Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    145s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/02/2024, 11:34

General

  • Target

    970e8303df550a33cc671bae08e7e47a.exe

  • Size

    613KB

  • MD5

    970e8303df550a33cc671bae08e7e47a

  • SHA1

    11d6173967c21abc8369cc81870c00811330e413

  • SHA256

    05a74d290e92fe5b9e4c1171e30aa83c3be1d0e511e42198679789b707bdae60

  • SHA512

    7223122bd4ce0f641aad84bd99bb1836090ab6db99f01d14c25b7c0b9f664781f891b50ce4f9141bad90c4497bf950bbe1071e3513d5f445624040a88b241865

  • SSDEEP

    12288:kwMDD4nOsuoOYjduaxfrqk1XfB0cPTRs2dVr9ZFDT6k2LyC3KxBNAC4pmZ:ktgOsu7cuaxfPi4dV7FJ+8NACom

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 7 IoCs
  • Drops desktop.ini file(s) 2 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\970e8303df550a33cc671bae08e7e47a.exe
    "C:\Users\Admin\AppData\Local\Temp\970e8303df550a33cc671bae08e7e47a.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:3332
    • C:\Users\Admin\AppData\Local\Temp\DM_9tR8iG5d9h\DownloadManager.exe
      DownloadManager.exe "C:\Users\Admin\AppData\Local\Temp\970e8303df550a33cc671bae08e7e47a.exe"
      2⤵
      • Executes dropped EXE
      • Drops desktop.ini file(s)
      • Drops file in Windows directory
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:888

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\DM_9tR8iG5d9h\ApplicationDebug.log

    Filesize

    110B

    MD5

    d90f30ec817672c86555083560b698f8

    SHA1

    7be9597d5b0bcef19a8de562b6d89974af3387a9

    SHA256

    0d051d3808ee63ff5f42e4e2e78834171a244336fd5b5aaf5ba56c34c7d30f9d

    SHA512

    afa369b0676a08c9a849d630f23b3884162549e80a3fcf3240acfaaa8b08c0cad4883bc4bb8cbd434a74a4980cf3f9f8e657276254becf095a8576d0aee76a5c

  • C:\Users\Admin\AppData\Local\Temp\DM_9tR8iG5d9h\DownloadManager.exe

    Filesize

    1.1MB

    MD5

    cdfe78adf74d242a4348145ea9e33f0a

    SHA1

    15e57d5ec85c53daefc08318dcbb18a904221cd9

    SHA256

    74ad7935ce68fb5d792dafacd0cc8c5bccaf9ed8d868ced7b1a648fcca46616c

    SHA512

    0c084ed7e779aaf5191eaf337ab181c478585fe2856d8b11e8eebbe6638e61f6dd2aaa2cdcd58beda6032071ca8e20bc1dfbda2a06cd8fc4be0e089d84f47e91

  • C:\Users\Admin\AppData\Local\Temp\nsc4BDF.tmp\System.dll

    Filesize

    11KB

    MD5

    c17103ae9072a06da581dec998343fc1

    SHA1

    b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

    SHA256

    dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

    SHA512

    d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

  • C:\Users\Admin\AppData\Local\Temp\nsc4BDF.tmp\UserInfo.dll

    Filesize

    4KB

    MD5

    7579ade7ae1747a31960a228ce02e666

    SHA1

    8ec8571a296737e819dcf86353a43fcf8ec63351

    SHA256

    564c80dec62d76c53497c40094db360ff8a36e0dc1bda8383d0f9583138997f5

    SHA512

    a88bc56e938374c333b0e33cb72951635b5d5a98b9cb2d6785073cbcad23bf4c0f9f69d3b7e87b46c76eb03ced9bb786844ce87656a9e3df4ca24acf43d7a05b

  • C:\Users\Admin\AppData\Local\Temp\nsc4BDF.tmp\inetc.dll

    Filesize

    20KB

    MD5

    c498ae64b4971132bba676873978de1e

    SHA1

    92e4009cd776b6c8616d8bffade7668ef3cb3c27

    SHA256

    5552bdde7e4113393f683ef501e4cc84dccc071bdc51391ea7fa3e7c1d49e4e8

    SHA512

    8e5ca35493f749a39ceae6796d2658ba10f7d8d9ceca45bb4365b338fabd1dfa9b9f92e33f50c91b0273e66adfbce4b98b09c15fd2473f8b214ed797462333d7

  • C:\Users\Admin\AppData\Local\Temp\nsc4BDF.tmp\pwgen.dll

    Filesize

    16KB

    MD5

    a555472395178ac8c733d90928e05017

    SHA1

    f44b192d66473f01a6540aaec4b6c9ac4c611d35

    SHA256

    82ae08fced4a1f9a7df123634da5f4cb12af4593a006bef421a54739a2cbd44e

    SHA512

    e6d87b030c45c655d93b2e76d7437ad900df5da2475dd2e6e28b6c872040491e80f540b00b6091d16bc8410bd58a1e82c62ee1b17193ef8500a153d4474bb80a

  • memory/888-50-0x00000000015C0000-0x00000000015D0000-memory.dmp

    Filesize

    64KB

  • memory/888-53-0x00000000015C0000-0x00000000015D0000-memory.dmp

    Filesize

    64KB

  • memory/888-48-0x000000001CB10000-0x000000001CFDE000-memory.dmp

    Filesize

    4.8MB

  • memory/888-49-0x000000001D080000-0x000000001D11C000-memory.dmp

    Filesize

    624KB

  • memory/888-38-0x00000000015C0000-0x00000000015D0000-memory.dmp

    Filesize

    64KB

  • memory/888-51-0x00000000015C0000-0x00000000015D0000-memory.dmp

    Filesize

    64KB

  • memory/888-52-0x000000001BC90000-0x000000001BC98000-memory.dmp

    Filesize

    32KB

  • memory/888-45-0x000000001C170000-0x000000001C188000-memory.dmp

    Filesize

    96KB

  • memory/888-54-0x00000000015C0000-0x00000000015D0000-memory.dmp

    Filesize

    64KB

  • memory/888-55-0x00000000015C0000-0x00000000015D0000-memory.dmp

    Filesize

    64KB

  • memory/888-56-0x00000000015C0000-0x00000000015D0000-memory.dmp

    Filesize

    64KB

  • memory/888-58-0x0000000020F60000-0x0000000021706000-memory.dmp

    Filesize

    7.6MB

  • memory/888-61-0x00007FF9CC240000-0x00007FF9CCBE1000-memory.dmp

    Filesize

    9.6MB

  • memory/888-37-0x00007FF9CC240000-0x00007FF9CCBE1000-memory.dmp

    Filesize

    9.6MB