Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    173s
  • max time network
    193s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/01/2024, 12:41

General

  • Target

    5b439f0679891477a6720337b94d12e8.exe

  • Size

    736KB

  • MD5

    5b439f0679891477a6720337b94d12e8

  • SHA1

    237f2259e8be726cdee3343ac0a5f4fa557c98dc

  • SHA256

    ead7dacfbe3fe40959353445ca3a754e9254c993d6a0efc7d99f960b01156df6

  • SHA512

    6bbe59f30d93972bb2e753364fe9ed2af6942c8b66430ecf111368a89cf952ea97ae2f5df009c4d5afbb8ae139bf0befc33c3a3267a55f573f95d1bd9723ab9c

  • SSDEEP

    12288:gpQFKc84EnyLz1emmZ+kEOc4dYchfL7pNWZQZrJe2WhmbT:gpQAcnLzY7EP6PhfLziQMhhmbT

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops file in Program Files directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
  • Modifies registry class 24 IoCs
  • Suspicious use of WriteProcessMemory 45 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5b439f0679891477a6720337b94d12e8.exe
    "C:\Users\Admin\AppData\Local\Temp\5b439f0679891477a6720337b94d12e8.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Program Files directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:4888
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\srun32.bat" "
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4572
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        3⤵
          PID:2492
        • C:\Windows\SysWOW64\cacls.exe
          cacls "C:\Users\Admin\Desktop\Internet Explorer.lnk" /G Everyone:R /C
          3⤵
            PID:2728
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\srun8.bat" "
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:5024
          • C:\Windows\SysWOW64\cacls.exe
            cacls "C:\Program Files (x86)\Internet Explorer\ie\iexplore.exe" /G Everyone:R /C
            3⤵
              PID:4424
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /S /D /c" echo Y"
              3⤵
                PID:3680
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\srun19.bat" "
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:2288
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                3⤵
                  PID:4200
                • C:\Windows\SysWOW64\cacls.exe
                  cacls "C:\Users\Admin\Desktop\Internet Explorer.lnk" /G Everyone:R /C
                  3⤵
                    PID:1052
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\srun74.bat" "
                  2⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1040
                  • C:\Windows\SysWOW64\cacls.exe
                    cacls "C:\Program Files (x86)\Internet Explorer\ie\iexplore.exe" /G Everyone:R /C
                    3⤵
                      PID:5084
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                      3⤵
                        PID:4072
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\srun91.bat" "
                      2⤵
                      • Suspicious use of WriteProcessMemory
                      PID:4720
                      • C:\Windows\SysWOW64\cacls.exe
                        cacls "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\╞⌠╢» Internet Explorer Σ»└└╞≈.lnk" /G Everyone:R /C
                        3⤵
                          PID:1788
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                          3⤵
                            PID:3588

                      Network

                      MITRE ATT&CK Enterprise v15

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Program Files (x86)\Internet Explorer\ie\iexplore.exe

                        Filesize

                        814KB

                        MD5

                        5e5f63cd0ca3ee94c61a2db20ce33fc9

                        SHA1

                        c90ea9645c7cc1ad7553675a7ecdf880b1fb4621

                        SHA256

                        219280ffebd3d771102fc3a7f26529e5e9161366e3a5de2f8943d81dda7756bf

                        SHA512

                        b36df698f1cbe52df754db9fcfba7e6811b6fc74f44a89378ce29356630f66a10d526402e9d133f8ab608bb614e2214945c0b732b4db3d0cad3d3665e062edcb

                      • C:\Users\Admin\AppData\Local\Temp\srun19.bat

                        Filesize

                        130B

                        MD5

                        9749362af66eb04abc7d18f857d770af

                        SHA1

                        157e6dcb88620f3260a3117f1571db7b1c70ba8a

                        SHA256

                        2a5353ed5694a34536145dcf811db213620750c2b652a0334c004805b362959b

                        SHA512

                        bc740cc890bc3506a8c2ac66adf8b0f24e81cd069c589b5b3f8fb9c83017ce614478a5261db9a1ce9d6a2a5977201fae44dfb0ff282b30bfb92ed25aa999a689

                      • C:\Users\Admin\AppData\Local\Temp\srun32.bat

                        Filesize

                        130B

                        MD5

                        c2051747849229e9a0ec40ae9e84d057

                        SHA1

                        9c566e0a4ed8febd7364a0c702fb8a714362557c

                        SHA256

                        bf228d23bc9cd90885950a34e39221a70a09d74dc85ccaadf8862cc66da7602e

                        SHA512

                        51e5a3aaeefb3c3abf03e47429514cc747e5fce04fa04e4c0d9d8533959c84c0a0d57567a7f0a2c9d210891a25310ba936ccf2085864d06763d31802cf1faabd

                      • C:\Users\Admin\AppData\Local\Temp\srun74.bat

                        Filesize

                        142B

                        MD5

                        d639bc0832331c473764e1ec371f6b1b

                        SHA1

                        6dc40e9d4162dd3137cefe927f936b01d2cb1022

                        SHA256

                        ce172de5a6f70c23316a575107066cc2d7800ccdc8e697fa042e2b788d5e0dee

                        SHA512

                        a6b4374510232bf363158cc59d19b1bda62910d928ecbb9f2512b02f41fcc832ba8024c425501529a24fc05682525bfdbd0d5dbe653973f56e2768a2bed2fb24

                      • C:\Users\Admin\AppData\Local\Temp\srun8.bat

                        Filesize

                        141B

                        MD5

                        6a874290cdec877d74b72242a092d953

                        SHA1

                        d579121b9a41401666ffe9013d1e85c7245bd02f

                        SHA256

                        7c68441a42a0f6015bc9a7e3e8561eabdf24cd0fc011080319995f319ba76013

                        SHA512

                        128aaef3e5015e34e75c935f3c850744b5e181e31f70291aaf02fd807b81633261a8005e893df6b2f3d27eeeac9b5800436db15f5e8849ed856a2aa72ac61a99

                      • C:\Users\Admin\AppData\Local\Temp\srun91.bat

                        Filesize

                        191B

                        MD5

                        5ab97efd33f56f35e53c395e52c6b477

                        SHA1

                        55df33d930a489db0902ee3d12d4baa27c901f76

                        SHA256

                        9b862cc69021e83c9a95dd8b3e17ae9131409a22c6aca3e70978ab01da5cdf06

                        SHA512

                        0763e46c11d84cdaa4037bc3d8a18d33ede06d37eb12414f8cdd047a95377b2a6627af0c5637afc41376e2fd32a495d9267e4203506097c4fdb6c3552fdaafe4

                      • C:\Users\Admin\Desktop\Internet Explorer.lnk

                        Filesize

                        1KB

                        MD5

                        ff86e243cc991ced1d422ed2260200ee

                        SHA1

                        54b1a7b40ce591eec4890ad5b032c0877e0961cd

                        SHA256

                        d0d64d1e07d366467db840a04a441b50d357150b7a49edab14d01f712c1bc335

                        SHA512

                        df171e155aace592c39eed46198d1f5f2d40b8ca5c74892eba3b59b2a4f90ff0a2f6ed3ead2ae7fb2da2d61774a9f5008b0dfaa3792e910e2209c375e343d8f4

                      • memory/4888-0-0x0000000002260000-0x0000000002261000-memory.dmp

                        Filesize

                        4KB

                      • memory/4888-1-0x0000000002260000-0x0000000002261000-memory.dmp

                        Filesize

                        4KB