Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

05/03/2024, 17:59

240305-wk7jesda7v 7

05/03/2024, 17:57

240305-wjrrksea33 7

Analysis

  • max time kernel
    85s
  • max time network
    88s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/03/2024, 17:57

General

  • Target

    CS2 Bhop_[unknowncheats.me]_.exe

  • Size

    444KB

  • MD5

    ddfda1f4f000dd283aeacf61bbf09e94

  • SHA1

    dece52d7bcb5b25c216fc5b5edd66a80c2cac1e5

  • SHA256

    543a201d0a4ab2e487db61022719c3ccb74054c42f851b1582f41b2146c8ffa2

  • SHA512

    7a5f0cf34b84fec3774be35ea2f9f6e14414da692c6d8c66c7cf7be2d80a4243e058c488b74b7b7be0fb6bfa434d50f8e6a8e3ad45cba47c1309a554b6535c9e

  • SSDEEP

    12288:ofsVoCyy14HcQCOLD/JsShH2gTy88V9ibL:o0VoCdkcQhbF7yg

Score
7/10
upx

Malware Config

Signatures

  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • AutoIT Executable 4 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops autorun.inf file 1 TTPs 1 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in Windows directory 64 IoCs
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\CS2 Bhop_[unknowncheats.me]_.exe
    "C:\Users\Admin\AppData\Local\Temp\CS2 Bhop_[unknowncheats.me]_.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    PID:3504
  • C:\Windows\system32\taskmgr.exe
    "C:\Windows\system32\taskmgr.exe" /4
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:4588
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2016
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaeae546f8,0x7ffaeae54708,0x7ffaeae54718
      2⤵
        PID:1156
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,12904073445041192337,4686067208016480126,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
        2⤵
          PID:4376
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,12904073445041192337,4686067208016480126,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:776
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,12904073445041192337,4686067208016480126,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2860 /prefetch:8
          2⤵
            PID:2320
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,12904073445041192337,4686067208016480126,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
            2⤵
              PID:4212
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,12904073445041192337,4686067208016480126,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
              2⤵
                PID:1084
            • C:\Windows\System32\CompPkgSrv.exe
              C:\Windows\System32\CompPkgSrv.exe -Embedding
              1⤵
                PID:4012
              • C:\Windows\System32\CompPkgSrv.exe
                C:\Windows\System32\CompPkgSrv.exe -Embedding
                1⤵
                  PID:2492
                • C:\Windows\system32\taskmgr.exe
                  "C:\Windows\system32\taskmgr.exe" /4
                  1⤵
                  • Checks SCSI registry key(s)
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3900
                • C:\Windows\system32\cmd.exe
                  "C:\Windows\system32\cmd.exe"
                  1⤵
                  • Drops autorun.inf file
                  • Drops file in Windows directory
                  PID:3508

                Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

                  Filesize

                  64KB

                  MD5

                  d2fb266b97caff2086bf0fa74eddb6b2

                  SHA1

                  2f0061ce9c51b5b4fbab76b37fc6a540be7f805d

                  SHA256

                  b09f68b61d9ff5a7c7c8b10eee9447d4813ee0e866346e629e788cd4adecb66a

                  SHA512

                  c3ba95a538c1d266beb83334af755c34ce642a4178ab0f2e5f7822fd6821d3b68862a8b58f167a9294e6d913b08c1054a69b5d7aec2efdb3cf9796ed84de21a8

                • C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

                  Filesize

                  4B

                  MD5

                  f49655f856acb8884cc0ace29216f511

                  SHA1

                  cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

                  SHA256

                  7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

                  SHA512

                  599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

                • C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

                  Filesize

                  944B

                  MD5

                  6bd369f7c74a28194c991ed1404da30f

                  SHA1

                  0f8e3f8ab822c9374409fe399b6bfe5d68cbd643

                  SHA256

                  878947d0ec814fe7c343cdebc05eebf00eb14f3023bdb3809a559e17f399fe5d

                  SHA512

                  8fc5f073dc9fa1e1ae47c60a5f06e0a48709fd6a4302dffaa721858409e7bde64bc6856d3fb28891090516d1a7afc542579de287778b5755eafe75cc67d45d93

                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                  Filesize

                  152B

                  MD5

                  279e783b0129b64a8529800a88fbf1ee

                  SHA1

                  204c62ec8cef8467e5729cad52adae293178744f

                  SHA256

                  3619c3b82a8cbdce37bfd88b66d4fdfcd728a1112b05eb26998bea527d187932

                  SHA512

                  32730d9124dd28c196bd4abcfd6a283a04553f3f6b050c057264bc883783d30d6602781137762e66e1f90847724d0e994bddf6e729de11a809f263f139023d3b

                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                  Filesize

                  152B

                  MD5

                  cbec32729772aa6c576e97df4fef48f5

                  SHA1

                  6ec173d5313f27ba1e46ad66c7bbe7c0a9767dba

                  SHA256

                  d34331aa91a21e127bbe68f55c4c1898c429d9d43545c3253d317ffb105aa24e

                  SHA512

                  425b3638fed70da3bc16bba8b9878de528aca98669203f39473b931f487a614d3f66073b8c3d9bc2211e152b4bbdeceb2777001467954eec491f862912f3c7a0

