Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    0s
  • max time network
    110s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/01/2024, 03:20

General

  • Target

    55589f0ba31caeb1506b805768840749.exe

  • Size

    1.5MB

  • MD5

    55589f0ba31caeb1506b805768840749

  • SHA1

    be7a0fa20dec57b9b94efb533e23a513547e3981

  • SHA256

    aec7d3254663753493cc816f6064fd39c6eaa477e9fe1af715480c4c2aee8112

  • SHA512

    a6484eeb0eeadd1e16f1ddd33e130f7a8194da2a68236d6178f5bb404fdc45b2e2fc6c615e045d10c013d9d9a745beebc1cfe70d78b3c9724d397849cbe47078

  • SSDEEP

    49152:68Gl0svU8HLuBX2sdu7c/WJdHhZZ39MT4Xq:68Y0svHLuBX2SuY/WJ5t3924Xq

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • NSIS installer 4 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\55589f0ba31caeb1506b805768840749.exe
    "C:\Users\Admin\AppData\Local\Temp\55589f0ba31caeb1506b805768840749.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:712
    • C:\Users\Admin\AppData\Local\Temp\dnt-firstlook-sntb.exe
      "dnt-firstlook-sntb.exe" /RETURNSTATUS /CHANNEL=US728 /TOOLBAR /DEFAULTSEARCH /DEFAULTSTART
      2⤵
        PID:3348
        • C:\Program Files (x86)\StartNow Toolbar\ToolbarUpdaterService.exe
          "C:\Program Files (x86)\StartNow Toolbar\ToolbarUpdaterService.exe" --install
          3⤵
            PID:4908
          • C:\Windows\SysWOW64\regsvr32.exe
            regsvr32.exe /i /s "C:\Program Files (x86)\StartNow Toolbar\Toolbar32.dll"
            3⤵
              PID:3372
            • C:\Program Files (x86)\StartNow Toolbar\ToolbarUpdaterService.exe
              "C:\Program Files (x86)\StartNow Toolbar\ToolbarUpdaterService.exe" --start
              3⤵
                PID:3320
            • C:\Users\Admin\AppData\Local\Temp\dnt-firstlook-sntb.exe
              "dnt-firstlook-sntb.exe" /CHANNEL=US728 /OFFERED /TOOLBAR /DEFAULTSTART /DEFAULTSEARCH
              2⤵
              • Executes dropped EXE
              PID:2708
            • C:\Users\Admin\AppData\Local\Temp\ispassistant-bho-setup.exe
              "ispassistant-bho-setup.exe" -d 5
              2⤵
                PID:2864
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://pornclips69.com/?tmp=adultvideo
                2⤵
                  PID:1548
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,1692252165987313232,13828104143955945310,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2844 /prefetch:8
                    3⤵
                      PID:2248
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,1692252165987313232,13828104143955945310,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2420 /prefetch:3
                      3⤵
                        PID:3672
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1692252165987313232,13828104143955945310,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
                        3⤵
                          PID:556
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1692252165987313232,13828104143955945310,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
                          3⤵
                            PID:2932
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1692252165987313232,13828104143955945310,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4076 /prefetch:1
                            3⤵
                              PID:2364
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,1692252165987313232,13828104143955945310,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
                              3⤵
                                PID:1264
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1692252165987313232,13828104143955945310,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:1
                                3⤵
                                  PID:1040
                                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,1692252165987313232,13828104143955945310,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4100 /prefetch:8
                                  3⤵
                                    PID:4024
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,1692252165987313232,13828104143955945310,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4100 /prefetch:8
                                    3⤵
                                      PID:4660
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1692252165987313232,13828104143955945310,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:1
                                      3⤵
                                        PID:3576
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1692252165987313232,13828104143955945310,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1
                                        3⤵
                                          PID:1164
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1692252165987313232,13828104143955945310,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4064 /prefetch:1
                                          3⤵
                                            PID:5272
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1692252165987313232,13828104143955945310,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:1
                                            3⤵
                                              PID:5380
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1692252165987313232,13828104143955945310,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1884 /prefetch:1
                                              3⤵
                                                PID:5468
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1692252165987313232,13828104143955945310,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3640 /prefetch:1
                                                3⤵
                                                  PID:6072
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,1692252165987313232,13828104143955945310,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
                                                  3⤵
                                                    PID:5260
                                              • C:\Program Files (x86)\StartNow Toolbar\ToolbarUpdaterService.exe
                                                "C:\Program Files (x86)\StartNow Toolbar\ToolbarUpdaterService.exe"
                                                1⤵
                                                  PID:4344
                                                • C:\Program Files (x86)\Internet Explorer\ielowutil.exe
                                                  "C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
                                                  1⤵
                                                    PID:816
                                                  • C:\Program Files\Internet Explorer\iexplore.exe
                                                    "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
                                                    1⤵
                                                      PID:2812
                                                      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                                        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2812 CREDAT:17410 /prefetch:2
                                                        2⤵
                                                          PID:4904
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff95dba46f8,0x7ff95dba4708,0x7ff95dba4718
                                                        1⤵
                                                          PID:1940
                                                        • C:\Windows\System32\CompPkgSrv.exe
                                                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                          1⤵
                                                            PID:2536
                                                          • C:\Windows\System32\CompPkgSrv.exe
                                                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                            1⤵
                                                              PID:4784

                                                            Network

                                                            MITRE ATT&CK Enterprise v15

                                                            Replay Monitor

                                                            Loading Replay Monitor...

