Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    153s
  • max time network
    159s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/12/2023, 02:45

General

  • Target

    24fff70f83197065cfd011efcb18c471.exe

  • Size

    3.3MB

  • MD5

    24fff70f83197065cfd011efcb18c471

  • SHA1

    aa7b959d9e71455c062c4d1c1d2069706c878e8a

  • SHA256

    8644b5a1ecf282da0e8ad4ff465e7026c26f6d3266f56e71b53e7ea776b03e7f

  • SHA512

    e39326653006966e3c5e274aa56d65cc3fc18ee6cd3f7e60083548f16b8ea9cea3809a925484d5615971f9c69f94e99b4c84176683446304c103a5ecc8a95109

  • SSDEEP

    98304:7RS6nfSOQZOt+CW+7EELhF3gxpNOf2k2Y/l:7kj8NBFwxpNOuk2w

Malware Config

Signatures

  • Stops running service(s) 3 TTPs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Launches sc.exe 2 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\24fff70f83197065cfd011efcb18c471.exe
    "C:\Users\Admin\AppData\Local\Temp\24fff70f83197065cfd011efcb18c471.exe"
    1⤵
    • Checks computer location settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4944
    • C:\Users\Admin\AppData\Local\Temp\b7MKxrvS51kC3lh.exe
      "C:\Users\Admin\AppData\Local\Temp\b7MKxrvS51kC3lh.exe" QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxUZW1wXDI0ZmZmNzBmODMxOTcwNjVjZmQwMTFlZmNiMThjNDcxLmV4ZQ==
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4080
      • C:\Windows\SYSTEM32\cmd.exe
        "cmd.exe" /C sc stop "SysMain" & sc config "SysMain" start=disabled
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4652
        • C:\Windows\system32\sc.exe
          sc stop "SysMain"
          4⤵
          • Launches sc.exe
          PID:1244
        • C:\Windows\system32\sc.exe
          sc config "SysMain" start=disabled
          4⤵
          • Launches sc.exe
          PID:5032

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\b7MKxrvS51kC3lh.exe

    Filesize

    3.3MB

    MD5

    33babed188e22c2a1489333fae97d0b2

    SHA1

    00081383fc7b8aeb6d60c08f3aba4225c1e23c5c

    SHA256

    caa58c5c9274cacb21ceaf371efdfb382c6939db3a21015456294f2d85864b48

    SHA512

    a744cbc2bb3d7b6a5c36ec2c7cda43d3449579e6a52edcf4d07bd4c2c0715780bcea95dc63d89773678b2fc956671811074f4e273ea44e87cf218fbdb0eb8336

  • C:\Users\Admin\AppData\Local\Temp\b7MKxrvS51kC3lh.exe

    Filesize

    3.2MB

    MD5

    658c2159b0f24991968ebdab8a5b9831

    SHA1

    95b3e16f30d8d75046017b4ab37d28316458f8ea

    SHA256

    0eab0e40994bf0a6347a1e2653cbc28fca7817d3352e42a08dc5c58db25dbe74

    SHA512

    c9742bd071bc505418d3b2335cf10ae62b24a9c59a2e75576286dfb66c4a2170a67839c8208c3d6db527452f0dcf615e109045758dd4152eccef6ef997d664a8

  • memory/4080-41-0x0000015855720000-0x0000015855758000-memory.dmp

    Filesize

    224KB

  • memory/4080-46-0x00007FF977500000-0x00007FF977FC1000-memory.dmp

    Filesize

    10.8MB

  • memory/4080-44-0x000001584A4D0000-0x000001584A5EF000-memory.dmp

    Filesize

    1.1MB

  • memory/4080-43-0x0000015849D90000-0x0000015849DA0000-memory.dmp

    Filesize

    64KB

  • memory/4080-47-0x0000015849D90000-0x0000015849DA0000-memory.dmp

    Filesize

    64KB

  • memory/4080-42-0x00000158556F0000-0x00000158556FE000-memory.dmp

    Filesize

    56KB

  • memory/4080-40-0x0000015849D90000-0x0000015849DA0000-memory.dmp

    Filesize

    64KB

  • memory/4080-39-0x000001584A780000-0x000001584A786000-memory.dmp

    Filesize

    24KB

  • memory/4080-38-0x000001584A860000-0x000001584A8D2000-memory.dmp

    Filesize

    456KB

  • memory/4080-37-0x0000015849D90000-0x0000015849DA0000-memory.dmp

    Filesize

    64KB

  • memory/4080-33-0x00007FF977500000-0x00007FF977FC1000-memory.dmp

    Filesize

    10.8MB

  • memory/4080-32-0x000001582F410000-0x000001582F734000-memory.dmp

    Filesize

    3.1MB

  • memory/4080-49-0x0000015849D90000-0x0000015849DA0000-memory.dmp

    Filesize

    64KB

  • memory/4944-8-0x00000247AC120000-0x00000247AC1BC000-memory.dmp

    Filesize

    624KB

  • memory/4944-9-0x0000024792110000-0x0000024792116000-memory.dmp

    Filesize

    24KB

  • memory/4944-18-0x00007FF977500000-0x00007FF977FC1000-memory.dmp

    Filesize

    10.8MB

  • memory/4944-14-0x00000247AC210000-0x00000247AC214000-memory.dmp

    Filesize

    16KB

  • memory/4944-13-0x00000247ACC80000-0x00000247ACCB2000-memory.dmp

    Filesize

    200KB

  • memory/4944-12-0x00000247ACD40000-0x00000247ACDFA000-memory.dmp

    Filesize

    744KB

  • memory/4944-36-0x00007FF977500000-0x00007FF977FC1000-memory.dmp

    Filesize

    10.8MB

  • memory/4944-11-0x00000247ACA70000-0x00000247ACB8F000-memory.dmp

    Filesize

    1.1MB

  • memory/4944-10-0x00000247AC1D0000-0x00000247AC1D8000-memory.dmp

    Filesize

    32KB

  • memory/4944-19-0x00000247AC1E0000-0x00000247AC1F0000-memory.dmp

    Filesize

    64KB

  • memory/4944-0-0x0000024791970000-0x0000024791C94000-memory.dmp

    Filesize

    3.1MB

  • memory/4944-7-0x00000247920B0000-0x00000247920B6000-memory.dmp

    Filesize

    24KB

  • memory/4944-6-0x0000024792070000-0x0000024792074000-memory.dmp

    Filesize

    16KB

  • memory/4944-5-0x00000247AC530000-0x00000247AC968000-memory.dmp

    Filesize

    4.2MB

  • memory/4944-4-0x0000024792040000-0x0000024792070000-memory.dmp

    Filesize

    192KB

  • memory/4944-3-0x00000247AC1E0000-0x00000247AC1F0000-memory.dmp

    Filesize

    64KB

  • memory/4944-2-0x00000247AC240000-0x00000247AC530000-memory.dmp

    Filesize

    2.9MB

  • memory/4944-1-0x00007FF977500000-0x00007FF977FC1000-memory.dmp

    Filesize

    10.8MB