Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/01/2024, 05:45

General

  • Target

    d5c62e521f44e5fc7bc80dd61a163e86405eae49dbbc9101aad6b6261b79abf9.exe

  • Size

    31KB

  • MD5

    a5ad2d1796744144d739569bb466b307

  • SHA1

    42de0164c8cbd9b6c64100de720d2e0c49ebcb77

  • SHA256

    d5c62e521f44e5fc7bc80dd61a163e86405eae49dbbc9101aad6b6261b79abf9

  • SHA512

    45fa09478a871a75f4650a56529632bfddf93990819c6d5212753325305a7946c631076897b13e62297136ae26db064fef701dea23453ea504b4c2517d5e74b9

  • SSDEEP

    384:c8LBBi/W/7mgEp87wYK2GePqZhbM2AQk93vmhm7UMKmIEecKdbXTzm9bVhcaO6fd:5W/sqoHT2A/vMHTi9bD/Qz1n

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 4 IoCs
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of AdjustPrivilegeToken 33 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d5c62e521f44e5fc7bc80dd61a163e86405eae49dbbc9101aad6b6261b79abf9.exe
    "C:\Users\Admin\AppData\Local\Temp\d5c62e521f44e5fc7bc80dd61a163e86405eae49dbbc9101aad6b6261b79abf9.exe"
    1⤵
    • Checks computer location settings
    • Drops startup file
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1960
    • C:\Users\Admin\AppData\Local\Temp\Payload.exe
      "C:\Users\Admin\AppData\Local\Temp\Payload.exe"
      2⤵
      • Drops startup file
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of AdjustPrivilegeToken
      PID:60
    • C:\Windows\SysWOW64\attrib.exe
      attrib +h +r +s "C:\Users\Admin\AppData\Local\Temp\Payload.exe"
      2⤵
      • Views/modifies file attributes
      PID:1740

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\Payload.exe

    Filesize

    31KB

    MD5

    a5ad2d1796744144d739569bb466b307

    SHA1

    42de0164c8cbd9b6c64100de720d2e0c49ebcb77

    SHA256

    d5c62e521f44e5fc7bc80dd61a163e86405eae49dbbc9101aad6b6261b79abf9

    SHA512

    45fa09478a871a75f4650a56529632bfddf93990819c6d5212753325305a7946c631076897b13e62297136ae26db064fef701dea23453ea504b4c2517d5e74b9

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.lnk

    Filesize

    1KB

    MD5

    1cf416d26fcaa9ac44cde97b4071c2c1

    SHA1

    2f49d770b79359232d9b8ad9609bcab9bc8489a1

    SHA256

    298bf368286c7dfa7b8cd2774d93811fea422c38b37b79c4049fb38fbfa49da0

    SHA512

    d4a92f2051d7bb5ec5dfd5cce038202cab2a75fad83238c914ce0e1d4db66b36bd2b8302451035e6e9cbf8160965e180f91af0ffea9772c28e0a4aa9a4171bcf

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Windows.lnk

    Filesize

    1KB

    MD5

    b565b6f7a706fa0e6f1a618d53af840a

    SHA1

    a2dcefc8f9bf6ffc89c3e9dba9ba582a4dc0c47f

    SHA256

    e2be89378f1677a386e8641949f4af149db4947d04ff320e256a5c0b39d683cb

    SHA512

    11755649cf70808de39fd6f3a20559feebad8e7344bbd5c10de0d285ded97d8570c9e01b2834eb80c6e3179abc6bec2d9bbd4dc4e24dd94fb981fd6c9caf28fe

  • memory/60-15-0x0000000074DD0000-0x0000000075381000-memory.dmp

    Filesize

    5.7MB

  • memory/60-16-0x0000000000D50000-0x0000000000D60000-memory.dmp

    Filesize

    64KB

  • memory/60-18-0x0000000074DD0000-0x0000000075381000-memory.dmp

    Filesize

    5.7MB

  • memory/60-23-0x0000000074DD0000-0x0000000075381000-memory.dmp

    Filesize

    5.7MB

  • memory/60-24-0x0000000000D50000-0x0000000000D60000-memory.dmp

    Filesize

    64KB

  • memory/1960-1-0x0000000001090000-0x00000000010A0000-memory.dmp

    Filesize

    64KB

  • memory/1960-0-0x0000000074DD0000-0x0000000075381000-memory.dmp

    Filesize

    5.7MB

  • memory/1960-2-0x0000000074DD0000-0x0000000075381000-memory.dmp

    Filesize

    5.7MB

  • memory/1960-14-0x0000000074DD0000-0x0000000075381000-memory.dmp

    Filesize

    5.7MB