                                                            Downloads

                                                            • C:\Users\Admin\AppData\Local\Temp\dnt-firstlook-sntb.exe

                                                              Filesize

                                                              712KB

                                                              MD5

                                                              4251d8d58a61737cabc32bee6ad94845

                                                              SHA1

                                                              a7dd476767117ddb8bf04588976735ce9b3757e2

                                                              SHA256

                                                              f168a3d9048460ade8e9a99570e04b7298b51d733cfdaa815c7114897ef43edf

                                                              SHA512

                                                              506aa2ae112bcfed60b3b0b8936d53f6b4ef0954030e65003706ddfa95db28080cdea92fd4f617caae31a47e2ebe6c22e023041d2d7d939956e44e9f6d259238

                                                            • C:\Users\Admin\AppData\Local\Temp\nsf471D.tmp\Math.dll

                                                              Filesize

                                                              64KB

                                                              MD5

                                                              15ae86d7e718db607ced309f37a8b50e

                                                              SHA1

                                                              2247aaa689b752cfa26833f04b9dc5200ab7f040

                                                              SHA256

                                                              8b5c4de6d6d07d4e6018d34533ef871060bad5b21bb5726deb655e87171c5a6a

                                                              SHA512

                                                              8c58348e85d83a67241dd658ec39ba31733aef73630d3a49ff0fdaa7d727800360c4894da692545c5a5d18f25bf07783df3581c9db4448c5cc316f35c606c6c0

                                                            • C:\Users\Admin\AppData\Local\Temp\nsf471D.tmp\Math.dll

                                                              Filesize

                                                              66KB

                                                              MD5

                                                              b140459077c7c39be4bef249c2f84535

                                                              SHA1

                                                              c56498241c2ddafb01961596da16d08d1b11cd35

                                                              SHA256

                                                              0598f7d83db44929b7170c1285457b52b4281185f63ced102e709bf065f10d67

                                                              SHA512

                                                              fbcb19a951d96a216d73b6b3e005338bbb6e11332c6cc8c3f179ccd420b4db0e5682dc4245bd120dcb67bc70960eab368e74c68c7c165a485a12a7d0d8a00328

                                                            • C:\Users\Admin\AppData\Local\Temp\nsf471D.tmp\System.dll

                                                              Filesize

                                                              11KB

                                                              MD5

                                                              c17103ae9072a06da581dec998343fc1

                                                              SHA1

                                                              b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

                                                              SHA256

                                                              dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

                                                              SHA512

                                                              d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

                                                            • C:\Users\Admin\AppData\Local\Temp\nsf471D.tmp\timepro.dll

                                                              Filesize

                                                              20KB

                                                              MD5

                                                              009dbbdd1ef470dd752c2b73835da3e7

                                                              SHA1

                                                              f97da6556b24302df8201a092eaa32a80d49064b

                                                              SHA256

                                                              c1ed8c398108dc56fbb6fd6797c3c9df59447e2a2f198b72a45058124971b09c

                                                              SHA512

                                                              dbffa0eb830b292e5550eb3f3cfce90f881282652afb0463672ece7eb0946c34a8f75c4852f77b1db3604f0f346d0ed9d9babbad40b41de109e9f5119d555ec5

                                                            • C:\Users\Admin\AppData\Local\Temp\nsu4690.tmp\System.dll

                                                              Filesize

                                                              10KB

                                                              MD5

                                                              fe24766ba314f620d57d0cf7339103c0

                                                              SHA1

                                                              8641545f03f03ff07485d6ec4d7b41cbb898c269

                                                              SHA256

                                                              802ef71440f662f456bed6283a5ff78066af016897fe6bfd29cac6edc2967bbd

                                                              SHA512

                                                              60d36959895cebf29c4e7713e6d414980139c7aa4ed1c8c96fefb672c1263af0ce909fb409534355895649c0e8056635112efb0da2ba05694446aec2ca77e2e3

                                                            • memory/2708-36-0x0000000002190000-0x00000000021AA000-memory.dmp

                                                              Filesize

                                                              104KB

                                                            • memory/2708-255-0x0000000003EE0000-0x0000000003EE9000-memory.dmp

                                                              Filesize

                                                              36KB

                                                            • memory/2708-51-0x00000000021B0000-0x00000000021B9000-memory.dmp

                                                              Filesize

                                                              36KB

                                                            • memory/2864-828-0x0000000073FE0000-0x00000000740F0000-memory.dmp

                                                              Filesize

                                                              1.1MB

                                                            • memory/3348-403-0x0000000002FA0000-0x0000000002FBA000-memory.dmp

                                                              Filesize

                                                              104KB

                                                            • memory/3348-652-0x0000000003AA0000-0x0000000003AA9000-memory.dmp

                                                              Filesize

                                                              36KB