Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    140s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/03/2024, 07:10

General

  • Target

    bad4f3cea7de3de5fc1361cfb846186d.exe

  • Size

    108KB

  • MD5

    bad4f3cea7de3de5fc1361cfb846186d

  • SHA1

    92082be4f46f2bc85466e0fe1c924aa40d586184

  • SHA256

    53ad98d938e17f0470b0e847e36084df7361ae2e89b3cb568456f479a9fd7b46

  • SHA512

    982ccfeaabc429b7eb9ea7b6e98d0ce15f9c918e08c190708b1db7830901a5a5b183a2362ce500f28d3719cf67390cd3381cb2e55fc4b9bdf19b4239cd540ae2

  • SSDEEP

    3072:f91DQEsGNeqSda6Pn/yHirTyk51i7uA848rCeNwn/W:l4Q3SdaU/yCnJ51CuAMWeK

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 42 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 40 IoCs
  • Suspicious use of SetWindowsHookEx 20 IoCs
  • Suspicious use of WriteProcessMemory 44 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\bad4f3cea7de3de5fc1361cfb846186d.exe
    "C:\Users\Admin\AppData\Local\Temp\bad4f3cea7de3de5fc1361cfb846186d.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious use of WriteProcessMemory
    PID:924
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\\delmeexe.bat
      2⤵
        PID:3080
    • C:\Windows\SysWOW64\360safe.exe
      C:\Windows\SysWOW64\360safe.exe
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3496
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:3176
        • C:\Program Files\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
          3⤵
          • Drops file in System32 directory
          • Modifies data under HKEY_USERS
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:5976
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5976 CREDAT:17410 /prefetch:2
            4⤵
            • Drops file in System32 directory
            • Modifies data under HKEY_USERS
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:5536
            • C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\BHO\ie_to_edge_stub.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\BHO\ie_to_edge_stub.exe" --from-ie-to-edge=3 --ie-frame-hwnd=100b0
              5⤵
              • Modifies data under HKEY_USERS
              • Suspicious use of WriteProcessMemory
              PID:432
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --from-ie-to-edge=3 --ie-frame-hwnd=100b0
                6⤵
                • Modifies data under HKEY_USERS
                PID:1768
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5976 CREDAT:82948 /prefetch:2
            4⤵
            • Modifies data under HKEY_USERS
            • Suspicious use of SetWindowsHookEx
            PID:4368
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5976 CREDAT:82952 /prefetch:2
            4⤵
            • Modifies data under HKEY_USERS
            • Suspicious use of SetWindowsHookEx
            PID:4424
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5976 CREDAT:82956 /prefetch:2
            4⤵
            • Suspicious use of SetWindowsHookEx
            PID:3936
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2420
        • C:\Program Files\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
          3⤵
            PID:712
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:3128
          • C:\Program Files\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
            3⤵
              PID:5612
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:5564
            • C:\Program Files\Internet Explorer\IEXPLORE.EXE
              "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
              3⤵
                PID:4628
            • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
              "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:3120
              • C:\Program Files\Internet Explorer\IEXPLORE.EXE
                "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
                3⤵
                  PID:3124
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3996 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:8
              1⤵
                PID:4652

              Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Temp\delmeexe.bat

                Filesize

                217B

                MD5

                249767ee3d236141012785fe03f1bf30

                SHA1

                bda391d5dfeea02b99264305ff195ab4178bb63b

                SHA256

                15397dbd1ec335d627be06649cc0240bc51992e0c01bd7f887e7bf310d9eef23

                SHA512

                064bd22799f261a59a0f57eb4e6421538bb34cc8b1d6e2bb8e06e39e2795891b8359e195808dd5889e6ee7c0364197418b2212564dcd741597205bcf8622fa03

              • C:\Windows\SysWOW64\360safe.exe

                Filesize

                108KB

                MD5

                bad4f3cea7de3de5fc1361cfb846186d

                SHA1

                92082be4f46f2bc85466e0fe1c924aa40d586184

                SHA256

                53ad98d938e17f0470b0e847e36084df7361ae2e89b3cb568456f479a9fd7b46

                SHA512

                982ccfeaabc429b7eb9ea7b6e98d0ce15f9c918e08c190708b1db7830901a5a5b183a2362ce500f28d3719cf67390cd3381cb2e55fc4b9bdf19b4239cd540ae2

              • C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

                Filesize

                4KB

                MD5

                da597791be3b6e732f0bc8b20e38ee62

                SHA1

                1125c45d285c360542027d7554a5c442288974de

                SHA256

                5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

                SHA512

                d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

              • C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\suggestions[1].en-US

                Filesize

                17KB

                MD5

                5a34cb996293fde2cb7a4ac89587393a

                SHA1

                3c96c993500690d1a77873cd62bc639b3a10653f

                SHA256

                c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

                SHA512

                e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

              • C:\Windows\System32\config\systemprofile\Favorites\desktop.ini

                Filesize

                402B

                MD5

                881dfac93652edb0a8228029ba92d0f5

                SHA1

                5b317253a63fecb167bf07befa05c5ed09c4ccea

                SHA256

                a45e345556901cd98b9bf8700b2a263f1da2b2e53dbdf69b9e6cfab6e0bd3464

                SHA512

                592b24deb837d6b82c692da781b8a69d9fa20bbaa3041d6c651839e72f45ac075a86cb967ea2df08fa0635ae28d6064a900f5d15180b9037bb8ba02f9e8e1810

              • C:\Windows\Temp\Kno624F.tmp

                Filesize

                88KB

                MD5

                002d5646771d31d1e7c57990cc020150

                SHA1

                a28ec731f9106c252f313cca349a68ef94ee3de9

                SHA256

                1e2e25bf730ff20c89d57aa38f7f34be7690820e8279b20127d0014dd27b743f

                SHA512

                689e90e7d83eef054a168b98ba2b8d05ab6ff8564e199d4089215ad3fe33440908e687aa9ad7d94468f9f57a4cc19842d53a9cd2f17758bdadf0503df63629c6

              • memory/924-0-0x0000000000400000-0x000000000045C000-memory.dmp

                Filesize

                368KB

              • memory/924-1-0x0000000000400000-0x000000000045C000-memory.dmp

                Filesize

                368KB

              • memory/924-2-0x0000000000400000-0x000000000045C000-memory.dmp

                Filesize

                368KB

              • memory/924-12-0x0000000000400000-0x000000000045C000-memory.dmp

                Filesize

                368KB

              • memory/3496-7-0x0000000000400000-0x000000000045C000-memory.dmp

                Filesize

                368KB

              • memory/3496-57-0x0000000000400000-0x000000000045C000-memory.dmp

                Filesize

                368KB