Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

19/01/2024, 15:19

240119-sp7hfahah6 5

19/01/2024, 15:17

240119-spb2jagdgm 5

Analysis

  • max time kernel
    143s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/01/2024, 15:19

General

  • Target

    BT-23.10.0-64UWD-Win10-Win11.exe

  • Size

    58.2MB

  • MD5

    3d1299ef2998b60d60d0b0676916ab32

  • SHA1

    ab603bfb318ea47a3aadd2482f8070dc0c1dfd86

  • SHA256

    a639a39bf1c7b5e27b3487f14a8d99f81d5e7334580e917606cb4a32647a2816

  • SHA512

    961e9b905ff47a5564e43c3c9e5571cf9ac210ec6f5a034d59601e539f7ec3c07d1eddf6be0365d3ed9e9d5a9d1b23bcb80e78ef8386a777d282b47cb1d3b2d9

  • SSDEEP

    393216:hB9i8PUgDtfGi39joJ5HFsPyaGBkE5v1AamBNS:wI71945lDtv+aKNS

Score
5/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies system certificate store 2 TTPs 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\BT-23.10.0-64UWD-Win10-Win11.exe
    "C:\Users\Admin\AppData\Local\Temp\BT-23.10.0-64UWD-Win10-Win11.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1048
    • C:\Windows\Temp\{3F7AD04D-2BF1-4F21-B349-525AC45D4B70}\WirelessSetup.exe
      "C:\Windows\Temp\{3F7AD04D-2BF1-4F21-B349-525AC45D4B70}\WirelessSetup.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3632
      • C:\Windows\Temp\ca1401314f6ae6b2e8739ecdf5e831dfa85d70\WirelessSetup.exe
        "C:\Windows\Temp\ca1401314f6ae6b2e8739ecdf5e831dfa85d70\WirelessSetup.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:1272

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18E6B4A57A6BC7EC9B861CDF2D6D0D02_EF52C1EC85F21F31CC0157A5C8803013

    Filesize

    765B

    MD5

    9389c5403447352cb33f439c7e9c18b2

    SHA1

    14b4c1deeefe1502f02a1e148722cf1f2e78553b

    SHA256

    7c833c358158f743a1f6089bb0e4fc466830e971d8717d1004ffc783217d3350

    SHA512

    c3f304fe27d2cb1f7fa20917636bf361636b41262da5d17102800b6e208b6c301d4e8c1da7c27c640285989044e8a3e779f9862184891d3ed0843b65b129b170

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3AA0DCD5A74331FBD6F344550EC48B87_5138147F2BE7083CBCE306C8D330136B

    Filesize

    638B

    MD5

    a2c38169adb6b9b0f2e9f3f140c14fd4

    SHA1

    fd9cfcd4c168a12982931ea095815ebb7e017d2a

    SHA256

    a2695f19e6d8b475fc2dfc2f231118b3936ec6c03630904f2a3a18057eab5a38

    SHA512

    53beffa061a651f0301380c9ca9bd16d5db814939abe4ffe50dc756ab71b83f07da733cb9acb318b434013ff6f02e512d7611c399f30b1ce78a31ea7fbd0e8d3

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F

    Filesize

    1KB

    MD5

    765c6d3c40db39f2d87414f0809a8c05

    SHA1

    7ca9fd389aa670b0369449f74b0be9d732197e63

    SHA256

    28aadfaa6706dc3e815b14c5d6716586e9c42a44f3bdda0e8b214a93fa601fdb

    SHA512

    a1ebf643958539fb6e2fe9001836506e633e06b5bae0c6a7b5b10e4a3c76d9db72a1f7db289a14b63420cd90a713cb5efaa04b11eda8a842226b6767a7070402

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18E6B4A57A6BC7EC9B861CDF2D6D0D02_EF52C1EC85F21F31CC0157A5C8803013

    Filesize

    484B

    MD5

    e22f12ab94959352b883f6617a47e9bf

    SHA1

    cb977f7df7f282b00ddb23d0ae7f2644be4d4661

    SHA256

    e6422ce27965770c3550bf0484ec9820b1fe17b8279ad7ec1ec87c37de62e425

    SHA512

    4d79e05b2e4545c6d45c47023f25846444c29b9fef550c884a00d2dc827fc9d5d4d1b8c85eb1e14b1ff666bcef7bf64904a9ea582b218abf2483082fc0f53240

