Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    200s
  • max time network
    218s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/12/2023, 05:19

General

  • Target

    0fd9de7ade782e98932527224de8190d.exe

  • Size

    13KB

  • MD5

    0fd9de7ade782e98932527224de8190d

  • SHA1

    77a3599c64b13b7848d876f431e6ed438d5f1eeb

  • SHA256

    b658e2e642ebcc72efdc36341a604252703231db7a59ed85463eac8fb8be34f7

  • SHA512

    304176f5dda65b7c8cf9364b61399cd0902edd22440ab40584c33658bcb24969b6d7d612fe209811a5ca2658055458d29d33350eff3e5962a16a3f6f436aaa3b

  • SSDEEP

    384:DxmI6AoJtteqexodGcuudFOvmRr4qHB+v:9mLtteVxrNud8vm9nHB+v

Score
10/10

Malware Config

Signatures

  • Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Drops file in System32 directory 3 IoCs
  • Modifies registry class 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0fd9de7ade782e98932527224de8190d.exe
    "C:\Users\Admin\AppData\Local\Temp\0fd9de7ade782e98932527224de8190d.exe"
    1⤵
    • Adds autorun key to be loaded by Explorer.exe on startup
    • Loads dropped DLL
    • Drops file in System32 directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3492
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\39B4.tmp.bat
      2⤵
        PID:2796

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\39B4.tmp.bat

      Filesize

      179B

      MD5

      c5052b4f704d3e867d11cac3a098273b

      SHA1

      c97e5e70b8a0d87957571c13662e6fce2df49a0a

      SHA256

      abf29a30bfa0c3053e6fa13b560cb981ebb791d3e9415e3826df1ce2f8f2ea90

      SHA512

      57b75651527c2d501d67425790f1443014db1e14308c2b9e3f8bf67ee1413e9b2b7f13c0525530996d598cc07cede29d963ec0886ba826f49d2fc2dbda909593

    • C:\Windows\SysWOW64\cliconfgzx.dll

      Filesize

      84KB

      MD5

      7e1a504108510946ba8d0b9512983a45

      SHA1

      0263429fbdf38ff718b574b90de92131684bf175

      SHA256

      15913afd464922ec4fbfa2766c7f5f7fb788072ca791c441f74902aaf590e3c5

      SHA512

      c0eb157690a2d0a615fad86371d29bbf8017a90cdc1b9eb5c711c746c727fe7c8d0bd5c31c2da701ee0d56aa6c5a4d7ee0f571c9f7ec4f8fd3adb25dbba0b3bf

    • C:\Windows\SysWOW64\cliconfgzx.dll

      Filesize

      196KB

      MD5

      3affe03ef69a67ea5246cc116af5e95a

      SHA1

      9e404bf792676908b697a47fce52bd63ab6ee0d6

      SHA256

      c6b19bf400048d45f97cb4f57b9674bb1d4f454174fa0224ab9c7b212f7fc4ba

      SHA512

      ddb458401040e77d45ffe618549e212c128ac95b9c0f9b898ab4c395bc1f6775c2eda7dbf2d4483c48d87b1b77da4b735e198adb5bb57438f01573bf6d423417

    • memory/3492-9-0x0000000020000000-0x000000002006C000-memory.dmp

      Filesize

      432KB

    • memory/3492-14-0x0000000020000000-0x000000002006C000-memory.dmp

      Filesize

      432KB