Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    142s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/01/2024, 13:51 UTC

General

  • Target

    AMM Consol 020-04860612.bat.exe

  • Size

    708KB

  • MD5

    3e902a2f0a5c02538f27858309c44e71

  • SHA1

    e5c42d3dcc966129b35fda066267a98f040b765d

  • SHA256

    75db37564d36a9f7cf79c21a1f69c5acc5149d6cf32f270b7799531b0d8b3327

  • SHA512

    17a8708042e49b20013284921ec25fbab64b81a657b75ed7c66e65fd451798775046818a53048e8ae9d12405a9a0f8b03667c285bdf6bf494c20fae5abcdf4e8

  • SSDEEP

    12288:7aFpedTKGZr4NS52Hd5M+Igh/SkjY/oXA9ULcdD1bT78myovhd:Se/r4Hd5H0L9uch98mb

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\AMM Consol 020-04860612.bat.exe
    "C:\Users\Admin\AppData\Local\Temp\AMM Consol 020-04860612.bat.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4976
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\AMM Consol 020-04860612.bat.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2468
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\QzkJCQY.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3664
    • C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\QzkJCQY" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE8BA.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:3784
    • C:\Users\Admin\AppData\Local\Temp\AMM Consol 020-04860612.bat.exe
      "C:\Users\Admin\AppData\Local\Temp\AMM Consol 020-04860612.bat.exe"
      2⤵
        PID:776

    Network

    • flag-us
      DNS
      241.150.49.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      241.150.49.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      187.178.17.96.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      187.178.17.96.in-addr.arpa
      IN PTR
      Response
      187.178.17.96.in-addr.arpa
      IN PTR
      a96-17-178-187deploystaticakamaitechnologiescom
    • flag-us
      DNS
      95.221.229.192.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      95.221.229.192.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      83.177.190.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      83.177.190.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      217.106.137.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      217.106.137.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      97.17.167.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      97.17.167.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      16.234.44.23.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      16.234.44.23.in-addr.arpa
      IN PTR
      Response
      16.234.44.23.in-addr.arpa
      IN PTR
      a23-44-234-16deploystaticakamaitechnologiescom
    • flag-us
      DNS
      157.123.68.40.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      157.123.68.40.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      206.23.85.13.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      206.23.85.13.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      18.134.221.88.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      18.134.221.88.in-addr.arpa
      IN PTR
      Response
      18.134.221.88.in-addr.arpa
      IN PTR
      a88-221-134-18deploystaticakamaitechnologiescom
    • flag-us
      DNS
      173.178.17.96.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      173.178.17.96.in-addr.arpa
      IN PTR
      Response
      173.178.17.96.in-addr.arpa
      IN PTR
      a96-17-178-173deploystaticakamaitechnologiescom
    • flag-us
      DNS
      11.227.111.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      11.227.111.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      13.73.50.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      13.73.50.20.in-addr.arpa
      IN PTR
      Response
    No results found
    • 8.8.8.8:53
      241.150.49.20.in-addr.arpa
      dns
      72 B
      158 B
      1
      1

      DNS Request

      241.150.49.20.in-addr.arpa

    • 8.8.8.8:53
      187.178.17.96.in-addr.arpa
      dns
      72 B
      137 B
      1
      1

      DNS Request

      187.178.17.96.in-addr.arpa

    • 8.8.8.8:53
      95.221.229.192.in-addr.arpa
      dns
      73 B
      144 B
      1
      1

      DNS Request

      95.221.229.192.in-addr.arpa

    • 8.8.8.8:53
      83.177.190.20.in-addr.arpa
      dns
      72 B
      158 B
      1
      1

      DNS Request

      83.177.190.20.in-addr.arpa

    • 8.8.8.8:53
      217.106.137.52.in-addr.arpa
      dns
      73 B
      147 B
      1
      1

      DNS Request

      217.106.137.52.in-addr.arpa

    • 8.8.8.8:53
      97.17.167.52.in-addr.arpa
      dns
      71 B
      145 B
      1
      1

      DNS Request

      97.17.167.52.in-addr.arpa

    • 8.8.8.8:53
      16.234.44.23.in-addr.arpa
      dns
      71 B
      135 B
      1
      1

      DNS Request

      16.234.44.23.in-addr.arpa

    • 8.8.8.8:53
      157.123.68.40.in-addr.arpa
      dns
      72 B
      146 B
      1
      1

      DNS Request

      157.123.68.40.in-addr.arpa

    • 8.8.8.8:53
      206.23.85.13.in-addr.arpa
      dns
      71 B
      145 B
      1
      1