                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                  Filesize

                  6KB

                  MD5

                  af2dd2d0e1ce68c51e3186c0888e9a0c

                  SHA1

                  e7ac92d9a2daafa491550916098db8c460a5ab26

                  SHA256

                  377a870b5134f4fd994c3382185d1aeb6d9112433503c027123ac467edf5a5bf

                  SHA512

                  77606d626047aebb991838ba64784c35452499dab14571b3fe8a46028150274fab45d34c55e91aea58297aed79a6ddc1dbc5c75f805f535258f8ff74e61633eb

                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                  Filesize

                  6KB

                  MD5

                  5c1380517ca9adff804814efaf720fc4

                  SHA1

                  38a640a61b2152e7c232a008115baac50fbd9fdd

                  SHA256

                  408d8bca3a869b32ffcc86a17ed7cd3f01f8a605cb867f71c0e32fd4fafa8cac

                  SHA512

                  a7f122ef4f2f5adb6dfb41884ec6098c77841a8e5204da2819f6594613ea312179f6ff29ee8aede90022aca28f5e9c98f53f59e6d50599afaebfa4721ee6a242

                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                  Filesize

                  11KB

                  MD5

                  6cfb2ef96a19b339aa788c1be9f1c45b

                  SHA1

                  373ae16b4cd9b5a61992efed60539f19890f0ab3

                  SHA256

                  297319f9e6789d0d5add63581ffdaa28e2c0870e1ebcdbeedb0c2004dcaae881

                  SHA512

                  f5cab8f35f63ee8c515501946704422258221947b0796781f1fcb605752188b48529e72bddd86c57672ea9b726dc9036fa82ca8230e58b794cac14f9a0db324e

                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

                  Filesize

                  264KB

                  MD5

                  f50f89a0a91564d0b8a211f8921aa7de

                  SHA1

                  112403a17dd69d5b9018b8cede023cb3b54eab7d

                  SHA256

                  b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                  SHA512

                  bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                • memory/3504-108-0x00007FF7B2500000-0x00007FF7B260B000-memory.dmp

                  Filesize

                  1.0MB

                • memory/3504-0-0x00007FF7B2500000-0x00007FF7B260B000-memory.dmp

                  Filesize

                  1.0MB

                • memory/3504-14-0x00007FF7B2500000-0x00007FF7B260B000-memory.dmp

                  Filesize

                  1.0MB

                • memory/3504-16-0x00007FF7B2500000-0x00007FF7B260B000-memory.dmp

                  Filesize

                  1.0MB

                • memory/3504-125-0x00007FF7B2500000-0x00007FF7B260B000-memory.dmp

                  Filesize

                  1.0MB

                • memory/3900-123-0x00000193303D0000-0x00000193303D1000-memory.dmp

                  Filesize

                  4KB

                • memory/3900-122-0x00000193303D0000-0x00000193303D1000-memory.dmp

                  Filesize

                  4KB

                • memory/3900-118-0x00000193303D0000-0x00000193303D1000-memory.dmp

                  Filesize

                  4KB

                • memory/3900-119-0x00000193303D0000-0x00000193303D1000-memory.dmp

                  Filesize

                  4KB

                • memory/3900-120-0x00000193303D0000-0x00000193303D1000-memory.dmp

                  Filesize

                  4KB

                • memory/3900-121-0x00000193303D0000-0x00000193303D1000-memory.dmp

                  Filesize

                  4KB

                • memory/3900-111-0x00000193303D0000-0x00000193303D1000-memory.dmp

                  Filesize

                  4KB

                • memory/3900-112-0x00000193303D0000-0x00000193303D1000-memory.dmp

                  Filesize

                  4KB

                • memory/3900-113-0x00000193303D0000-0x00000193303D1000-memory.dmp

                  Filesize

                  4KB

                • memory/4588-9-0x0000015793090000-0x0000015793091000-memory.dmp

                  Filesize

                  4KB

                • memory/4588-8-0x0000015793090000-0x0000015793091000-memory.dmp

                  Filesize

                  4KB

                • memory/4588-13-0x0000015793090000-0x0000015793091000-memory.dmp

                  Filesize

                  4KB

                • memory/4588-10-0x0000015793090000-0x0000015793091000-memory.dmp

                  Filesize

                  4KB

                • memory/4588-11-0x0000015793090000-0x0000015793091000-memory.dmp

                  Filesize

                  4KB

                • memory/4588-12-0x0000015793090000-0x0000015793091000-memory.dmp

                  Filesize

                  4KB

                • memory/4588-7-0x0000015793090000-0x0000015793091000-memory.dmp

                  Filesize

                  4KB

                • memory/4588-3-0x0000015793090000-0x0000015793091000-memory.dmp

                  Filesize

                  4KB

                • memory/4588-2-0x0000015793090000-0x0000015793091000-memory.dmp

                  Filesize

                  4KB

                • memory/4588-1-0x0000015793090000-0x0000015793091000-memory.dmp

                  Filesize

                  4KB