Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    117s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/03/2024, 14:15

General

  • Target

    b255bfb165207c91bc333eadf7dc5191.exe

  • Size

    42KB

  • MD5

    b255bfb165207c91bc333eadf7dc5191

  • SHA1

    4c6310f0bb5b361e02f74ed4d97d34cea1f9f6d7

  • SHA256

    81f8cf0d14c183be6928e42e7ec558fb39bd592b300890037c8ca19c183b5b8e

  • SHA512

    03cbdeb88ec5c77d5d03f24666dd63880d80dc7d9255d74d35b272498effcfa5e995ed1166d823bfb4170747e766fe069e8038e03d34c29e961e6e7821ee1575

  • SSDEEP

    768:pGkEywiIYBAnUtj5erD6r5KVApvtC0hQlaOOIbA3xg4o+TM:tExfYBAnkIDEj1tCEQEOOIbD4o+TM

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in System32 directory 4 IoCs
  • Modifies registry class 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\winlogon.exe
    winlogon.exe
    1⤵
      PID:612
    • C:\Users\Admin\AppData\Local\Temp\b255bfb165207c91bc333eadf7dc5191.exe
      "C:\Users\Admin\AppData\Local\Temp\b255bfb165207c91bc333eadf7dc5191.exe"
      1⤵
      • Loads dropped DLL
      • Drops file in System32 directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1264
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe C:\Windows\system32\wvUkICtr.dll,a
        2⤵
        • Loads dropped DLL
        • Adds Run key to start application
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        PID:216
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\removalfile.bat "C:\Users\Admin\AppData\Local\Temp\b255bfb165207c91bc333eadf7dc5191.exe"
        2⤵
          PID:5600

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\removalfile.bat

        Filesize

        43B

        MD5

        9a7ef09167a6f4433681b94351509043

        SHA1

        259b1375ed8e84943ca1d42646bb416325c89e12

        SHA256

        d5739a0510d89da572eb0b0d394d4fb4dd361cd9ee0144b9b31c590df93c3be7

        SHA512

        96b84cd88a0e4b7c1122af3ed6ce5edf0a9a4e9bf79575eadfac16b2c46f1278d57755d29f21d7c6dcb4403be24b7ac7da4837c6cc9c602342a8f2b8e54883df

      • C:\Windows\SysWOW64\rqRKAQIc.dll

        Filesize

        32KB

        MD5

        6c4faf2bee227999271ce23f74797b93

        SHA1

        e66aaadfa53ac8dd8646475e4e94a39a44b756b6

        SHA256

        471190ab85cc3ed0694758a972c54c8795429bc00a25cbe29f64296c2e4ce18d

        SHA512

        baecb0a57a14918ca50126d29077916ec77602d47a85c41dedfc5796e645d03b97145c24dc523940b8de18fb1bb9ece1dabfe5c57a3a12741919d8151cfdfab8

      • memory/216-23-0x0000000010000000-0x0000000010010000-memory.dmp

        Filesize

        64KB

      • memory/216-24-0x0000000002B60000-0x0000000002B65000-memory.dmp

        Filesize

        20KB

      • memory/216-26-0x0000000010000000-0x0000000010010000-memory.dmp

        Filesize

        64KB

      • memory/1264-0-0x0000000000400000-0x000000000040E000-memory.dmp

        Filesize

        56KB

      • memory/1264-1-0x0000000002030000-0x0000000002035000-memory.dmp

        Filesize

        20KB

      • memory/1264-7-0x0000000010000000-0x0000000010010000-memory.dmp

        Filesize

        64KB

      • memory/1264-9-0x0000000002A90000-0x0000000002A95000-memory.dmp

        Filesize

        20KB

      • memory/1264-13-0x0000000000400000-0x000000000040E000-memory.dmp

        Filesize

        56KB

      • memory/1264-14-0x0000000010000000-0x0000000010010000-memory.dmp

        Filesize

        64KB

      • memory/1264-17-0x0000000002030000-0x0000000002035000-memory.dmp

        Filesize

        20KB