Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    93s
  • max time network
    114s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/02/2024, 05:42

General

  • Target

    a115c40fcc89b08a1634c6f6433bd3c0.exe

  • Size

    1.4MB

  • MD5

    a115c40fcc89b08a1634c6f6433bd3c0

  • SHA1

    6d4082f93198de467584cb48f6a8f708a1ff13db

  • SHA256

    1fd72cea01073af91e1f8677c48fa14257230cc505409e0e56f204a79f4ebae4

  • SHA512

    72c96484687eca67a5ae9bbb6db4f6e82b7a44a3a6cd240d9d9df69da81d6b0e53c158f47fd22676bd1dd40807ea08b5eeb80fd644df68bd0df791dd81bb3f40

  • SSDEEP

    24576:Ro7r/4p6qO4pDlPJsZtZQk5p8hulbEwfXGpBzjRvdsxlTShiVCF:yf/4Qf4pxPctqG8IlNGnxvdsxZ4U2

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 8 IoCs
  • Drops file in Program Files directory 11 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 38 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a115c40fcc89b08a1634c6f6433bd3c0.exe
    "C:\Users\Admin\AppData\Local\Temp\a115c40fcc89b08a1634c6f6433bd3c0.exe"
    1⤵
    • Checks computer location settings
    • Loads dropped DLL
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1700
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" http://taourl.com/i0dpw
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3092
      • C:\Program Files\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://taourl.com/i0dpw
        3⤵
        • Modifies Internet Explorer settings
        PID:2912
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" http://www.178gg.com/lianjie/10608.htm
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3704
      • C:\Program Files\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://www.178gg.com/lianjie/10608.htm
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:908
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:908 CREDAT:17410 /prefetch:2
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:4740
    • C:\Windows\SysWOW64\Wscript.exe
      "C:\Windows\system32\Wscript" "C:\Program Files (x86)\soft121403\b_1203.vbs"
      2⤵
        PID:4064

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\jishu_121403\jishu_121403.exe

      Filesize

      1.0MB

      MD5

      e2590fb7bac27dbfa512820e9139f28b

      SHA1

      209d8d0b77c7a8863a3c68464ce47f6a3f00d454

      SHA256

      4369c213390dd318aaf57b841e338f0b781b16e61713c39e3d961d6065de1821

      SHA512

      a6b8cdac512c2d05eb2270f8b4f64248cc177785acbd8d4f0ad725acdd2c894f639e7e7259066a8014a79d69f213812dc09793a2bad7a3d6bd9a511f3ee57223

    • C:\Program Files (x86)\soft121403\b_1203.vbs

      Filesize

      226B

      MD5

      88e390a1ae346a890b0ad5f99b680230

      SHA1

      a092ac6c24d3d0db4d8a573c46f20cf72c266b55

      SHA256

      e8e6f4b99b4d86aef27a2b6c276bb6d9a12411b278d9b80c177a1f7e19ec79dc

      SHA512

      8d53fb2bd82f6dbe188f6b368cb4c7b61ea5b429769fdc3075f0c7c320ae1362caab3432facfe83ad323ebebf3beab1739adfef46c01d2356eb6866f9ded88b1

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\VTN5LRZV\suggestions[1].en-US

      Filesize

      17KB

      MD5

      5a34cb996293fde2cb7a4ac89587393a

      SHA1

      3c96c993500690d1a77873cd62bc639b3a10653f

      SHA256

      c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

      SHA512

      e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

    • C:\Users\Admin\AppData\Local\Temp\nsv472C.tmp\FindProcDLL.dll

      Filesize

      31KB

      MD5

      83cd62eab980e3d64c131799608c8371

      SHA1

      5b57a6842a154997e31fab573c5754b358f5dd1c

      SHA256

      a6122e80f1c51dc72770b4f56c7c482f7a9571143fbf83b19c4d141d0cb19294

      SHA512

      91cfbcc125600ec341f5571dcf1e4a814cf7673f82cf42f32155bd54791bbf32619f2bb14ae871d7996e9ddecdfcc5db40caa0979d6dfba3e73cfe8e69c163c9

    • C:\Users\Admin\AppData\Local\Temp\nsv472C.tmp\NSISdl.dll

      Filesize

      14KB

      MD5

      254f13dfd61c5b7d2119eb2550491e1d

      SHA1

      5083f6804ee3475f3698ab9e68611b0128e22fd6

      SHA256

      fd0e8be2135f3d326b65520383a3468c3983fa32c9c93594d986b16709d80f28

      SHA512

      fcef8ac5bd0ee6e316dbbc128a223ba18c8bf85a8d253e0c0877af6a4f686a20b08d34e5a426e2be5045962b391b8073769253a4d9b18616febc8133ccf654f7