Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/01/2024, 10:12

General

  • Target

    file.exe

  • Size

    1.1MB

  • MD5

    072932d63a4fdc222735e6f713a514ae

  • SHA1

    cdb200e4c759600e4a83e450fbd67a7682526ea9

  • SHA256

    eb27d4fc56e8a66e9fb47d0b73b752f963855ac169130d55a488709caa466bba

  • SHA512

    c7512594cb7ee7d9d3b3f71ff8931441932473d25561d946f55aface0c704b01a4f7bbbc8fc53b30e1cf1be10030c91186988f0ba6183485037924bb83db8702

  • SSDEEP

    24576:La5ou5FEgQHe/Hlh9dJs3duzm413cig9gUfHSA+U:EouPx/363duzm413cr9gUqZ

Score
8/10

Malware Config

Signatures

  • Modifies Windows Firewall 1 TTPs 4 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2560
    • C:\Windows\System32\netsh.exe
      "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
      2⤵
      • Modifies Windows Firewall
      PID:2856
    • C:\Windows\System32\netsh.exe
      "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
      2⤵
      • Modifies Windows Firewall
      PID:3636
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2732
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4060
    • C:\Windows\System\dc.exe
      "C:\Windows\System\dc.exe" /D
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:800
    • C:\Windows\SYSTEM32\schtasks.exe
      schtasks /delete /TN "Timer"
      2⤵
        PID:5092
      • C:\Windows\SYSTEM32\schtasks.exe
        schtasks /create /sc minute /ED "11/02/2024" /mo 7 /tn "Timer" /tr c:\windows\system\svchost.exe /ru SYSTEM
        2⤵
        • Creates scheduled task(s)
        PID:1788
      • C:\Windows\System\svchost.exe
        "C:\Windows\System\svchost.exe" formal
        2⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:1284
        • C:\Windows\System32\netsh.exe
          "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
          3⤵
          • Modifies Windows Firewall
          PID:1836
        • C:\Windows\System32\netsh.exe
          "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
          3⤵
          • Modifies Windows Firewall
          PID:3060
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4572
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4624
        • C:\Windows\System\dc.exe
          "C:\Windows\System\dc.exe" /D
          3⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          PID:2732

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

      Filesize

      2KB

      MD5

      d85ba6ff808d9e5444a4b369f5bc2730

      SHA1

      31aa9d96590fff6981b315e0b391b575e4c0804a

      SHA256

      84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

      SHA512

      8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

      Filesize

      944B

      MD5

      cadef9abd087803c630df65264a6c81c

      SHA1

      babbf3636c347c8727c35f3eef2ee643dbcc4bd2

      SHA256

      cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

      SHA512

      7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

      Filesize

      944B

      MD5

      398a4a9f993c41984cf69d927a4a1be7

      SHA1

      326f2b191a4af51d2d854f0cf5bd9d8e66701d71

      SHA256

      73408ee6e65dca6f7b59eefa7ac905ce6fbf2a2241117fb573e637cda560c7fc

      SHA512

      f2b634bfe0c296e23fcf3e150c0228e2b4c91f735c30841989c215bfec798483520f60a3197b51578917cce670a9dd98e9dd54293a0e990de7bc92f1f5322020

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_j41q34uw.1mk.ps1

      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • C:\Users\Admin\AppData\Local\Temp\vmwajbl

      Filesize

      108KB

      MD5

      07232b64be72593980cd952e8f85017e

      SHA1

      61dba57cc51f4501ace3520e2cf559d8e42e04d7

      SHA256

      ef342bcc3c938c2fa9b38bc84019d8dce94d018372f7d9c29a8ee7ff3f0fc3a8

      SHA512

      d5417f270e14fe3437c0d017e037117001377379475531b70f9d6840548dd830117fbf62c152c9af09f586bdf944edac330bc560cca4fa45105269319e7158cb

    • C:\Windows\System\dc.exe

      Filesize

      763KB

      MD5

      0a50081a6cd37aea0945c91de91c5d97

      SHA1

      755309c6d9fa4cd13b6c867cde01cc1e0d415d00

      SHA256

      6606d759667fbdfaa46241db7ffb4839d2c47b88a20120446f41e916cad77d0b

      SHA512

      f0a4e9a3dc065df2182527b17077c822d4535db86bf61f5ee795ee469b15159560a8e81e60d3037f3de1bb38e92f0fc8a422c2656882650d699e2b96948f9846

