Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    142s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/12/2023, 12:48

General

  • Target

    19045b2baf33f91c99da4ea9a7a409d4.exe

  • Size

    10KB

  • MD5

    19045b2baf33f91c99da4ea9a7a409d4

  • SHA1

    fb14ca6fea7aa049402e9f144cf974d643beaeaf

  • SHA256

    90e66a2abce2a534f5f890fe0c77643568308d6e9e27ac00a2248c6b492f3f95

  • SHA512

    064e7191cf091cd8d31a7dc82c59feb9452b7835d270f2e981b272bff07224ad9b0456c00bfe510866e771e95eba708949cfb5f5feeb3e42a6e206c4f81268b5

  • SSDEEP

    192:RyMqv+F7pQtH5dWVJLD9popPzvKx1jRN6TDzi/6DGLdtY/cLbf+OHTTFZ:Idg7pQtHDYLD0p2n+DO/I6Y4bjzr

Score
8/10

Malware Config

Signatures

  • Modifies AppInit DLL entries 2 TTPs
  • Executes dropped EXE 1 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in System32 directory 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\19045b2baf33f91c99da4ea9a7a409d4.exe
    "C:\Users\Admin\AppData\Local\Temp\19045b2baf33f91c99da4ea9a7a409d4.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2440
    • C:\Windows\SysWOW64\comboausk.exe
      C:\Windows\system32\comboausk.exe ˜‰
      2⤵
      • Executes dropped EXE
      PID:3164
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\19045b2baf33f91c99da4ea9a7a409d4.exe.bat
      2⤵
        PID:1912

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\19045b2baf33f91c99da4ea9a7a409d4.exe.bat

      Filesize

      182B

      MD5

      31c8e01563a5e3ea7f0d0aa7d77402ca

      SHA1

      7b31b8f7ea4041eea25688f68d6742914f3b7e36

      SHA256

      c202974b54e334dfd7872a739731fc1cf40e24a5bed3251608aa23e18e6ca2cf

      SHA512

      74d2184e9d30d674c16fe03d2b2f0f81820dea2987748388a7cd0a673747526163a5d98d63a8362795f8a6267e516971f93f3ad31b1f31be878fa65a7eb88d84

    • C:\Windows\SysWOW64\comboausk.exe

      Filesize

      10KB

      MD5

      19045b2baf33f91c99da4ea9a7a409d4

      SHA1

      fb14ca6fea7aa049402e9f144cf974d643beaeaf

      SHA256

      90e66a2abce2a534f5f890fe0c77643568308d6e9e27ac00a2248c6b492f3f95

      SHA512

      064e7191cf091cd8d31a7dc82c59feb9452b7835d270f2e981b272bff07224ad9b0456c00bfe510866e771e95eba708949cfb5f5feeb3e42a6e206c4f81268b5

    • memory/2440-0-0x0000000000400000-0x000000000040E000-memory.dmp

      Filesize

      56KB

    • memory/2440-9-0x0000000000400000-0x000000000040E000-memory.dmp

      Filesize

      56KB

    • memory/3164-6-0x0000000000400000-0x000000000040E000-memory.dmp

      Filesize

      56KB