Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    29s
  • max time network
    31s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240221-en
  • resource tags

    arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    13/03/2024, 13:54

General

  • Target

    SanPalia.rar

  • Size

    13.5MB

  • MD5

    8dc3bc3df356e6b51e997077cfc8511d

  • SHA1

    7f7b5abaaaa97cb38608f0f55f9ca73f7a17d3a7

  • SHA256

    6d60a343e620d09bfdaa13decec24708d1c7cb2b315d2c45c223844140aae1d0

  • SHA512

    599689e6cd5ad5e7863f802ceaaaa60a65a6eaf0e6156f59905ec17e43707e4e6116d3928a398103eba4a5d84fc03d886cf2944dbe525ad681cd0cec25cfe0b2

  • SSDEEP

    196608:eymlyTWBnqP1jn/IYe0h8IFHSX0CXJwYgyEdvJs4S4H/i8Jz9JVaiRRy3Y7li9IY:eyYy6nqNjIZ040CXJwAQJsfWJhJVY3N7

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Unexpected DNS network traffic destination 1 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\SanPalia.rar
    1⤵
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2016
    • C:\Program Files\7-Zip\7zFM.exe
      "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\SanPalia.rar"
      2⤵
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:5024
      • C:\Users\Admin\AppData\Local\Temp\7zO0A3AB0A7\SanPaliaSetup.exe
        "C:\Users\Admin\AppData\Local\Temp\7zO0A3AB0A7\SanPaliaSetup.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:2832
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "chcp"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2148
          • C:\Windows\system32\chcp.com
            chcp
            5⤵
              PID:5052
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -c "Add-Type -Name Window -Namespace Console -MemberDefinition ' [DllImport(\"Kernel32.dll\")] public static extern IntPtr GetConsoleWindow(); [DllImport(\"user32.dll\")] public static extern bool ShowWindow(IntPtr hWnd, Int32 nCmdShow); ' $consolePtr = [Console.Window]::GetConsoleWindow() #0 hide [Console.Window]::ShowWindow($consolePtr, 0) "
            4⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:4840
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
              "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\x45txilg\x45txilg.cmdline"
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:2508
              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC8CE.tmp" "c:\Users\Admin\AppData\Local\Temp\x45txilg\CSC9317C658EA6F4830BE29A69EA5FD2A0.TMP"
                6⤵
                  PID:2364
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /d /s /c ""undefined\VBoxManage.exe" list vms --long"
              4⤵
                PID:4832
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                4⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:1916
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                4⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:2136
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                4⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:3744

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

          Filesize

          2KB

          MD5

          5f4c933102a824f41e258078e34165a7

          SHA1

          d2f9e997b2465d3ae7d91dad8d99b77a2332b6ee

          SHA256

          d69b7d84970cb04cd069299fd8aa9cef8394999588bead979104dc3cb743b4f2

          SHA512

          a7556b2be1a69dbc1f7ff4c1c25581a28cb885c7e1116632c535fee5facaa99067bcead8f02499980f1d999810157d0fc2f9e45c200dee7d379907ef98a6f034

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

          Filesize

          1KB

          MD5

          0254494a4c89bf8f623066957ccb7ea1

          SHA1

          0a31bf0f80c2e5caaf36fdf4266b72379cfb3751

          SHA256

          ffda9233d24b63e14924cddc16d3885111c7cf09abe840547c0a266c2000687f

          SHA512

          8f8c04122ae09f4a544d482eb72c30fc6d1ae9840e4247eb9e7a5cbe6e912fbff9132afc78974509923c24c30a8049199d43d83aba49b8a66ab78316546673bb

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

          Filesize

          1KB

          MD5

          c0eb9583ac0a313eb0a02b0ece142516

          SHA1

          4d883d8abc27ab41547fc596c57afa884e15b10b

          SHA256

          927a46a6722835eab810935b74fa7f2bff7a63da27096258f780d10832dde34d

          SHA512

          c821d092c5ed9aa739046f39a5956d3f60e7f2d4454e7cff00d564d1ee572dca8814aa9c672f8f17ce10f1976405e79e3b7625ab74dd585ab32c3f93d8159643

