp

                Filesize

                112KB

              • memory/1384-3-0x0000000000400000-0x0000000000437000-memory.dmp

                Filesize

                220KB

              • memory/1384-0-0x0000000000400000-0x0000000000437000-memory.dmp

                Filesize

                220KB

              • memory/1880-21-0x0000000000400000-0x0000000000437000-memory.dmp

                Filesize

                220KB

              • memory/1880-16-0x0000000000400000-0x0000000000437000-memory.dmp

                Filesize

                220KB

              • memory/3644-17-0x0000000000400000-0x000000000041C000-memory.dmp

                Filesize

                112KB

              • memory/3644-5-0x0000000000400000-0x000000000041C000-memory.dmp

                Filesize

                112KB

              • memory/3644-1-0x0000000000400000-0x000000000041C000-memory.dmp

                Filesize

                112KB

              • memory/3644-4-0x0000000000400000-0x000000000041C000-memory.dmp

                Filesize

                112KB