Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    147s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/02/2024, 08:24

General

  • Target

    a1673ce11369e685bd9b1fa3dd7a8153.exe

  • Size

    600KB

  • MD5

    a1673ce11369e685bd9b1fa3dd7a8153

  • SHA1

    34bd4ccc809222345246db9f611f474f382e1b32

  • SHA256

    2335af0f1f32c4457296f40e539330a294e8b21460cdb8755e715a0fec6be859

  • SHA512

    a1e6164e7777bf7e7c169276b99d43409830bd07910b4e2866a029e844e9d8174769fa343ee335b22f8b61af6f4542188cb9077f7bdecb2240212e19215a19b6

  • SSDEEP

    12288:neHuihjaB44ZoATF87V4swu1JLb+MI7gK2YW7gPlXT:neOhu4/F8BTwu1JLbFTK2U

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a1673ce11369e685bd9b1fa3dd7a8153.exe
    "C:\Users\Admin\AppData\Local\Temp\a1673ce11369e685bd9b1fa3dd7a8153.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1148
    • C:\Users\Admin\AppData\Local\Temp\ccecabffhbd.exe
      C:\Users\Admin\AppData\Local\Temp\ccecabffhbd.exe 7-6-4-8-9-2-7-9-8-4-4 KEpFPDQwKy0uHCtMTz5IQEI2JxgrSj5OU0dJSUI7NS0cKD5FS0tHPTQqLywxKxwnOkc9NCgcK0lMSzxMQU1WQUA5KywuLyweKEo9TlI+TFtNSUo2X2xwbDMpK2tccG8lbGRhJltsaCRiWmtZKmVnYGsYJkFFQDtHRT03HCc7LzYkKRwrPSw5JSgeKDsrOSkqGis8KzsmKBgrQC43KSkXLUlJR0BRPE5bSElHTzg7VTkZKUxKRkJOOkxbQU5GPTUXLUlJR0BRPE5bRjhLPjQYK0FRP1tNSUo2FydBVD5ZP0U7SkJFPTkcKEJLS0tdO0lHU08+TDkpFy1NPzlKR1JJUVdMUEU0GCtSRjcuGCZCTCg1HCtLT0pMQEs+Vk9BSDxJST1ASzo+PVFORTccJ0BRWElNSlBCR0E1a3BuXBgrTj5OUUpFR0c+V1FPPkxbPDhXTDQqHCtBQ0A9TzsqFydFT1g+VUY4S0I6V0FKPExVSEtDPTReXWhsXxwnO01QRURLPT1ZRUg0LzIpJjQtJyssLSUwLioYK1BCR0E1KDIrKy81LjIzMhgmQkhORkhLOj5bTEBLPjQqKy4tKS4oKDMjKjIwNTMvMiJHSw==
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:452
      • C:\Windows\SysWOW64\Wbem\wmic.exe
        wmic /output:C:\Users\Admin\AppData\Local\Temp\81708763088.txt bios get serialnumber
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1944
      • C:\Windows\SysWOW64\Wbem\wmic.exe
        wmic /output:C:\Users\Admin\AppData\Local\Temp\81708763088.txt bios get version
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:3480
      • C:\Windows\SysWOW64\Wbem\wmic.exe
        wmic /output:C:\Users\Admin\AppData\Local\Temp\81708763088.txt bios get version
        3⤵
          PID:4064
        • C:\Windows\SysWOW64\Wbem\wmic.exe
          wmic /output:C:\Users\Admin\AppData\Local\Temp\81708763088.txt bios get version
          3⤵
            PID:2104
          • C:\Windows\SysWOW64\Wbem\wmic.exe
            wmic /output:C:\Users\Admin\AppData\Local\Temp\81708763088.txt bios get version
            3⤵
              PID:1704
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 452 -s 956
              3⤵
              • Program crash
              PID:3912
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 452 -ip 452
          1⤵
            PID:556