        • C:\Users\Admin\AppData\Local\Temp\7zO0A3AB0A7\SanPaliaSetup.exe

          Filesize

          19.0MB

          MD5

          aa36bb0fd148e140a0e9b229b6820f7c

          SHA1

          2a2e8ed1445b1de8fa8484007b0099bbccff1048

          SHA256

          38e3ba029fdc0ecfea36cbc94fbe079bc82fc750e3171f0593337c89a442f48b

          SHA512

          7e9abd573e960d9617c82751738bd078d74c25c237a0394de73a8b1b5e37029382d6ce6a42615ba537db402a4e3eb639b03adc9741993440f0f6909bdc7e6ee9

        • C:\Users\Admin\AppData\Local\Temp\7zO0A3AB0A7\SanPaliaSetup.exe

          Filesize

          15.5MB

          MD5

          c33cf464bbe1f4c140b7a80c4c823a2a

          SHA1

          d98b15369166d8f1e265b724cbba1ce57e167c96

          SHA256

          5aa705b7d28dae8d30a9059ecef39dabeea0696d2ae0aa6321f4c42d03d92fd3

          SHA512

          885af1d2e80151cbe0d539f9e67b9b993cd57b048f744ac0ef40762e66184e1e58b6884db394b434bf945c8e311567f95caa497a1c54fc46801c5be78afc6b2e

        • C:\Users\Admin\AppData\Local\Temp\7zO0A3AB0A7\SanPaliaSetup.exe

          Filesize

          13.1MB

          MD5

          ed02a9531aca8ae9b6852972d6660fd7

          SHA1

          a5d5ed101f937e59801d40f595ec35c162c63740

          SHA256

          bc89da234215c71e8cd90643e0742b838f2884ee254831f05d6627667c32ce9f

          SHA512

          a8578892b49d0518e66625c387e9bb57b0d5df4811f86338c8c490d333af7643ebf2c2de0c971b8e3eff7d77775bcfd3697ff9b9c8a5e0d4fb04518c0f4dc136

        • C:\Users\Admin\AppData\Local\Temp\RESC8CE.tmp

          Filesize

          1KB

          MD5

          4bee70c0f6866479d0f61d8c37d66248

          SHA1

          f02ff03360e0dfa18ab421946ddb8cec805954ec

          SHA256

          b2819b19c01a791c4d799b6c5c794917b6a4ea62f4cf4c925325fa08a626c43a

          SHA512

          cea1e07862e31f89aa6133de6063c7ab103f98dc8bd881d5f6bb7b401709ad6653a6a0adfe0401a961b5cea6d8060d0fc350ca528075b51c3a7a2656500e9274

        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bnoniqvd.zfc.ps1

          Filesize

          60B

          MD5

          d17fe0a3f47be24a6453e9ef58c94641

          SHA1

          6ab83620379fc69f80c0242105ddffd7d98d5d9d

          SHA256

          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

          SHA512

          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

        • C:\Users\Admin\AppData\Local\Temp\x45txilg\x45txilg.dll

          Filesize

          3KB

          MD5

          88a9a600777109cfcbdb687a22c03a23

          SHA1

          7f3839f1685203b8b89f363d9b87ad2208f43cd9

          SHA256

          4760c7ea4735aab1119fd90c66c14c21e5dbba071014a619c00a3d7f525266e9

          SHA512

          98e62c0dbb8c24c60597a6e8f8324e2442727bc159d483b3b08e16c5245c282525364fe52c79ae202f44284e130fb366b48fa82719ef435042247aa04af611ad

        • \??\c:\Users\Admin\AppData\Local\Temp\x45txilg\CSC9317C658EA6F4830BE29A69EA5FD2A0.TMP

          Filesize

          652B

          MD5

          adb1270c9bc75688f0dbc611067c3668

          SHA1

          5d06ede5ce8e703d6638f1530a5cf6f0e9d24a17

          SHA256

          cb7dddb3a122cf6e83f03b517780cdb94909dfe5fb7177d85007b5dd75457030

          SHA512

          9c740482596165f507214fb438969e7cca404ea7af3c44e162b31ce9475bff8d3284f6d7c44b2645be31b07719ccd92da44cb4a8b71de8524b66f83e67fa2bee

