Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

7

5bae030f30...ce.exe

windows7-x64

10

5bae030f30...ce.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    2s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/12/2023, 07:10

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    5bae030f30613badaa7354c376c217ce.exe

  • Size

    1.4MB

  • MD5

    5bae030f30613badaa7354c376c217ce

  • SHA1

    523ff5dd73db7335b54dcb21c296db79d065bc57

  • SHA256

    6d91cba543ad8cdca70294f97b370ed3f24167ea527fc06f4e48b8df918e55a1

  • SHA512

    12fbcbcd3290021b2ea6cb2657182d285ed1d77b08076a38f98a88dbefc36d5d51ae649cffa8cf03e944f1bf1276ad8fe439a9104b4e9c4bf41aada059c62845

  • SSDEEP

    1536:7ZskId5+yrryGczP54ghmB6qAID8sq/2zX5h3rG3mE/OKzpRWDYsxJC+ut7M3ZTs:pVAyGcN1gv/DFi2r5BtE/OKQdAi3

Score
10/10
evasionpersistencespywarestealertrojanupx

Malware Config

Signatures

  • Modifies firewall policy service 2 TTPs 18 IoCs
    evasion
  • Modifies security service 2 TTPs 1 IoCs
    evasion
  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • UAC bypass 3 TTPs 4 IoCs
    evasiontrojan
  • Windows security bypass 2 TTPs 4 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Disables Task Manager via registry modification
    evasion
  • Disables taskbar notifications via registry modification
    evasion
  • Drops file in Drivers directory 1 IoCs
  • Sets file execution options in registry 2 TTPs 64 IoCs
    persistence
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 1 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • UPX packed file 16 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Windows security modification 2 TTPs 15 IoCs
    evasiontrojan
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Control Panel 2 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 23 IoCs
    adwarespyware
  • Modifies Internet Explorer start page 1 TTPs 2 IoCs
    stealer
  • Modifies registry class 24 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 39 IoCs
  • System policy modification 1 TTPs 6 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\5bae030f30613badaa7354c376c217ce.exe
    "C:\Users\Admin\AppData\Local\Temp\5bae030f30613badaa7354c376c217ce.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4864
    • C:\Users\Admin\AppData\Local\Temp\5bae030f30613badaa7354c376c217ce.exe
      2⤵
      • Checks computer location settings
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4928
    • C:\Windows\SysWOW64\svchost.exe
      C:\Windows\system32\svchost.exe
      2⤵
        PID:4888
    • C:\Users\Admin\E696D64614\winlogon.exe
      "C:\Users\Admin\E696D64614\winlogon.exe"
      1⤵
      • Modifies firewall policy service
      • Modifies security service
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • UAC bypass
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Drops file in Drivers directory
      • Sets file execution options in registry
      • Drops startup file
      • Executes dropped EXE
      • Windows security modification
      • Checks whether UAC is enabled
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • System policy modification
      PID:4300
    • C:\Users\Admin\E696D64614\winlogon.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3640
    • C:\Users\Admin\E696D64614\winlogon.exe
      1⤵
      • Executes dropped EXE
      PID:5100
    • C:\Windows\SysWOW64\svchost.exe
      C:\Windows\system32\svchost.exe
      1⤵
        PID:4600
      • C:\Users\Admin\E696D64614\winlogon.exe
        "C:\Users\Admin\E696D64614\winlogon.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:3620
      • C:\Windows\system32\wbem\unsecapp.exe
        C:\Windows\system32\wbem\unsecapp.exe -Embedding
        1⤵
          PID:1920
        • C:\Program Files (x86)\Internet Explorer\ielowutil.exe
          "C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
          1⤵
            PID:1600
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
            1⤵
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:4916
            • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
              "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4916 CREDAT:17410 /prefetch:2
              2⤵
              • Modifies Internet Explorer settings
              PID:4108

          Network

          MITRE ATT&CK Enterprise v15

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          Persistence

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Create or Modify System Process

          2
          T1543

          Windows Service

          2
          T1543.003

          Privilege Escalation

          Abuse Elevation Control Mechanism

          1
          T1548

          Bypass User Account Control

          1
          T1548.002

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Create or Modify System Process

          2
          T1543

          Windows Service

          2
          T1543.003

          Defense Evasion

          Abuse Elevation Control Mechanism

          1
          T1548

          Bypass User Account Control

          1
          T1548.002

          Hide Artifacts

          2
          T1564

          Hidden Files and Directories

          2
          T1564.001

          Impair Defenses

          3
          T1562

          Disable or Modify Tools

          3
          T1562.001

          Modify Registry

          11
          T1112

          Credential Access

          Unsecured Credentials

          1
          T1552

          Credentials In Files

          1
          T1552.001

          Discovery

          Query Registry

          1
          T1012

          System Information Discovery

          3
          T1082

          Lateral Movement

          Collection

          Data from Local System

          1
          T1005

          Command and Control

          Exfiltration

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BJCNBC62\suggestions[1].en-US
            Filesize

            17KB

            MD5

            5a34cb996293fde2cb7a4ac89587393a

            SHA1

            3c96c993500690d1a77873cd62bc639b3a10653f

            SHA256

            c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

            SHA512

            e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

            Download Submit

          • memory/3620-23-0x0000000000A60000-0x0000000000A9B000-memory.dmp

            Filesize

            236KB

            Download

          • memory/3620-16-0x0000000000A60000-0x0000000000A9B000-memory.dmp

            Filesize

            236KB

            Download

          • memory/3640-24-0x0000000000400000-0x000000000041C000-memory.dmp

            Filesize

            112KB

            Download

          • memory/3640-1662-0x0000000000400000-0x000000000041C000-memory.dmp

            Filesize

            112KB

            Download

          • memory/3640-25-0x0000000000400000-0x000000000041C000-memory.dmp

            Filesize

            112KB

            Download

          • memory/4300-31-0x0000000000400000-0x0000000000443000-memory.dmp

            Filesize

            268KB

            Download

          • memory/4300-28-0x0000000000400000-0x0000000000443000-memory.dmp

            Filesize

            268KB

            Download

          • memory/4300-33-0x0000000000400000-0x0000000000443000-memory.dmp

            Filesize

            268KB

            Download

          • memory/4300-1972-0x0000000000400000-0x0000000000443000-memory.dmp

            Filesize

            268KB

            Download

          • memory/4864-0-0x0000000000BC0000-0x0000000000BFB000-memory.dmp

            Filesize

            236KB

            Download

          • memory/4864-4-0x0000000000BC0000-0x0000000000BFB000-memory.dmp

            Filesize

            236KB

            Download

          • memory/4928-18-0x0000000000400000-0x000000000041C000-memory.dmp

            Filesize

            112KB

            Download

          • memory/4928-1-0x0000000000400000-0x000000000041C000-memory.dmp

            Filesize

            112KB

            Download

          • memory/4928-5-0x0000000000400000-0x000000000041C000-memory.dmp

            Filesize

            112KB

            Download

          • memory/4928-3-0x0000000000400000-0x000000000041C000-memory.dmp

            Filesize

            112KB

            Download

          • memory/5100-20-0x0000000000A60000-0x0000000000A9B000-memory.dmp

            Filesize

            236KB

            Download