Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

17/01/2024, 18:54

240117-xkjyssdcf4 8

17/01/2024, 18:40

240117-xbebyscefm 8

Analysis

  • max time kernel
    132s
  • max time network
    278s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/01/2024, 18:54

General

  • Target

    efed9df5db764689c3ba1a06084599f47278e8a7a6732fb35f5ed1b01748864f.appx

  • Size

    135.6MB

  • MD5

    e347a58cf88cc6f686207d30d2e3db65

  • SHA1

    8b24338138775079f8fdd85366fed7598a9f288d

  • SHA256

    efed9df5db764689c3ba1a06084599f47278e8a7a6732fb35f5ed1b01748864f

  • SHA512

    d9347486a247e40f53b27270bca7afa29b428236be514d5261a19115226dc07de776c84fa6b0d0150f6e7d5d8bdfadba0da2d9ec9c6a5ca1d2a17943ebcadc43

  • SSDEEP

    3145728:YZXsiKRnMfIcYNVZiTeoVu1uX7rAUMg47zNO0SPo8Z1Z4wX1JfSbmbd3d:Y9ontcyVZiamAuLX947xOj1Z4wlQbw

Score
8/10

Malware Config

Signatures

  • Blocklisted process makes network request 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell start shell:AppsFolder\Midjourney.Midjourney_jqzvp2n7sb70p!VCredist.x86.exe
    1⤵
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:4080
  • C:\Program Files\WindowsApps\Midjourney.Midjourney_4.0.3.17_x86__jqzvp2n7sb70p\AI_STUBS\AiStubX86.exe
    "C:\Program Files\WindowsApps\Midjourney.Midjourney_4.0.3.17_x86__jqzvp2n7sb70p\AI_STUBS\AiStubX86.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4388
    • C:\Windows\SysWOW64\xcopy.exe
      "xcopy.exe" "C:\Program Files\WindowsApps\Midjourney.Midjourney_4.0.3.17_x86__jqzvp2n7sb70p\VFS\AppData" "C:\Users\Admin\AppData\Local\Packages\Midjourney.Midjourney_jqzvp2n7sb70p\LocalCache\Roaming" /e /s /y /c /h /q /i /k
      2⤵
      • Enumerates system info in registry
      PID:1004
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe
      Powershell.exe -ExecutionPolicy RemoteSigned -file "C:\Program Files\WindowsApps\Midjourney.Midjourney_4.0.3.17_x86__jqzvp2n7sb70p\StartingScriptWrapper.ps1" "Powershell.exe -ExecutionPolicy RemoteSigned -file 'C:\Program Files\WindowsApps\Midjourney.Midjourney_4.0.3.17_x86__jqzvp2n7sb70p\refresh.ps1'"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:760
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy RemoteSigned -file "C:\Program Files\WindowsApps\Midjourney.Midjourney_4.0.3.17_x86__jqzvp2n7sb70p\refresh.ps1"
        3⤵
        • Blocklisted process makes network request
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4004
    • C:\Program Files\WindowsApps\Midjourney.Midjourney_4.0.3.17_x86__jqzvp2n7sb70p\VC_redist.x86.exe
      "VC_redist.x86.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4480
      • C:\Windows\Temp\{98D31A1E-44E6-4582-9F9C-848841B972F9}\.cr\VC_redist.x86.exe
        "C:\Windows\Temp\{98D31A1E-44E6-4582-9F9C-848841B972F9}\.cr\VC_redist.x86.exe" -burn.clean.room="C:\Program Files\WindowsApps\Midjourney.Midjourney_4.0.3.17_x86__jqzvp2n7sb70p\VC_redist.x86.exe" -burn.filehandle.attached=556 -burn.filehandle.self=536
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of FindShellTrayWindow
        PID:2220

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Powershell.exe.log

    Filesize

    1KB

    MD5

    6195a91754effb4df74dbc72cdf4f7a6

    SHA1

    aba262f5726c6d77659fe0d3195e36a85046b427

    SHA256

    3254495a5513b37a2686a876d0040275414699e7ce760e7b5ee05e41a54b96f5

    SHA512

    ed723d15de267390dc93263538428e2c881be3494c996a810616b470d6df7d5acfcc8725687d5c50319ebef45caef44f769bfc32e0dc3abd249dacff4a12cc89

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    64B

    MD5

    ac013f8d5f5e6b67ed75d9eef1cecc35

    SHA1

    9a5ca0b77346127828ad143e92e75122e319cf95

    SHA256

    a9818dbb0823141b7dc294e1a2cd9967cf615dece060ee4fafc5f09a63ede63e

    SHA512

    7492516e78ba5dabec88c7ede564a9a87335319a3bc2296c6659ba47cc28b881b92d26eee65117f764f951fba2854e19f4a4750e8d22d1a3850b473cdccce254