    • C:\Windows\System\svchost.exe

      Filesize

      1.1MB

      MD5

      072932d63a4fdc222735e6f713a514ae

      SHA1

      cdb200e4c759600e4a83e450fbd67a7682526ea9

      SHA256

      eb27d4fc56e8a66e9fb47d0b73b752f963855ac169130d55a488709caa466bba

      SHA512

      c7512594cb7ee7d9d3b3f71ff8931441932473d25561d946f55aface0c704b01a4f7bbbc8fc53b30e1cf1be10030c91186988f0ba6183485037924bb83db8702

    • memory/1284-95-0x0000000140000000-0x0000000140218400-memory.dmp

      Filesize

      2.1MB

    • memory/1284-67-0x0000000140000000-0x0000000140218400-memory.dmp

      Filesize

      2.1MB

    • memory/1284-66-0x0000000140000000-0x0000000140218400-memory.dmp

      Filesize

      2.1MB

    • memory/2560-1-0x0000000140000000-0x0000000140218400-memory.dmp

      Filesize

      2.1MB

    • memory/2560-29-0x0000000140000000-0x0000000140218400-memory.dmp

      Filesize

      2.1MB

    • memory/2560-3-0x0000000140000000-0x0000000140218400-memory.dmp

      Filesize

      2.1MB

    • memory/2560-2-0x0000000140000000-0x0000000140218400-memory.dmp

      Filesize

      2.1MB

    • memory/2560-0-0x0000000140000000-0x0000000140218400-memory.dmp

      Filesize

      2.1MB

    • memory/2560-68-0x0000000140000000-0x0000000140218400-memory.dmp

      Filesize

      2.1MB

    • memory/2732-28-0x0000013DF5B00000-0x0000013DF5B10000-memory.dmp

      Filesize

      64KB

    • memory/2732-30-0x0000013DF5B00000-0x0000013DF5B10000-memory.dmp

      Filesize

      64KB

    • memory/2732-4-0x0000013DF7CF0000-0x0000013DF7D12000-memory.dmp

      Filesize

      136KB

    • memory/2732-37-0x00007FFE24D00000-0x00007FFE257C1000-memory.dmp

      Filesize

      10.8MB

    • memory/2732-25-0x0000013DF5B00000-0x0000013DF5B10000-memory.dmp

      Filesize

      64KB

    • memory/2732-24-0x0000013DF5B00000-0x0000013DF5B10000-memory.dmp

      Filesize

      64KB

    • memory/2732-23-0x00007FFE24D00000-0x00007FFE257C1000-memory.dmp

      Filesize

      10.8MB

    • memory/4060-26-0x000002406CF60000-0x000002406CF70000-memory.dmp

      Filesize

      64KB

    • memory/4060-36-0x00007FFE24D00000-0x00007FFE257C1000-memory.dmp

      Filesize

      10.8MB

    • memory/4060-27-0x00007FFE24D00000-0x00007FFE257C1000-memory.dmp

      Filesize

      10.8MB

    • memory/4572-70-0x0000020C80110000-0x0000020C80120000-memory.dmp

      Filesize

      64KB

    • memory/4572-71-0x0000020C80110000-0x0000020C80120000-memory.dmp

      Filesize

      64KB

    • memory/4572-85-0x0000020C80110000-0x0000020C80120000-memory.dmp

      Filesize

      64KB

    • memory/4572-69-0x00007FFE248A0000-0x00007FFE25361000-memory.dmp

      Filesize

      10.8MB

    • memory/4572-119-0x00007FFE248A0000-0x00007FFE25361000-memory.dmp

      Filesize

      10.8MB

    • memory/4624-82-0x00007FFE248A0000-0x00007FFE25361000-memory.dmp

      Filesize

      10.8MB

    • memory/4624-83-0x000001426D1B0000-0x000001426D1C0000-memory.dmp

      Filesize

      64KB

    • memory/4624-84-0x000001426D1B0000-0x000001426D1C0000-memory.dmp

      Filesize

      64KB

    • memory/4624-97-0x000001426D1B0000-0x000001426D1C0000-memory.dmp

      Filesize

      64KB

    • memory/4624-100-0x00007FFE248A0000-0x00007FFE25361000-memory.dmp

      Filesize

      10.8MB