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3AA0DCD5A74331FBD6F344550EC48B87_5138147F2BE7083CBCE306C8D330136B

    Filesize

    484B

    MD5

    ed8212274e93bb4fb777f45172684c8f

    SHA1

    bb84048d7c6044b176dd6d6b3d84dbda5381e867

    SHA256

    bc1a363a9b7dda7515b954e399689c3a3e8beeeccaa7539ae5bf060e4f91b7a4

    SHA512

    65c7fefbaeea1d2811e6a57619001ff417f613d10181b1235a46c4a11caa9fcd81542aeba9bf736f03b689f44260e04851ba9d687b54330bd69d757b46673c21

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F

    Filesize

    482B

    MD5

    8ee607ea6275ad0e8ed4e2d94eb34778

    SHA1

    50aaf356af2b54b36dc08f54822104cb1fe7ab34

    SHA256

    cf488ca28700434f47f4bf7b41dd003144c125bb94c272a640bd3a2ed171b97b

    SHA512

    c57f99f69f5b895d9ea9dfeb6fe99af8ed37fbfa134a821840da45ba66ab45dce91ae2de650ea04bba270ab4a1cacb9bb2dec8d8494700260f35482d01d54bd4

  • C:\Windows\Temp\ca1401314f6ae6b2e8739ecdf5e831dfa85d70\Intel Bluetooth.msi

    Filesize

    766KB

    MD5

    2a08c874acfe37d248d3e5322d31e942

    SHA1

    da6afb7d4b1e88652c9b7e58f1b78e0236f42468

    SHA256

    0912530e3df8e1a992e7c181dc971bf91b1d03f1284cc4b3839fc31158540dee

    SHA512

    2afe61ab2f93cf44c14141d944d4a20750a9da9db4a00a904cbe2782c24681fb41db9e34af5dc9388fa39ffca053de8687f43bdef033f16c2c5c334d281ba0dc

  • C:\Windows\Temp\ca1401314f6ae6b2e8739ecdf5e831dfa85d70\WirelessSetup.exe

    Filesize

    1.1MB

    MD5

    43d743b6057a77a8367abc21396f8bfd

    SHA1

    d372b1d7bf3285ed9dc90eeadd4ac875a5e1b1b5

    SHA256

    d2d453f2632983ad7007237f079c14e6e591a0fb5caa1509a5e0d9bd10049f2d

    SHA512

    085b0fda02b1eaf632866c47de9df6ffcc768dbe11c6191214638a9aa3cc06d6a5bbbb4c096b62cbe7a62eb89658341da00b88b3c5fd7abacca6784cdbfa7eb4

  • C:\Windows\Temp\ca1401314f6ae6b2e8739ecdf5e831dfa85d70\WirelessSetup.exe

    Filesize

    797KB

    MD5

    8d89007c71c653a76661a75629a0f0bd

    SHA1

    c48fad02788a0d9e4cd301afbae43f521104c0a1

    SHA256

    653d26a0fbf1088888487bc23a173fe768885775083a3840ed94cb9dc8592ae5

    SHA512

    92353247b86a5b541444fc3c4638afaa6bae11fb72d04c6162d777277f7d51ee9ccf0bad36b355f24273a5b6286ee32a2e21741bfa421b473dac1ed146d975fc

  • C:\Windows\Temp\ca1401314f6ae6b2e8739ecdf5e831dfa85d70\WirelessSetup.exe

    Filesize

    967KB

    MD5

    1a4bccc9df569ad3141012a00a868433

    SHA1

    b3bd02e0a9bd9ec75fb912a5ba027705ae472360

    SHA256

    a03c5b9f502793e25bea3d6152083d5910f09c57cffddbd6c5e2f98b487bacdf

    SHA512

    4dcb27f8579f819dc469260fe4abd3e056edd1dbb3f747957e3d5c78982d2c900de29e3a234613da1ec3aae2fc57aa5d6a0eb01069cd6c8d6cc090804ac03c7c

  • C:\Windows\Temp\ca1401314f6ae6b2e8739ecdf5e831dfa85d70\lang\setupENU.dll

    Filesize

    928KB

    MD5

    6993628abc35c5b88145a937a54fc558

    SHA1

    c7768df0aa22df96e05b1d1e481cb3ccd1617c0b

    SHA256

    2069e4968c73b86eae8addde7f6d0cd77a8abb2711937d55288da69df1ef0721

    SHA512

    8bac0cf0768db5dae774ea19f583973ff17d60b3af9a6a9293df7dce7ee0fa14565d27984e0b73429c77726edd090c268548313b580e022fd321aef8129b6fd0

