Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    145s
  • max time network
    140s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/12/2023, 00:48

General

  • Target

    09104d1e60e897712568dbca8c54cace.exe

  • Size

    629KB

  • MD5

    09104d1e60e897712568dbca8c54cace

  • SHA1

    75ac14370f0a94b57b28a21cf23b15785c31700b

  • SHA256

    757e8e0d877c4f6e3ee83dcfb19b03871b2a11592db3fd2e930d6020d5a1422b

  • SHA512

    72b553d55ad6195ef36df133f6b6da4fa36da25c41f786235d898cb1ea0368b1d7fb53cd9bfa1699303ed1eb6fb8dd43a7f45642508345eab5d3ee8af87b9e99

  • SSDEEP

    12288:MlIFreXlWDAFWGijeZZICG5l1gx41c2obY7rwtN5yfMe:MSAO5GijeZXG5PgxqocwkUe

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in Windows directory 3 IoCs
  • Modifies data under HKEY_USERS 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\09104d1e60e897712568dbca8c54cace.exe
    "C:\Users\Admin\AppData\Local\Temp\09104d1e60e897712568dbca8c54cace.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1636
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\03VMP~1.EXE
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\03VMP~1.EXE
      2⤵
      • Executes dropped EXE
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:264
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Windows\DELME.BAT
        3⤵
          PID:3804
    • C:\Windows\windows.exe
      C:\Windows\windows.exe
      1⤵
      • Executes dropped EXE
      • Modifies data under HKEY_USERS
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:4676
      • C:\Program Files\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
        2⤵
          PID:1932

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/264-41-0x0000000000400000-0x0000000000524000-memory.dmp

        Filesize

        1.1MB

      • memory/264-51-0x0000000000400000-0x0000000000524000-memory.dmp

        Filesize

        1.1MB

      • memory/264-39-0x0000000000400000-0x0000000000524000-memory.dmp

        Filesize

        1.1MB

      • memory/264-40-0x0000000002290000-0x0000000002291000-memory.dmp

        Filesize

        4KB

      • memory/264-43-0x00000000023E0000-0x00000000023E1000-memory.dmp

        Filesize

        4KB

      • memory/1636-15-0x0000000000BA0000-0x0000000000BA1000-memory.dmp

        Filesize

        4KB

      • memory/1636-13-0x0000000000D40000-0x0000000000D41000-memory.dmp

        Filesize

        4KB

      • memory/1636-32-0x0000000002A50000-0x0000000002A51000-memory.dmp

        Filesize

        4KB

      • memory/1636-31-0x00000000005B0000-0x00000000005B1000-memory.dmp

        Filesize

        4KB

      • memory/1636-28-0x00000000005A0000-0x00000000005A1000-memory.dmp

        Filesize

        4KB

      • memory/1636-27-0x0000000002AA0000-0x0000000002AA1000-memory.dmp

        Filesize

        4KB

      • memory/1636-26-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

        Filesize

        4KB

      • memory/1636-25-0x0000000000DD0000-0x0000000000DD1000-memory.dmp

        Filesize

        4KB

      • memory/1636-24-0x0000000000DC0000-0x0000000000DC1000-memory.dmp

        Filesize

        4KB

      • memory/1636-23-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

        Filesize

        4KB

      • memory/1636-22-0x0000000000D70000-0x0000000000D71000-memory.dmp

        Filesize

        4KB

      • memory/1636-21-0x0000000000D80000-0x0000000000D81000-memory.dmp

        Filesize

        4KB

      • memory/1636-20-0x0000000000CE0000-0x0000000000CE1000-memory.dmp

        Filesize

        4KB

      • memory/1636-19-0x0000000000D20000-0x0000000000D21000-memory.dmp

        Filesize

        4KB

      • memory/1636-18-0x0000000000D50000-0x0000000000D51000-memory.dmp

        Filesize

        4KB

      • memory/1636-17-0x0000000000D10000-0x0000000000D11000-memory.dmp

        Filesize

        4KB

      • memory/1636-16-0x0000000000D00000-0x0000000000D01000-memory.dmp

        Filesize

        4KB

      • memory/1636-0-0x0000000001000000-0x00000000010AD000-memory.dmp

        Filesize

        692KB

      • memory/1636-14-0x0000000000BC0000-0x0000000000BC1000-memory.dmp

        Filesize

        4KB

      • memory/1636-34-0x0000000002A30000-0x0000000002A31000-memory.dmp

        Filesize

        4KB

      • memory/1636-35-0x0000000002AB0000-0x0000000002AB1000-memory.dmp

        Filesize

        4KB

      • memory/1636-33-0x0000000002A40000-0x0000000002A41000-memory.dmp

        Filesize

        4KB

      • memory/1636-12-0x0000000002A10000-0x0000000002A14000-memory.dmp

        Filesize

        16KB

      • memory/1636-11-0x0000000000B20000-0x0000000000B21000-memory.dmp

        Filesize

        4KB

      • memory/1636-10-0x0000000002A20000-0x0000000002A21000-memory.dmp

        Filesize

        4KB

      • memory/1636-9-0x0000000000B50000-0x0000000000B51000-memory.dmp

        Filesize

        4KB

      • memory/1636-8-0x0000000000B80000-0x0000000000B81000-memory.dmp

        Filesize

        4KB

      • memory/1636-7-0x0000000000B40000-0x0000000000B41000-memory.dmp

        Filesize

        4KB

      • memory/1636-6-0x0000000000B30000-0x0000000000B31000-memory.dmp

        Filesize

        4KB

      • memory/1636-5-0x0000000000850000-0x0000000000851000-memory.dmp

        Filesize

        4KB

      • memory/1636-4-0x0000000000860000-0x0000000000861000-memory.dmp

        Filesize

        4KB

      • memory/1636-3-0x0000000000B70000-0x0000000000B71000-memory.dmp

        Filesize

        4KB

      • memory/1636-1-0x0000000001000000-0x00000000010AD000-memory.dmp

        Filesize

        692KB

      • memory/1636-52-0x0000000001000000-0x00000000010AD000-memory.dmp

        Filesize

        692KB

      • memory/1636-53-0x0000000000AD0000-0x0000000000B20000-memory.dmp

        Filesize

        320KB

      • memory/1636-2-0x0000000000AD0000-0x0000000000B20000-memory.dmp

        Filesize

        320KB

      • memory/4676-48-0x0000000000F40000-0x0000000000F41000-memory.dmp

        Filesize

        4KB

      • memory/4676-47-0x0000000000400000-0x0000000000524000-memory.dmp

        Filesize

        1.1MB

      • memory/4676-55-0x0000000000400000-0x0000000000524000-memory.dmp

        Filesize

        1.1MB

      • memory/4676-56-0x00000000006E0000-0x00000000006E1000-memory.dmp

        Filesize

        4KB

      • memory/4676-57-0x0000000000F40000-0x0000000000F41000-memory.dmp

        Filesize

        4KB