Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    14s
  • max time network
    19s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/02/2024, 00:13

Errors

Reason
Machine shutdown

General

  • Target

    97fb18226b9e973c999ed8547efd5ddc.exe

  • Size

    642KB

  • MD5

    97fb18226b9e973c999ed8547efd5ddc

  • SHA1

    37bede16538d59b8a1023a329e17f25e82df6665

  • SHA256

    7f5bd953de51989a7ed7e5151b43d280af2eeffff1453b198dd6c877e86d8116

  • SHA512

    c5c5656bdb269e19fc093ea7e7d1c2f6635bb191b45dc0fafab666e25203b51e2f09ca9875aee1d3ed9e21a77afe75c872e033e734e6e1bac1e8e33b844f203e

  • SSDEEP

    12288:z/xXCiWWuEFo0tDap7uL47ikBwjsW77zfx2WbgSrSw9B67mAyd9qU8YIWKnW:td2EFntk7uE7TwjTrfx2DSr9B6nynvNK

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Maps connected drives based on registry 3 TTPs 5 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies data under HKEY_USERS 15 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\97fb18226b9e973c999ed8547efd5ddc.exe
    "C:\Users\Admin\AppData\Local\Temp\97fb18226b9e973c999ed8547efd5ddc.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Maps connected drives based on registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:3412
  • C:\Windows\system32\LogonUI.exe
    "LogonUI.exe" /flags:0x4 /state0:0xa398f855 /state1:0x41c64e6d
    1⤵
    • Modifies data under HKEY_USERS
    • Suspicious use of SetWindowsHookEx
    PID:1960

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\MYPNGI1.jpg

    Filesize

    515B

    MD5

    7f7112e9c3de0d48e8198b74207b5c03

    SHA1

    d8acfb4a14d3cb8279c39f9d18780aec261b627a

    SHA256

    d4d5fb19b9a21aa609c5f91c35d3d9dcd4c62071769b332406cc23215bb66ee7

    SHA512

    9bed65083205866140d3f70d217a19ba75a443a58554748eac5edebf62201b08edb70bef0a28997447878db151dad62d0849014515c2c4767654b625e03f0a7d

  • C:\Users\Admin\AppData\Roaming\MYPNGI16.jpg

    Filesize

    500B

    MD5

    212a6d2dbd5c89a3ffe47bcdd5b43504

    SHA1

    3cbc32e292fb3a29e7df59026839f435cfa0fda3

    SHA256

    197afe35f7607e225fd49d829e4c28608441c3fd8ce209daa171df675611bbb2

    SHA512

    b2ce9af36e1c07ebdeac12c20038b01a48eb728f8094ee25eafac6e8152049e02694f936783a2fe41d61312be74781b01b5f8553eb2f954becee428851189c3b

  • C:\Users\Admin\AppData\Roaming\MYPNGI20.jpg

    Filesize

    694B

    MD5

    175412ff945c4d15eb6cd3b393d130c2

    SHA1

    2c83768848611756b277579f55f7f3a40ebee103

    SHA256

    f9b7e03583ee87205d7c7e9e10dd9d2dfc94415e63c05203fda70431423a5f03

    SHA512

    5dab37093e665a9fab279a71f0057253ac6676d0796c9b8c6cb69b403e44a3fadf62c353bb96bbf494ad87115b8199b6ed18b522ecc3a075dbc62c9e73b830a6

  • C:\Users\Admin\AppData\Roaming\MYPNGI8.jpg

    Filesize

    12KB

    MD5

    1bd1cb93fac0acc948d65c51ab5489b4

    SHA1

    64ff1ef70e25554de420ef5da917e710937c03e9

    SHA256

    1183daa52f3ff1aab9aec0e23ec92d6185e601f77f6944501d6fe5b3598518a4

    SHA512

    45c7edb9f74d39c972226be0e7bf0213cc417ae2a8c0536a3761dddd02a8c3b4df8b2f316bf88e5979fc0d1e732e7e9f686245318a1cb3e48f901ee0e0ee77d5

  • memory/3412-0-0x0000000000400000-0x000000000057E000-memory.dmp

    Filesize

    1.5MB

  • memory/3412-1-0x0000000000BD0000-0x0000000000BD1000-memory.dmp

    Filesize

    4KB

  • memory/3412-152-0x0000000000400000-0x000000000057E000-memory.dmp

    Filesize

    1.5MB