  • C:\Windows\Temp\ca1401314f6ae6b2e8739ecdf5e831dfa85d70\lang\setupENU.dll

    Filesize

    649KB

    MD5

    d5d44fe941b39cffb45dd779ee7b68a1

    SHA1

    0d4430471331511d8d83167e2780f182fd19d471

    SHA256

    cf21c3fd753924fd5668364dcde5c3e25cc692a04b39367d44933067248e56d4

    SHA512

    98c2fc3653765df72e5c5e893776a5232eda7e56c13191e68a58f1e47134dd40106c76f8f6baa8265bb19950d6c50081ed35d7fb92496ce33a0606e2548df1a7

  • C:\Windows\Temp\{3F7AD04D-2BF1-4F21-B349-525AC45D4B70}\Intel Bluetooth.msi

    Filesize

    1.4MB

    MD5

    1ce6b0d949d85135806f61259cbc3ab7

    SHA1

    02b771d7aca1c39b8baf7338b8ee7c8f8df9e00c

    SHA256

    85547b56e7b823efda31dd942de397cd1bef73881f78bc664c6ca9a7ae05b225

    SHA512

    08df780558614676140a29bff08fd080e99cc5fdf678369d0ae751fded369296afa3aa739c21ffa4dcb5d6b949dc257a0437b4a3f64732a6c0ba8436e14bee35

  • C:\Windows\Temp\{3F7AD04D-2BF1-4F21-B349-525AC45D4B70}\WirelessSetup.exe

    Filesize

    2.1MB

    MD5

    568a3b311389b61cda9f297a40ca260e

    SHA1

    99bd6e4abb04ccf09380bc3fb78f66ed7c5d82a0

    SHA256

    6b78c9cdc02bd95251997c5084557f077db1cdd86ebe4f03d1e640bf5a14b30f

    SHA512

    f94f1cc2440d1c4dd416232e1a5061a2ed2ced26f418702bfd8935486f433415bb1eed7288ca21f9b35efd495cfa08a039afc2c0061f32b72fcd926aeb0f1475

  • C:\Windows\Temp\{3F7AD04D-2BF1-4F21-B349-525AC45D4B70}\WirelessSetup.exe

    Filesize

    2.6MB

    MD5

    55f87a0d29bde0d4625bd6886da38159

    SHA1

    4ceca8a26451bf6dd777375636a1033d368083ba

    SHA256

    0b4257ad43ac0aa98d3d79f26d374cb37ed8abf0889df4196175561cef6f8f26

    SHA512

    4c9f49c246867e53db650e361342c81e6236348f6786e899ff3e8042f2c374061904a9bcc52fed02ba791de0c58a9bdac2f525476da4cb4437741715ff60bb69

  • C:\Windows\Temp\{3F7AD04D-2BF1-4F21-B349-525AC45D4B70}\WirelessSetup.xml

    Filesize

    632B

    MD5

    495d22fb91b19d93e337be9cd92b78eb

    SHA1

    c1c7e948b0ad53568275385dd2c3324455bfbb64

    SHA256

    4e890388a0a0e8b6ff24fb1e2eb8cb7042ecfddf62419ca1b749f034bbeee483

    SHA512

    ee102c8acdb1732cee5fb92cca8fc1934e66b1892a6f93cfe64f70c54aea7eab3f89f4dd2154ee75104392cf0e28470149d5be447140e7c51b7743ea1d8c389b

  • C:\Windows\Temp\{3F7AD04D-2BF1-4F21-B349-525AC45D4B70}\lang\setupENU.dll

    Filesize

    932KB

    MD5

    275107cb380077afac25712f56d8255c

    SHA1

    fd35bbd5de787af31d233a35e6eaa1b5286104a0

    SHA256

    83b5bcbe5a3e687891f8d5d79b3da4a5d90eace35ee3a2ab64a256210ec20b3c

    SHA512

    ac0bdb8d9d3757d05418e6f8f6e642955a88f0135fe291c7f8e8a597a305dcfe8c15e5317d59f5a4454d6085fab260a5d811f03bc492e8940e8e2776bc451fcd