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\81708763088.txt

            Filesize

            66B

            MD5

            9025468f85256136f923096b01375964

            SHA1

            7fcd174999661594fa5f88890ffb195e9858cc52

            SHA256

            d5418014fa8e6e17d8992fd12c0dfecac8a34855603ea58133e87ea09c2130df

            SHA512

            92cac37c332e6e276a963d659986a79a79867df44682bfc2d77ed7784ffa5e2c149e5960a83d03ef4cf171be40a73e93a110aaa53b95152fa9a9da6b41d31e51

          • C:\Users\Admin\AppData\Local\Temp\81708763088.txt

            Filesize

            2B

            MD5

            f3b25701fe362ec84616a93a45ce9998

            SHA1

            d62636d8caec13f04e28442a0a6fa1afeb024bbb

            SHA256

            b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

            SHA512

            98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

          • C:\Users\Admin\AppData\Local\Temp\81708763088.txt

            Filesize

            58B

            MD5

            dd876faf0fd44a5fab3e82368e2e8b15

            SHA1

            01b04083fa278dda3a81705ca5abcfee487a3c90

            SHA256

            5602490a82bcacec8797d25cbb6f643fc9e69f89a2f0e6ec1e8d1f568e77a6b9

            SHA512

            e03d1def5b7fb0ed01a414cead199229ec0e153ff831d3ff5dd36c320572084c56a5e1369c753f868c855455758c0d308941b6187c348051419bd937d014cb8b

          • C:\Users\Admin\AppData\Local\Temp\ccecabffhbd.exe

            Filesize

            768KB

            MD5

            a496c00622f8f51a1e9d51328dbf281e

            SHA1

            a176ae4f204d815590923a87b1795fcb96caf0eb

            SHA256

            ce7f278246b65532be85f8dff7ae3506eb880a82870d40ce864dd28cd9f8edc2

            SHA512

            6b6023ce11c30272ba0ad58c076911649b1c25fc902741995c9647467a33100f9dc3b621e8eafa27383f33365159378685b78cbd6e238f8e7d367bfc64f0e10a

          • C:\Users\Admin\AppData\Local\Temp\ccecabffhbd.exe

            Filesize

            640KB

            MD5

            1f42b60af346c9b2499f136bbcedb413

            SHA1

            587e652d82c9ccb1a3bd18e0ab9f1f82c220f6fa

            SHA256

            e45d70a6988bb50986d7477821a17be27466e683aae07c6251d6de46aba2b21e

            SHA512

            ff0fce9dd3b7f35227586cc650fc3ce6b677d18dc262edb25997df8cc47bd64adac68aed947ed1b32007fc6169448a50adcfb0f938be2554e80591dec81268e3

          • C:\Users\Admin\AppData\Local\Temp\nss663D.tmp\nsisunz.dll

            Filesize

            40KB

            MD5

            5f13dbc378792f23e598079fc1e4422b

            SHA1

            5813c05802f15930aa860b8363af2b58426c8adf

            SHA256

            6e87ecb7f62039fbb6e7676422d1a5e75a32b90dde6865dcb68ee658ba8df61d

            SHA512

            9270635a5294482f49e0292e26d45dd103b85fe27dc163d44531b095c5f9dbde6b904adaf1a888ba3c112a094380394713c796f5195b2566a20f00b42b6578e5

          • C:\Users\Admin\AppData\Local\Temp\nss663D.tmp\rtm.dll

            Filesize

            125KB

            MD5

            dcf5bed7cdb5677ce2eb2b53e3baf344

            SHA1

            af8e22a2a976bd33892a5fb73548b1e5a2ae63fe

            SHA256

            ae175ba3963a7c8d65f252266de0058630c9c7395b6e2f3b6b817a5285b8f544

            SHA512

            30ca7aa4b7f43deafbde4c90682d9eb611551b5c26a77d92427e8d17b307842914ef0cc1f1ed50809d34d2e8408a5dae4527406dd40dbd1a323c8bed492261fd