Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    186s
  • max time network
    196s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/03/2024, 11:58

General

  • Target

    be8cfc2526efcc21da279e97faac0ccd.exe

  • Size

    1.8MB

  • MD5

    be8cfc2526efcc21da279e97faac0ccd

  • SHA1

    cde7dc54797056c2afcb852fa178db49fa529657

  • SHA256

    5557bc2b4439f7e348cc30dfab22714f051296d8906691256d1280715cb40825

  • SHA512

    5951360882c7790700d6907dc9915f181f9446538cb44c03a59f0cf45b53d85a1ad05293b4b4c24c59771fe73fb6f1e0134968c640db8db3f610da3fe1f00bed

  • SSDEEP

    49152:RMumM6xRN9GfpB9EbWMVjHg9/chd/ww1vQr/wi6LfUwRD:qZRSfprEW/0zisLtRD

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 6 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 26 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\be8cfc2526efcc21da279e97faac0ccd.exe
    "C:\Users\Admin\AppData\Local\Temp\be8cfc2526efcc21da279e97faac0ccd.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2140
    • C:\Users\Admin\AppData\Roaming\mang2\ddqjh_wqeqd.exe
      "C:\Users\Admin\AppData\Roaming\mang2\ddqjh_wqeqd.exe" /setupsucc
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Writes to the Master Boot Record (MBR)
      • Suspicious behavior: EnumeratesProcesses
      PID:3260

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nse34F8.tmp\FindProcDLL.dll

    Filesize

    3KB

    MD5

    8614c450637267afacad1645e23ba24a

    SHA1

    e7b7b09b5bbc13e910aa36316d9cc5fc5d4dcdc2

    SHA256

    0fa04f06a6de18d316832086891e9c23ae606d7784d5d5676385839b21ca2758

    SHA512

    af46cd679097584ff9a1d894a729b6397f4b3af17dff3e6f07bef257bc7e48ffa341d82daf298616cd5df1450fc5ab7435cacb70f27302b6db193f01a9f8391b

  • C:\Users\Admin\AppData\Local\Temp\nse34F8.tmp\System.dll

    Filesize

    10KB

    MD5

    56a321bd011112ec5d8a32b2f6fd3231

    SHA1

    df20e3a35a1636de64df5290ae5e4e7572447f78

    SHA256

    bb6df93369b498eaa638b0bcdc4bb89f45e9b02ca12d28bcedf4629ea7f5e0f1

    SHA512

    5354890cbc53ce51081a78c64ba9c4c8c4dc9e01141798c1e916e19c5776dac7c82989fad0f08c73e81aaba332dad81205f90d0663119af45550b97b338b9cc3

  • C:\Users\Admin\AppData\Roaming\mang2\config.dll

    Filesize

    1.6MB

    MD5

    86d6bdfc762e0eb60606d8c227a9a50b

    SHA1

    0eb0f7cbceed4ba18be76108be2480693cb94d0c

    SHA256

    09a6579d86a8d7627229e336f846cfc71f5d76f0c5be92ee4125be719f659530

    SHA512

    4e83cf8ac1bd38058dd0d45e09282edf284f98639c7e25f70e69a3ac8686c585dfde6389ddb2c6617b0d102d6f9845817b565593ab61b8ff91c733aafe7b11a5

  • C:\Users\Admin\AppData\Roaming\mang2\config.ini

    Filesize

    363B

    MD5

    917ec9d7b3a7a0ad3e2ba8ef7e1c6668

    SHA1

    abed79adcd3a1e3db705fb2bdc6eddafb5f06e22

    SHA256

    d3897767261d7bdf9b3044189d66f2d554792d59650d12c46b3423e179e34c38

    SHA512

    3e07438e858b100e7255a8926927ea8cd716777e4f76a197c3c204982652b8ef8a1e69f2c804ed0dfea27f62ce4e96b8bd7b5ff2849bde25a0b22b9648680552

  • C:\Users\Admin\AppData\Roaming\mang2\config.ini

    Filesize

    414B

    MD5

    fafd2f3bc4855c1ab5f2f32cac1a8ffe

    SHA1

    abfcdedbca4af008ff1441244783001edca4812e

    SHA256

    562ec99a5273e0bae5a73571d4d9a23df676876b1ac70fcc76a814a96b4610e3

    SHA512

    0b808ac32a581fa47ec55a9ad5fb82d307836a0471060e270dabdc8ccb12e1cc9c5161d5d8fee20c119871c503ac958c8b151df1a32cd76ab67ed7edca14cb2a

  • C:\Users\Admin\AppData\Roaming\mang2\ddqjh_wqeqd.exe

    Filesize

    31KB

    MD5

    c35a26f177a905feb02adbb2d7db5c00

    SHA1

    70f5a756fa020fedad901014206f4069cdd024c3

    SHA256

    362a34664946a5fe654fe5f3286392d88c256962a1a0dc4342dc4fd0db47f299

    SHA512

    79c62acc778f131ae4ab070c309a4452c2d84b22b06ca499e5bf158a80aff20f0c1fcbb810374f8c1b9b8314aecc52f7818e7a241d354c0675ac2e73e8c233c1

  • memory/2140-17-0x0000000000000078-0x0000000000000EE9-memory.dmp

    Filesize

    3KB

  • memory/2140-16-0x0000000002300000-0x0000000002303000-memory.dmp

    Filesize

    12KB

  • memory/2140-45-0x0000000002300000-0x0000000002303000-memory.dmp

    Filesize

    12KB

  • memory/2140-46-0x0000000000000078-0x0000000000000EE9-memory.dmp

    Filesize

    3KB

  • memory/2140-15-0x0000000002300000-0x0000000002303000-memory.dmp

    Filesize

    12KB

  • memory/2140-52-0x0000000000000078-0x0000000000000EE9-memory.dmp

    Filesize

    3KB

  • memory/2140-59-0x0000000000000078-0x0000000000000EE9-memory.dmp

    Filesize

    3KB