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    16KB

    MD5

    77a3319f6940cca2122314778bd9a1b9

    SHA1

    a12c153108c4b97dfa1f8d91ee6dfae12647d111

    SHA256

    1be911c1ad808ab0c28ac84672b115aff7d7592ed720288549b9ecb443b234ff

    SHA512

    eb78d718ce1b59f4fd8a2b5069ce3eb8dfb45cfbb437c467f05fbb689ed3cb0f8f5ddceba7b44baae159a4b50f617ac8ca881d0d78a0d048355d960e97b79298

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2bj21mqh.s5u.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • C:\Windows\Temp\{98D31A1E-44E6-4582-9F9C-848841B972F9}\.cr\VC_redist.x86.exe

    Filesize

    634KB

    MD5

    415e8d504ea08ee2d8515fe87b820910

    SHA1

    e90f591c730bd39b8343ca3689b2c0ee85aaea5f

    SHA256

    e0e642106c94fd585782b75d1f942872d2bf99d870bed4216e5001e4ba3374c0

    SHA512

    e51f185c0e9d3eb4950a4c615285c6610a4977a696ed9f3297a551835097b2122566122231437002c82e2c5cf72a7a8f67362bff16b24c0abe05fe35dddbf6a1

  • C:\Windows\Temp\{CA1A3526-55C6-4F2A-B3F0-0D5571D3A92A}\.ba\logo.png

    Filesize

    1KB

    MD5

    d6bd210f227442b3362493d046cea233

    SHA1

    ff286ac8370fc655aea0ef35e9cf0bfcb6d698de

    SHA256

    335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef

    SHA512

    464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b

  • C:\Windows\Temp\{CA1A3526-55C6-4F2A-B3F0-0D5571D3A92A}\.ba\wixstdba.dll

    Filesize

    191KB

    MD5

    eab9caf4277829abdf6223ec1efa0edd

    SHA1

    74862ecf349a9bedd32699f2a7a4e00b4727543d

    SHA256

    a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041

    SHA512

    45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2

  • memory/760-17-0x00000000050D0000-0x0000000005106000-memory.dmp

    Filesize

    216KB

  • memory/760-36-0x0000000007730000-0x000000000774A000-memory.dmp

    Filesize

    104KB

  • memory/760-20-0x00000000059B0000-0x0000000005A16000-memory.dmp

    Filesize

    408KB

  • memory/760-21-0x0000000006060000-0x00000000060C6000-memory.dmp

    Filesize

    408KB

  • memory/760-27-0x00000000060D0000-0x0000000006424000-memory.dmp

    Filesize

    3.3MB

  • memory/760-18-0x0000000005A30000-0x0000000006058000-memory.dmp

    Filesize

    6.2MB

  • memory/760-33-0x0000000006580000-0x000000000659E000-memory.dmp

    Filesize

    120KB

  • memory/760-34-0x0000000006650000-0x000000000669C000-memory.dmp

    Filesize

    304KB

  • memory/760-35-0x0000000007DB0000-0x000000000842A000-memory.dmp

    Filesize

    6.5MB

  • memory/760-19-0x00000000058E0000-0x0000000005902000-memory.dmp

    Filesize

    136KB

  • memory/760-54-0x00000000742B0000-0x0000000074A60000-memory.dmp

    Filesize

    7.7MB

  • memory/760-47-0x00000000742B0000-0x0000000074A60000-memory.dmp

    Filesize

    7.7MB

  • memory/760-16-0x00000000742B0000-0x0000000074A60000-memory.dmp

    Filesize

    7.7MB

  • memory/4004-50-0x00000000742B0000-0x0000000074A60000-memory.dmp

    Filesize

    7.7MB

  • memory/4004-37-0x00000000742B0000-0x0000000074A60000-memory.dmp

    Filesize

    7.7MB

  • memory/4080-0-0x000001FE28A80000-0x000001FE28AA2000-memory.dmp

    Filesize

    136KB

  • memory/4080-12-0x00007FF997820000-0x00007FF9982E1000-memory.dmp

    Filesize

    10.8MB

  • memory/4080-11-0x00007FF997820000-0x00007FF9982E1000-memory.dmp

    Filesize

    10.8MB

  • memory/4388-15-0x000000006EC10000-0x000000006EC20000-memory.dmp

    Filesize

    64KB

  • memory/4480-55-0x000000006EC10000-0x000000006EC20000-memory.dmp

    Filesize

    64KB