Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    92s
  • max time network
    122s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/02/2024, 18:19

General

  • Target

    8d0619315aa626b29db776b4235cadef.exe

  • Size

    479KB

  • MD5

    8d0619315aa626b29db776b4235cadef

  • SHA1

    33ecf307805b81ac7f64d70a6c30bcdf335691d8

  • SHA256

    33ff3fc49a0d2135a30f7d7268dd3d30345326fe25012eea4d59ad94667e265d

  • SHA512

    d5660af8e7e7f4f0e0e8651b7c079167abd0f62bfcb16469e2e0ad9c28daf8c9403144a421c3069200e16456329aeba047ee39872fdbd8e7339c03685a4270e2

  • SSDEEP

    12288:rtOzkjUBvCkfmvz756FGtkeSUknzp7tRuvftbOb8:RwkjUV5a75G0OtXggb8

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8d0619315aa626b29db776b4235cadef.exe
    "C:\Users\Admin\AppData\Local\Temp\8d0619315aa626b29db776b4235cadef.exe"
    1⤵
    • Loads dropped DLL
    • Checks whether UAC is enabled
    • Modifies Internet Explorer settings
    • Suspicious use of SetWindowsHookEx
    PID:4548
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4548 -s 2236
      2⤵
      • Program crash
      PID:2396
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4548 -ip 4548
    1⤵
      PID:1264

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\IM_513D.tmp\ActionEngine.dll

      Filesize

      1009KB

      MD5

      9f33f5afe6693f5ef2bab1ff9b68ca52

      SHA1

      01b12b2c2b389d2337548b6d41a11be4516d8039

      SHA256

      7da9d3591d9b319484e4f651a1218fcfce6254315c2dab77519c11279ba25ced

      SHA512

      221256a8048a442322e2da961add20e46ff669cab29274e41824d00638a2ca3ce0b29a3987856db891862983e5cf8d417d113fe7653ae62ba47d77f3bb716cad

    • C:\Users\Admin\AppData\Local\Temp\IM_513D.tmp\Gui\api.js

      Filesize

      5KB

      MD5

      cad20144ce29f20fecd6c21c5c61dead

      SHA1

      6bbaeb0aae32a3828cb77f8bfd3fb493803f3626

      SHA256

      e68cb263198cf8cf93e5a60be4ff091606be78b0963aca0e519732187ea93e80

      SHA512

      35e0f7c8cb13693d7e3a221f186bd72613544dc75e5355550bd0e7ed7054831258c5a487d20b412ce646313d24b3436baf10597baa8a359a319dbeee26580ad5

    • C:\Users\Admin\AppData\Local\Temp\IM_513D.tmp\Gui\jquery-1.3.2.min.js

      Filesize

      55KB

      MD5

      bb381e2d19d8eace86b34d20759491a5

      SHA1

      3dc9f7c2642efff4482e68c9d9df874bf98f5bcb

      SHA256

      c8370a2d050359e9d505acc411e6f457a49b21360a21e6cbc9229bad3a767899

      SHA512

      abb2ad8b111271a82a04362940a7ab9930883ecb33497a1c53edcdc49f0634af5bf5b1bc7095bd18db26d212b059aece4577f85040b5f49c4982b468fe973c12

    • C:\Users\Admin\AppData\Local\Temp\IM_513D.tmp\Gui\jquery.localisation.min.js

      Filesize

      1KB

      MD5

      f1cf73e00c240e9a4283201291d45a07

      SHA1

      918c49cb6f1de521d91967b2508f19db1f38fea2

      SHA256

      81bce5ff1003c9d5a688102d5d4c603841ed61c32628823dc48d560ec0d42cd2

      SHA512

      2242892434a638a9344c87453c3d2a66a880278dcf66f1516f240131dca767248baf663ffc9365acad26550e5b20a742d8115d5976de3a094d0229d60844788f

