Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    142s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/01/2024, 19:37

General

  • Target

    7b19f0775f2d0614c20e7a00f2eec61b.exe

  • Size

    27KB

  • MD5

    7b19f0775f2d0614c20e7a00f2eec61b

  • SHA1

    1998cb1c40978df979e41cedeed0d7e057fdfb20

  • SHA256

    b8001fa7feb004a014da2051b5059bc1ea25f5c0d9fed5add8b064614881a1b6

  • SHA512

    aa7437f12b3d70b537a1ec17de6737e24d98548139147b505507431b95d6751fbfa72179b2a14ab7d1268419fdbbc04a75fedeb8be72f0d2d8340df09d81b7d7

  • SSDEEP

    384:AmmBX9UBSJWGe6cL1mlZg9hhiU4z6P1pU89/dNQCKCP4DCYAN+Hn:AmmBX9UBSEJmA9hhiUJzS4gDXk+H

Score
7/10
upx

Malware Config

Signatures

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in System32 directory 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 30 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 9 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7b19f0775f2d0614c20e7a00f2eec61b.exe
    "C:\Users\Admin\AppData\Local\Temp\7b19f0775f2d0614c20e7a00f2eec61b.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4960
    • C:\Program Files\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1916
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1916 CREDAT:17410 /prefetch:2
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:4800
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\7B19F0~1.EXE > nul
      2⤵
        PID:2008

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

      Filesize

      471B

      MD5

      55adff48fbcd7763c70a0d51d485d24f

      SHA1

      8ba66cb09d8e16d22c35931083d443155d3a04fa

      SHA256

      801c05af90120efdf31e4dfdcc5e7f2b76b9ca0e0746f58fdf12bf99287d8aca

      SHA512

      a3151d562469fd2412c237bb5646bb214a9a9f8664be4eb48fdf704d9710872e41947669f770ac74d9d1eb5d6ea5953e40cc5a85d57e56fc82708341154eee7b

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

      Filesize

      404B

      MD5

      2a7714ed33f11acfca3c33d29021e95d

      SHA1

      bb25200383c48df00e28322e6fae0aa8d0c0bc59

      SHA256

      ab24dc157ee8b74e3e200e926827f203840884b0c445c98ded7ef12a3621e87e

      SHA512

      d17ddc6d9919fd2a866e761079afdc6b9ce84de1ff0eefc69b74a78b6e5cc0f068d17818d8b11b4b1d634c3c4d26bdb471cb9b5a06211a9e855f9893dae689d5

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6AXLYU2E\suggestions[1].en-US

      Filesize

      17KB

      MD5

      5a34cb996293fde2cb7a4ac89587393a

      SHA1

      3c96c993500690d1a77873cd62bc639b3a10653f

      SHA256

      c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

      SHA512

      e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

    • memory/4960-0-0x0000000000400000-0x0000000000415000-memory.dmp

      Filesize

      84KB

    • memory/4960-3-0x0000000000400000-0x0000000000415000-memory.dmp

      Filesize

      84KB