      DNS Request

      206.23.85.13.in-addr.arpa

    • 8.8.8.8:53
      18.134.221.88.in-addr.arpa
      dns
      72 B
      137 B
      1
      1

      DNS Request

      18.134.221.88.in-addr.arpa

    • 8.8.8.8:53
      173.178.17.96.in-addr.arpa
      dns
      72 B
      137 B
      1
      1

      DNS Request

      173.178.17.96.in-addr.arpa

    • 8.8.8.8:53
      11.227.111.52.in-addr.arpa
      dns
      72 B
      158 B
      1
      1

      DNS Request

      11.227.111.52.in-addr.arpa

    • 8.8.8.8:53
      13.73.50.20.in-addr.arpa
      dns
      70 B
      156 B
      1
      1

      DNS Request

      13.73.50.20.in-addr.arpa

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

      Filesize

      2KB

      MD5

      d85ba6ff808d9e5444a4b369f5bc2730

      SHA1

      31aa9d96590fff6981b315e0b391b575e4c0804a

      SHA256

      84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

      SHA512

      8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

      Filesize

      944B

      MD5

      d28a889fd956d5cb3accfbaf1143eb6f

      SHA1

      157ba54b365341f8ff06707d996b3635da8446f7

      SHA256

      21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

      SHA512

      0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0mundavv.2kv.ps1

      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • C:\Users\Admin\AppData\Local\Temp\tmpE8BA.tmp

      Filesize

      1KB

      MD5

      10490b2e45f9b426b0616f9922405182

      SHA1

      df5625cb5e4eac59a3746eab7a6ec26dcb10c548

      SHA256

      7490a02d8b5af17801f657625de28d4cb48f8c130045b0923cfcc6767f621ba1

      SHA512

      effd314f9df4e290e15376eb0905605163b6be982f3a87b25eee0142612d5866d950e2e219b5ebfd7fb62e7567a2dfcd88cca13ceddcf7cdd894fff325abe970

    • memory/2468-51-0x00007FF801390000-0x00007FF801E51000-memory.dmp

      Filesize

      10.8MB

    • memory/2468-18-0x0000017FEA790000-0x0000017FEA7A0000-memory.dmp

      Filesize

      64KB

    • memory/2468-43-0x0000017FEA790000-0x0000017FEA7A0000-memory.dmp

      Filesize

      64KB

    • memory/2468-17-0x00007FF801390000-0x00007FF801E51000-memory.dmp

      Filesize

      10.8MB

    • memory/2468-29-0x0000017FEA790000-0x0000017FEA7A0000-memory.dmp

      Filesize

      64KB

    • memory/3664-39-0x0000028AA1CB0000-0x0000028AA1CC0000-memory.dmp

      Filesize

      64KB

    • memory/3664-13-0x00007FF801390000-0x00007FF801E51000-memory.dmp

      Filesize

      10.8MB

    • memory/3664-15-0x0000028AA1CB0000-0x0000028AA1CC0000-memory.dmp

      Filesize

      64KB

    • memory/3664-16-0x0000028ABA3C0000-0x0000028ABA3E2000-memory.dmp

      Filesize

      136KB

    • memory/3664-42-0x0000028AA1CB0000-0x0000028AA1CC0000-memory.dmp

      Filesize

      64KB

    • memory/3664-44-0x0000028AA1CB0000-0x0000028AA1CC0000-memory.dmp

      Filesize

      64KB

    • memory/3664-50-0x00007FF801390000-0x00007FF801E51000-memory.dmp

      Filesize

      10.8MB

    • memory/4976-6-0x00000000039C0000-0x00000000039D0000-memory.dmp

      Filesize

      64KB

    • memory/4976-8-0x000000001CA50000-0x000000001CA60000-memory.dmp

      Filesize

      64KB

    • memory/4976-41-0x00007FF801390000-0x00007FF801E51000-memory.dmp

      Filesize

      10.8MB

    • memory/4976-7-0x000000001EE10000-0x000000001EE90000-memory.dmp

      Filesize

      512KB

    • memory/4976-0-0x0000000000C30000-0x0000000000CE4000-memory.dmp

      Filesize

      720KB

    • memory/4976-5-0x00000000039B0000-0x00000000039C2000-memory.dmp

      Filesize

      72KB

    • memory/4976-4-0x00007FF801390000-0x00007FF801E51000-memory.dmp

      Filesize

      10.8MB

    • memory/4976-3-0x0000000003990000-0x00000000039AA000-memory.dmp

      Filesize

      104KB

    • memory/4976-2-0x000000001CA50000-0x000000001CA60000-memory.dmp

      Filesize

      64KB

    • memory/4976-1-0x00007FF801390000-0x00007FF801E51000-memory.dmp

      Filesize

      10.8MB

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.