Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/01/2024, 02:10

General

  • Target

    57b5ac989ffe62b558dc73ed02e616c1.exe

  • Size

    128KB

  • MD5

    57b5ac989ffe62b558dc73ed02e616c1

  • SHA1

    b7df17573572be3eb92f53d1d49a503904a0116c

  • SHA256

    e32ff5f2f378e159e1483c8b01fb9d95fae4e628ee323c421877f054e7076011

  • SHA512

    c0ca2973cb70d6dd977d04549561d72ee34fe1bf04e09b47901fe27be555bb0a7391f424e60f92910746aa64623cb3ba619822abc7ae26d145482c492be13c03

  • SSDEEP

    3072:EmeDmBqskJTH7XeAhKHkWxVmc+CNhanPf0T9HQ:E8xEWxMmbaP8T9HQ

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

  • Drops file in Program Files directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 64 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\57b5ac989ffe62b558dc73ed02e616c1.exe
    "C:\Users\Admin\AppData\Local\Temp\57b5ac989ffe62b558dc73ed02e616c1.exe"
    1⤵
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:4704
    • C:\Windows\SysWOW64\regsvr32.exe
      "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\Common Files\PushWare\cpush.dll"
      2⤵
      • Loads dropped DLL
      • Installs/modifies Browser Helper Object
      • Modifies registry class
      PID:5004

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\Common Files\PushWare\cpush.dll

    Filesize

    208KB

    MD5

    d3d7021dccf955e3bf53348ba4635dcf

    SHA1

    623cd2fb2e409ce5f55baa7dbb87a2b4142567ff

    SHA256

    b37d8c895258cccb982dc4bfbb7b62fd8420c589166f3adbed8cdfa0257b9ed6

    SHA512

    f91e22fbbc9fcef36b29d93ae553a57bea9a28133bb6058525e680b736c97be47de47da18ec92d43539647f4b9dcf2cd790fa8edfa26458d4bf93b669bf271bf