Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    106s
  • max time network
    115s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    05/03/2024, 21:50

General

  • Target

    rufus-4.4p.exe

  • Size

    1.4MB

  • MD5

    7a4662bb7f331d2252f3d949657d821d

  • SHA1

    ad53fddfbcead7b3e6c322c0aad8c4a826bd4967

  • SHA256

    42cdb16f6dd64c4fec30c7a71960fe4d0015862c37e7b02c8dba5c0d68384c74

  • SHA512

    a1d111fc91cd470d36bd4640884b3550c6a4035e8c5bc5176dc9f67aa2ef8be6fc12956d0b351c272d8bb89646546dac868b32d1d1985dee86ffb6e971b14f3f

  • SSDEEP

    24576:wOyBSB04yZT5Z6iqUbVEMs6MrhXlPrBnr/TwcEgzXIdVWLpuL94q:XgZT5ZSU1fUhXhrBnbTbaAIt

Score
7/10
upx

Malware Config

Signatures

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 48 IoCs
  • Suspicious use of SendNotifyMessage 45 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\rufus-4.4p.exe
    "C:\Users\Admin\AppData\Local\Temp\rufus-4.4p.exe"
    1⤵
      PID:2756
    • C:\Windows\System32\vdsldr.exe
      C:\Windows\System32\vdsldr.exe -Embedding
      1⤵
        PID:1708
      • C:\Windows\System32\vds.exe
        C:\Windows\System32\vds.exe
        1⤵
          PID:2816
        • C:\Program Files\VideoLAN\VLC\vlc.exe
          "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\RemoveRepair.mpv2"
          1⤵
          • Suspicious behavior: AddClipboardFormatListener
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of SetWindowsHookEx
          PID:2768
        • C:\Windows\explorer.exe
          "C:\Windows\explorer.exe"
          1⤵
            PID:2780
          • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
            "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde
            1⤵
            • Enumerates system info in registry
            • Modifies Internet Explorer settings
            • Modifies registry class
            • Suspicious behavior: AddClipboardFormatListener
            • Suspicious use of SetWindowsHookEx
            PID:1104
          • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
            "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\Documents\Are.docx"
            1⤵
            • Drops file in Windows directory
            • Suspicious behavior: AddClipboardFormatListener
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:3044
            • C:\Windows\splwow64.exe
              C:\Windows\splwow64.exe 12288
              2⤵
                PID:1636
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe"
              1⤵
              • Enumerates system info in registry
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              • Suspicious use of WriteProcessMemory
              PID:1580
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef4bf9758,0x7fef4bf9768,0x7fef4bf9778
                2⤵
                  PID:1704
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1168 --field-trial-handle=1188,i,16833306507058622173,16929499044546179951,131072 /prefetch:2
                  2⤵
                    PID:2184
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1500 --field-trial-handle=1188,i,16833306507058622173,16929499044546179951,131072 /prefetch:8
                    2⤵
                      PID:2592
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1588 --field-trial-handle=1188,i,16833306507058622173,16929499044546179951,131072 /prefetch:8
                      2⤵
                        PID:1068
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2292 --field-trial-handle=1188,i,16833306507058622173,16929499044546179951,131072 /prefetch:1
                        2⤵
                          PID:2436
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2304 --field-trial-handle=1188,i,16833306507058622173,16929499044546179951,131072 /prefetch:1
                          2⤵
                            PID:2456
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1408 --field-trial-handle=1188,i,16833306507058622173,16929499044546179951,131072 /prefetch:2
                            2⤵
                              PID:2908
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3380 --field-trial-handle=1188,i,16833306507058622173,16929499044546179951,131072 /prefetch:1
                              2⤵
                                PID:2192
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3712 --field-trial-handle=1188,i,16833306507058622173,16929499044546179951,131072 /prefetch:8
                                2⤵
                                  PID:1332
                              • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                1⤵
                                  PID:1616

                                Network

                                MITRE ATT&CK Enterprise v15

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

                                  Filesize

                                  264KB

                                  MD5

                                  f50f89a0a91564d0b8a211f8921aa7de

                                  SHA1

                                  112403a17dd69d5b9018b8cede023cb3b54eab7d

                                  SHA256

                                  b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                                  SHA512

                                  bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp

                                  Filesize

                                  16B

                                  MD5

                                  18e723571b00fb1694a3bad6c78e4054

                                  SHA1

                                  afcc0ef32d46fe59e0483f9a3c891d3034d12f32

                                  SHA256

                                  8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

                                  SHA512

                                  43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

                                • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

                                  Filesize

                                  20KB

                                  MD5

                                  53005255fc88be3e88ccfc7deab2541d

                                  SHA1

                                  83b61e816985c67310db315d64df5c1b462461c6

                                  SHA256

                                  9fda6a6b9660c2de9df2116a5bbfb6806614649e1accba7f3511d506b1ba5f74

                                  SHA512

                                  7d9aa8661733017310182eb1d9494a1c87792a72b1353d24f384912b6870381f19de28a53893d97b35347ae35ec8123d21f02a416280bda14399fd2f5c8d1197

                                • memory/1104-32-0x0000000072A1D000-0x0000000072A28000-memory.dmp

                                  Filesize

                                  44KB

                                • memory/1104-28-0x000000005FFF0000-0x0000000060000000-memory.dmp

                                  Filesize

                                  64KB

                                • memory/1104-29-0x0000000072A1D000-0x0000000072A28000-memory.dmp

                                  Filesize

                                  44KB

                                • memory/1104-31-0x000000005FFF0000-0x0000000060000000-memory.dmp

                                  Filesize

                                  64KB

                                • memory/2756-5-0x000000013F280000-0x000000013F65F000-memory.dmp

                                  Filesize

                                  3.9MB

                                • memory/2756-0-0x000000013F280000-0x000000013F65F000-memory.dmp

                                  Filesize

                                  3.9MB

                                • memory/2768-25-0x000007FEF5C00000-0x000007FEF5EB4000-memory.dmp

                                  Filesize

                                  2.7MB

                                • memory/2768-27-0x000007FEF3B30000-0x000007FEF3C42000-memory.dmp

                                  Filesize

                                  1.1MB

                                • memory/2768-26-0x000007FEF4170000-0x000007FEF521B000-memory.dmp

                                  Filesize

                                  16.7MB

                                • memory/2768-24-0x000007FEFB200000-0x000007FEFB234000-memory.dmp

                                  Filesize

                                  208KB

                                • memory/2768-23-0x000000013FC30000-0x000000013FD28000-memory.dmp

                                  Filesize

                                  992KB

                                • memory/3044-33-0x000000002F291000-0x000000002F292000-memory.dmp

                                  Filesize

                                  4KB

                                • memory/3044-34-0x000000005FFF0000-0x0000000060000000-memory.dmp

                                  Filesize

                                  64KB

                                • memory/3044-35-0x000000007179D000-0x00000000717A8000-memory.dmp

                                  Filesize

                                  44KB

                                • memory/3044-72-0x000000007179D000-0x00000000717A8000-memory.dmp

                                  Filesize

                                  44KB