Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/12/2023, 22:56

General

  • Target

    1f24e4d5fc6693648e7c404d4b31be49.exe

  • Size

    23KB

  • MD5

    1f24e4d5fc6693648e7c404d4b31be49

  • SHA1

    710bfeeaf7084a7c65b337d6de92126f3de4fed7

  • SHA256

    de51f37f5cb828a9d5d9ae3784a9e7ecf75ea8a8f35c9f2a5ebdef5edd5ae6f9

  • SHA512

    ffd9fd04c55dba77ae9ba818c08dbfbd42db5c99671b4201334af400a73d6233719a7a01dc5fccca19512bd30d27fb4b772c9f67341bc49ca79f633616caa46f

  • SSDEEP

    384:pzARALrTUe7ZPbfHgLRlk3L5I0ldpG3IJ6SbTyrzhpRdLZ3hj0i6Frlx9:Ga/TlPbfO/uL5/dpG306SiXhpbTYj

Malware Config

Signatures

  • Adds policy Run key to start application 2 TTPs 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1f24e4d5fc6693648e7c404d4b31be49.exe
    "C:\Users\Admin\AppData\Local\Temp\1f24e4d5fc6693648e7c404d4b31be49.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1756
    • C:\Program Files (x86)\Security Tools\imsmain.exe
      "C:\Program Files (x86)\Security Tools\imsmain.exe"
      2⤵
      • Adds policy Run key to start application
      • Executes dropped EXE
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:516
      • C:\Program Files (x86)\Security Tools\imsmn.exe
        "C:\Program Files (x86)\Security Tools\imsmn.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        PID:4684
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uninst0.bat" "
      2⤵
        PID:3196

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\Security Tools\imsmain.exe

      Filesize

      28KB

      MD5

      986749db854219ea6860ad5c2fc1d347

      SHA1

      a1fe81b15ed79a057624cbb78d1d7b097865d15a

      SHA256

      ac4c0a16fffc876af4ff3a30f5c684816acf6073dfd95f98a7c3959a216684a2

      SHA512

      992728b788fc3b871668611ebbd475d8b932bc3523366fa5c8006a70c39ed823e9b954897dadfd494226216bb571c38a12001ccb1ab989be17fe4640f7e0b40b

    • C:\Program Files (x86)\Security Tools\imsmn.exe

      Filesize

      7KB

      MD5

      1d33a0839a337cc60967510d5b0fb218

      SHA1

      aad20595e3aaea690bccbf70633242b0ef6df049

      SHA256

      9351a96c20bb8d8cb4a1814a038a72493e19e8386a25bd3197e996bdd0aa43b3

      SHA512

      857f9412a150aaca3a8b25c6bbb3cad041912f9c3625f3ffc6e1f4badd2d764db99b7dbe84355c46454622e312dd5ca1ffeaadb67105ee0498cb8285239a0a10

    • C:\Users\Admin\AppData\Local\Temp\_uninst0.bat

      Filesize

      277B

      MD5

      c6c6039e439218cfa2f75af9b0a87096

      SHA1

      24904e70af7ec048559f57747e4a9ea056235cf3

      SHA256

      61d7ee048ac596a8349812b79e117e59ac879476e05d61085fcc07d7ad64fe01

      SHA512

      221c59428ff925669ef143aaa5d4ce1f1bb809c1479f0df1033a7c590bd58af2f09624e76888a998c7245e6f1cf55f55012c26ff6e2444d50701945e6de82eb7

    • memory/1756-0-0x0000000000400000-0x0000000000413000-memory.dmp

      Filesize

      76KB

    • memory/1756-14-0x0000000000400000-0x0000000000413000-memory.dmp

      Filesize

      76KB

    • memory/4684-11-0x0000000000400000-0x0000000000408000-memory.dmp

      Filesize

      32KB