Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/12/2023, 21:48

General

  • Target

    1d8b98f417340d9b399a5f9f9944b2e3.exe

  • Size

    744KB

  • MD5

    1d8b98f417340d9b399a5f9f9944b2e3

  • SHA1

    19e4f629d735ac04504510b3a2d6124e654bf883

  • SHA256

    6bf32a69e43c97be65994a8f24b369eaa85d7f9d194d92cfaad35a9f37bab8ff

  • SHA512

    7247b16bbce7038ec7ee2313cd6356f1da0a8c31cfaa40dde53bddd67fee681b2db2aa334901f7b34898bd42fccd1d7b404f2bdfd6ce01a2106c270786a1d9c4

  • SSDEEP

    12288:vfyDxDV00lo3Oxp88Cy1bFKkEgjRFa92VvABc4czAM6CZdUs:nuxC0lwOxp8K1xNVK2VvAPWOw

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Sets file execution options in registry 2 TTPs 64 IoCs
  • Executes dropped EXE 1 IoCs
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs
  • System policy modification 1 TTPs 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1d8b98f417340d9b399a5f9f9944b2e3.exe
    "C:\Users\Admin\AppData\Local\Temp\1d8b98f417340d9b399a5f9f9944b2e3.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:1752
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
      2⤵
        PID:4240
    • C:\Windows\dllhost.exe
      C:\Windows\dllhost.exe -netsvcs
      1⤵
      • Modifies WinLogon for persistence
      • Sets file execution options in registry
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1716

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Windows\SysWOW64\Deleteme.bat

      Filesize

      184B

      MD5

      6bb8216f32cb533653e2e534150495af

      SHA1

      8b26355e76a119576dd9e4a132415c89b603bdc6

      SHA256

      3d3ed5dc44a6e0bd924b4bd464ed97246d36fad65430711724f16ecb7d006286

      SHA512

      fee2856b66600ce714ad236abaf4bc17bf17e430933030aecefd25e3d19dd0d2dd7025b15e2b137143c8a0f65862b139383cf088f6bd19b55134bdf11930b8e1

    • C:\Windows\dllhost.exe

      Filesize

      744KB

      MD5

      1d8b98f417340d9b399a5f9f9944b2e3

      SHA1

      19e4f629d735ac04504510b3a2d6124e654bf883

      SHA256

      6bf32a69e43c97be65994a8f24b369eaa85d7f9d194d92cfaad35a9f37bab8ff

      SHA512

      7247b16bbce7038ec7ee2313cd6356f1da0a8c31cfaa40dde53bddd67fee681b2db2aa334901f7b34898bd42fccd1d7b404f2bdfd6ce01a2106c270786a1d9c4

    • F:\autorun.inf.tmp

      Filesize

      186B

      MD5

      388cdce38219e26795c8df2e4b9a8a4c

      SHA1

      0e72b83417eab223464533d1b749d4bd8a6caa13

      SHA256

      29eecdb0b3889f3fd97795e770d38455e8af0ca84119dda8e009a123aa527d9b

      SHA512

      8912302845a77e2d19d0306acdefa1bd55666004eb6240f1d47fceef2ebccf1102fceaf5564de89499106ee03514e6c9ffb82805faaf54be0a9e5f304be0b5b7

    • memory/1716-84-0x0000000000400000-0x00000000004C2000-memory.dmp

      Filesize

      776KB

    • memory/1716-118-0x0000000000400000-0x00000000004C2000-memory.dmp

      Filesize

      776KB

    • memory/1716-11-0x0000000000CD0000-0x0000000000CD1000-memory.dmp

      Filesize

      4KB

    • memory/1716-36-0x0000000000400000-0x00000000004C2000-memory.dmp

      Filesize

      776KB

    • memory/1716-53-0x0000000000400000-0x00000000004C2000-memory.dmp

      Filesize

      776KB

    • memory/1716-56-0x0000000000CD0000-0x0000000000CD1000-memory.dmp

      Filesize

      4KB

    • memory/1716-69-0x0000000000400000-0x00000000004C2000-memory.dmp

      Filesize

      776KB

    • memory/1716-248-0x0000000000400000-0x00000000004C2000-memory.dmp

      Filesize

      776KB

    • memory/1716-103-0x0000000000400000-0x00000000004C2000-memory.dmp

      Filesize

      776KB

    • memory/1716-233-0x0000000000400000-0x00000000004C2000-memory.dmp

      Filesize

      776KB

    • memory/1716-133-0x0000000000400000-0x00000000004C2000-memory.dmp

      Filesize

      776KB

    • memory/1716-148-0x0000000000400000-0x00000000004C2000-memory.dmp

      Filesize

      776KB

    • memory/1716-167-0x0000000000400000-0x00000000004C2000-memory.dmp

      Filesize

      776KB

    • memory/1716-182-0x0000000000400000-0x00000000004C2000-memory.dmp

      Filesize

      776KB

    • memory/1716-199-0x0000000000400000-0x00000000004C2000-memory.dmp

      Filesize

      776KB

    • memory/1716-214-0x0000000000400000-0x00000000004C2000-memory.dmp

      Filesize

      776KB

    • memory/1752-20-0x0000000000400000-0x00000000004C2000-memory.dmp

      Filesize

      776KB

    • memory/1752-0-0x0000000000780000-0x0000000000781000-memory.dmp

      Filesize

      4KB