Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    1s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/01/2024, 14:57

General

  • Target

    1694c0fe69e7b2a5e1fb8f76de91fa47.exe

  • Size

    512KB

  • MD5

    1694c0fe69e7b2a5e1fb8f76de91fa47

  • SHA1

    96ef777ac2d8b9d5a2e7abca0954efc4a29bfa32

  • SHA256

    8211aac46563d0fe4e35480ba6879a4d54311e918bf022d8df6a360cc0c87c20

  • SHA512

    197ba89c8fb623d522f726fbaaa91fc9ba5976ae862aa6bae0bbb2467034807dc12ea83799cb33812b0d6ecc157a83155a30ea457c2ceb9a05ac6e8e2f6ac1ff

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6S:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5v

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 4 IoCs
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 8 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 7 IoCs
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious use of FindShellTrayWindow 7 IoCs
  • Suspicious use of SendNotifyMessage 7 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1694c0fe69e7b2a5e1fb8f76de91fa47.exe
    "C:\Users\Admin\AppData\Local\Temp\1694c0fe69e7b2a5e1fb8f76de91fa47.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4084
    • C:\Windows\SysWOW64\ettrjmfxvpgfa.exe
      ettrjmfxvpgfa.exe
      2⤵
      • Executes dropped EXE
      PID:4792
    • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
      "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""
      2⤵
        PID:212
      • C:\Windows\SysWOW64\zloxdxuz.exe
        zloxdxuz.exe
        2⤵
        • Executes dropped EXE
        PID:2304
      • C:\Windows\SysWOW64\ckywomlxxwbrvuo.exe
        ckywomlxxwbrvuo.exe
        2⤵
        • Executes dropped EXE
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:5012
      • C:\Windows\SysWOW64\samspqijxe.exe
        samspqijxe.exe
        2⤵
        • Executes dropped EXE
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:3400
    • C:\Windows\SysWOW64\zloxdxuz.exe
      C:\Windows\system32\zloxdxuz.exe
      1⤵
        PID:1900

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/212-45-0x00007FF8E7150000-0x00007FF8E7160000-memory.dmp

        Filesize

        64KB

      • memory/212-117-0x00007FF9270D0000-0x00007FF9272C5000-memory.dmp

        Filesize

        2.0MB

      • memory/212-40-0x00007FF8E7150000-0x00007FF8E7160000-memory.dmp

        Filesize

        64KB

      • memory/212-43-0x00007FF9270D0000-0x00007FF9272C5000-memory.dmp

        Filesize

        2.0MB

      • memory/212-47-0x00007FF9270D0000-0x00007FF9272C5000-memory.dmp

        Filesize

        2.0MB

      • memory/212-49-0x00007FF9270D0000-0x00007FF9272C5000-memory.dmp

        Filesize

        2.0MB

      • memory/212-51-0x00007FF9270D0000-0x00007FF9272C5000-memory.dmp

        Filesize

        2.0MB

      • memory/212-52-0x00007FF9270D0000-0x00007FF9272C5000-memory.dmp

        Filesize

        2.0MB

      • memory/212-53-0x00007FF8E4F50000-0x00007FF8E4F60000-memory.dmp

        Filesize

        64KB

      • memory/212-54-0x00007FF9270D0000-0x00007FF9272C5000-memory.dmp

        Filesize

        2.0MB

      • memory/212-50-0x00007FF9270D0000-0x00007FF9272C5000-memory.dmp

        Filesize

        2.0MB

      • memory/212-48-0x00007FF9270D0000-0x00007FF9272C5000-memory.dmp

        Filesize

        2.0MB

      • memory/212-46-0x00007FF9270D0000-0x00007FF9272C5000-memory.dmp

        Filesize

        2.0MB

      • memory/212-55-0x00007FF8E4F50000-0x00007FF8E4F60000-memory.dmp

        Filesize

        64KB

      • memory/212-39-0x00007FF9270D0000-0x00007FF9272C5000-memory.dmp

        Filesize

        2.0MB

      • memory/212-141-0x00007FF8E7150000-0x00007FF8E7160000-memory.dmp

        Filesize

        64KB

      • memory/212-119-0x00007FF9270D0000-0x00007FF9272C5000-memory.dmp

        Filesize

        2.0MB

      • memory/212-41-0x00007FF9270D0000-0x00007FF9272C5000-memory.dmp

        Filesize

        2.0MB

      • memory/212-37-0x00007FF8E7150000-0x00007FF8E7160000-memory.dmp

        Filesize

        64KB

      • memory/212-38-0x00007FF9270D0000-0x00007FF9272C5000-memory.dmp

        Filesize

        2.0MB

      • memory/212-44-0x00007FF8E7150000-0x00007FF8E7160000-memory.dmp

        Filesize

        64KB

      • memory/212-118-0x00007FF9270D0000-0x00007FF9272C5000-memory.dmp

        Filesize

        2.0MB

      • memory/212-42-0x00007FF8E7150000-0x00007FF8E7160000-memory.dmp

        Filesize

        64KB

      • memory/212-144-0x00007FF9270D0000-0x00007FF9272C5000-memory.dmp

        Filesize

        2.0MB

      • memory/212-147-0x00007FF9270D0000-0x00007FF9272C5000-memory.dmp

        Filesize

        2.0MB

      • memory/212-146-0x00007FF9270D0000-0x00007FF9272C5000-memory.dmp

        Filesize

        2.0MB

      • memory/212-145-0x00007FF8E7150000-0x00007FF8E7160000-memory.dmp

        Filesize

        64KB

      • memory/212-143-0x00007FF8E7150000-0x00007FF8E7160000-memory.dmp

        Filesize

        64KB

      • memory/212-142-0x00007FF8E7150000-0x00007FF8E7160000-memory.dmp

        Filesize

        64KB

      • memory/4084-0-0x0000000000400000-0x0000000000496000-memory.dmp

        Filesize

        600KB