    • C:\Users\Admin\AppData\Local\Temp\IM_513D.tmp\Gui\language\splash-strings-de.js

      Filesize

      476B

      MD5

      63f3c0fde7f1574f9f32c83ac42ff22c

      SHA1

      2aeca63aa753d3b9fe94e0784e1778755a93e327

      SHA256

      88b4561f58729b6e789cc322195902c80d1ac60ad93ca19036a98634deabce29

      SHA512

      9bb35fa3066625173b714cec8208210aad78d0849d6a965e3660d9263b67e759cb071451c5df74cfac33c6eacb1572cdb85ccf8ae60f6e2185d4666bd844bd81

    • C:\Users\Admin\AppData\Local\Temp\IM_513D.tmp\Gui\language\splash-strings.js

      Filesize

      446B

      MD5

      157d5a5389521369e8d42bf50dd9e4e5

      SHA1

      32f0877615d73dd0f952dbaf1425e2e61e8082aa

      SHA256

      5688c7509f409b9f06d40f247000833f8318e4d20dbb6a2dff7fdb74df220bed

      SHA512

      75a583cfa7bd4fb4eaa73b3e189a5dba4116479c5ac5c6be8db95bb656b3951013493ada964d8abf4d5140732ae3e0e1e09e9f48622d445460532ec8eef06f1b

    • C:\Users\Admin\AppData\Local\Temp\IM_513D.tmp\Gui\splash.html

      Filesize

      1KB

      MD5

      0d0e0532f51af856688ad83abb889fde

      SHA1

      a1949b703816fa1bc60cf9c395d6dbb0f6f5c61c

      SHA256

      a358150647aaf4413fd2738c8ebcc0579b0bd4ccca8ba02738a4332a430f8ec8

      SHA512

      29322e2446ae5a37a34f113be5924121ce7d8fcfc617818f59c407fe7da01153845a947464345d6b86463b18c75d0adae1cc7dd5f17cf2d29584ef9539d8e0df

    • C:\Users\Admin\AppData\Local\Temp\IM_513D.tmp\Gui\splash.js

      Filesize

      946B

      MD5

      354dce57695e99df9e6faba76346496f

      SHA1

      ca364e2daa4a80cfed7412b0f0374f1f82fa7146

      SHA256

      bb39b6b14ae7f032922366943b342f58be120242020b1fa4dbb3310e39928823

      SHA512

      8f34ae59e5502c70659e358d03709cfdfd01ec2128110932910e8de16888857896e86707c279b3f67edb54059a08ab6ce05b742342e825e2894580ae4a4639ee

    • C:\Users\Admin\AppData\Local\Temp\IM_513D.tmp\Gui\translation.js

      Filesize

      6KB

      MD5

      682fea27f4c335defc18be6fb24d5748

      SHA1

      d4a1743d63508d18af4be59232f3d266228648fb

      SHA256

      928571317e90c4d6680931dffaaae85f382069be2bc72b875810ceb1f7c2744f

      SHA512

      ef70ad8c291fe10c8b1d0dc060fc50b4593cf6fabc03a751aa62d5f4e375b1c80184337816a8e50430964960fc56324259f8833707320c7b757e388ecbd28341

    • C:\Users\Admin\AppData\Local\Temp\IM_513D.tmp\instlangs.xml

      Filesize

      17KB

      MD5

      aa91818150cfadb667ae6f914d43dca0

      SHA1

      4411bd0038ccd464ed7597f0540cfe04867b9042

      SHA256

      2aa71646493cf47b38be0920488159b154eaf19193dc4a6ecfa0a6509196c7c5

      SHA512

      dd1310dc52bb6cc4977341dc34fb6a273e1349602a5fb3037e0b0d087b8f0d2d7a04e2db32e2708379758266c31422d27b5a35f5ba068cd7dbdd211b07893ecd

    • memory/4548-104-0x0000000002C30000-0x0000000002C31000-memory.dmp

      Filesize

      4KB