        • \??\c:\Users\Admin\AppData\Local\Temp\x45txilg\x45txilg.0.cs

          Filesize

          312B

          MD5

          ecbf151f81ff98f7dff196304a40239e

          SHA1

          ccf6b97b6f8276656b042d64f0595963fe9ec79c

          SHA256

          295ca195631c485c876e7c468ddcbb3fe7cd219d3e5005a2441be2de54e62ac8

          SHA512

          4526a59055a18af6c0c13fb9f55a9a9bc15aa1407b697849e19b6cc32c88ee7206b3efff806bd154d36bce144ae1d9c407c6ea0f5077c54fbe92cd172c203720

        • \??\c:\Users\Admin\AppData\Local\Temp\x45txilg\x45txilg.cmdline

          Filesize

          369B

          MD5

          88b1d5af6260e9242f61eabacbe23636

          SHA1

          bcd7e1f9609d37ab108eff67daa3c5dc30cd28f5

          SHA256

          19176023022c03c9ccdfcab748fb1f6621c668a9d7012f35783bb2a111152060

          SHA512

          98544f559150f7b9ee3304e258d28afb1ab96d6a7be17e49b0aeb5c2d663e5e3cc1c951eae9fe05976e9d5713528d34968020a6d3f3c44228001255600c36a65

        • memory/1916-29-0x0000027BBD320000-0x0000027BBD330000-memory.dmp

          Filesize

          64KB

        • memory/1916-43-0x0000027BBD520000-0x0000027BBD566000-memory.dmp

          Filesize

          280KB

        • memory/1916-67-0x00007FF992340000-0x00007FF992E02000-memory.dmp

          Filesize

          10.8MB

        • memory/1916-35-0x0000027BBD320000-0x0000027BBD330000-memory.dmp

          Filesize

          64KB

        • memory/1916-58-0x0000027BBD770000-0x0000027BBD794000-memory.dmp

          Filesize

          144KB

        • memory/1916-57-0x0000027BBD770000-0x0000027BBD79A000-memory.dmp

          Filesize

          168KB

        • memory/1916-26-0x00007FF992340000-0x00007FF992E02000-memory.dmp

          Filesize

          10.8MB

        • memory/2136-69-0x00007FF992340000-0x00007FF992E02000-memory.dmp

          Filesize

          10.8MB

        • memory/2136-71-0x000001D43DFE0000-0x000001D43DFF0000-memory.dmp

          Filesize

          64KB

        • memory/2136-84-0x00007FF992340000-0x00007FF992E02000-memory.dmp

          Filesize

          10.8MB

        • memory/2136-70-0x000001D43DFE0000-0x000001D43DFF0000-memory.dmp

          Filesize

          64KB

        • memory/3744-86-0x00007FF992340000-0x00007FF992E02000-memory.dmp

          Filesize

          10.8MB

        • memory/3744-87-0x00000250FCA60000-0x00000250FCA70000-memory.dmp

          Filesize

          64KB

        • memory/3744-88-0x00000250FCA60000-0x00000250FCA70000-memory.dmp

          Filesize

          64KB

        • memory/3744-98-0x00000250FCA60000-0x00000250FCA70000-memory.dmp

          Filesize

          64KB

        • memory/3744-102-0x00007FF992340000-0x00007FF992E02000-memory.dmp

          Filesize

          10.8MB

        • memory/4840-25-0x000001C3FC4C0000-0x000001C3FC4E2000-memory.dmp

          Filesize

          136KB

        • memory/4840-39-0x00007FF992340000-0x00007FF992E02000-memory.dmp

          Filesize

          10.8MB

        • memory/4840-40-0x000001C3FBD50000-0x000001C3FBD60000-memory.dmp

          Filesize

          64KB

        • memory/4840-28-0x000001C3FBD50000-0x000001C3FBD60000-memory.dmp

          Filesize

          64KB

        • memory/4840-62-0x00007FF992340000-0x00007FF992E02000-memory.dmp

          Filesize

          10.8MB

        • memory/4840-55-0x000001C3FC4B0000-0x000001C3FC4B8000-memory.dmp

          Filesize

          32KB

        • memory/4840-27-0x000001C3FBD50000-0x000001C3FBD60000-memory.dmp

          Filesize

          64KB