Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
29s -
max time network
31s -
platform
windows11-21h2_x64 -
resource
win11-20240221-en -
resource tags
arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system -
submitted
13/03/2024, 13:54
Static task
static1
Behavioral task
behavioral1
Sample
SanPalia.rar
Resource
win11-20240221-en
General
-
Target
SanPalia.rar
-
Size
13.5MB
-
MD5
8dc3bc3df356e6b51e997077cfc8511d
-
SHA1
7f7b5abaaaa97cb38608f0f55f9ca73f7a17d3a7
-
SHA256
6d60a343e620d09bfdaa13decec24708d1c7cb2b315d2c45c223844140aae1d0
-
SHA512
599689e6cd5ad5e7863f802ceaaaa60a65a6eaf0e6156f59905ec17e43707e4e6116d3928a398103eba4a5d84fc03d886cf2944dbe525ad681cd0cec25cfe0b2
-
SSDEEP
196608:eymlyTWBnqP1jn/IYe0h8IFHSX0CXJwYgyEdvJs4S4H/i8Jz9JVaiRRy3Y7li9IY:eyYy6nqNjIZ040CXJwAQJsfWJhJVY3N7
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2832 SanPaliaSetup.exe -
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 114.114.114.114 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-647252928-2816094679-1307623958-1000_Classes\Local Settings cmd.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4840 powershell.exe 1916 powershell.exe 4840 powershell.exe 1916 powershell.exe 2136 powershell.exe 2136 powershell.exe 3744 powershell.exe 3744 powershell.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 5024 7zFM.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeRestorePrivilege 5024 7zFM.exe Token: 35 5024 7zFM.exe Token: SeSecurityPrivilege 5024 7zFM.exe Token: SeDebugPrivilege 4840 powershell.exe Token: SeDebugPrivilege 1916 powershell.exe Token: SeIncreaseQuotaPrivilege 1916 powershell.exe Token: SeSecurityPrivilege 1916 powershell.exe Token: SeTakeOwnershipPrivilege 1916 powershell.exe Token: SeLoadDriverPrivilege 1916 powershell.exe Token: SeSystemProfilePrivilege 1916 powershell.exe Token: SeSystemtimePrivilege 1916 powershell.exe Token: SeProfSingleProcessPrivilege 1916 powershell.exe Token: SeIncBasePriorityPrivilege 1916 powershell.exe Token: SeCreatePagefilePrivilege 1916 powershell.exe Token: SeBackupPrivilege 1916 powershell.exe Token: SeRestorePrivilege 1916 powershell.exe Token: SeShutdownPrivilege 1916 powershell.exe Token: SeDebugPrivilege 1916 powershell.exe Token: SeSystemEnvironmentPrivilege 1916 powershell.exe Token: SeRemoteShutdownPrivilege 1916 powershell.exe Token: SeUndockPrivilege 1916 powershell.exe Token: SeManageVolumePrivilege 1916 powershell.exe Token: 33 1916 powershell.exe Token: 34 1916 powershell.exe Token: 35 1916 powershell.exe Token: 36 1916 powershell.exe Token: SeDebugPrivilege 2136 powershell.exe Token: SeIncreaseQuotaPrivilege 2136 powershell.exe Token: SeSecurityPrivilege 2136 powershell.exe Token: SeTakeOwnershipPrivilege 2136 powershell.exe Token: SeLoadDriverPrivilege 2136 powershell.exe Token: SeSystemProfilePrivilege 2136 powershell.exe Token: SeSystemtimePrivilege 2136 powershell.exe Token: SeProfSingleProcessPrivilege 2136 powershell.exe Token: SeIncBasePriorityPrivilege 2136 powershell.exe Token: SeCreatePagefilePrivilege 2136 powershell.exe Token: SeBackupPrivilege 2136 powershell.exe Token: SeRestorePrivilege 2136 powershell.exe Token: SeShutdownPrivilege 2136 powershell.exe Token: SeDebugPrivilege 2136 powershell.exe Token: SeSystemEnvironmentPrivilege 2136 powershell.exe Token: SeRemoteShutdownPrivilege 2136 powershell.exe Token: SeUndockPrivilege 2136 powershell.exe Token: SeManageVolumePrivilege 2136 powershell.exe Token: 33 2136 powershell.exe Token: 34 2136 powershell.exe Token: 35 2136 powershell.exe Token: 36 2136 powershell.exe Token: SeDebugPrivilege 3744 powershell.exe Token: SeIncreaseQuotaPrivilege 3744 powershell.exe Token: SeSecurityPrivilege 3744 powershell.exe Token: SeTakeOwnershipPrivilege 3744 powershell.exe Token: SeLoadDriverPrivilege 3744 powershell.exe Token: SeSystemProfilePrivilege 3744 powershell.exe Token: SeSystemtimePrivilege 3744 powershell.exe Token: SeProfSingleProcessPrivilege 3744 powershell.exe Token: SeIncBasePriorityPrivilege 3744 powershell.exe Token: SeCreatePagefilePrivilege 3744 powershell.exe Token: SeBackupPrivilege 3744 powershell.exe Token: SeRestorePrivilege 3744 powershell.exe Token: SeShutdownPrivilege 3744 powershell.exe Token: SeDebugPrivilege 3744 powershell.exe Token: SeSystemEnvironmentPrivilege 3744 powershell.exe Token: SeRemoteShutdownPrivilege 3744 powershell.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 5024 7zFM.exe 5024 7zFM.exe -
Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 2016 wrote to memory of 5024 2016 cmd.exe 83 PID 2016 wrote to memory of 5024 2016 cmd.exe 83 PID 5024 wrote to memory of 2832 5024 7zFM.exe 86 PID 5024 wrote to memory of 2832 5024 7zFM.exe 86 PID 2832 wrote to memory of 2148 2832 SanPaliaSetup.exe 88 PID 2832 wrote to memory of 2148 2832 SanPaliaSetup.exe 88 PID 2148 wrote to memory of 5052 2148 cmd.exe 90 PID 2148 wrote to memory of 5052 2148 cmd.exe 90 PID 2832 wrote to memory of 4840 2832 SanPaliaSetup.exe 91 PID 2832 wrote to memory of 4840 2832 SanPaliaSetup.exe 91 PID 2832 wrote to memory of 4832 2832 SanPaliaSetup.exe 92 PID 2832 wrote to memory of 4832 2832 SanPaliaSetup.exe 92 PID 2832 wrote to memory of 1916 2832 SanPaliaSetup.exe 93 PID 2832 wrote to memory of 1916 2832 SanPaliaSetup.exe 93 PID 4840 wrote to memory of 2508 4840 powershell.exe 95 PID 4840 wrote to memory of 2508 4840 powershell.exe 95 PID 2508 wrote to memory of 2364 2508 csc.exe 96 PID 2508 wrote to memory of 2364 2508 csc.exe 96 PID 2832 wrote to memory of 2136 2832 SanPaliaSetup.exe 98 PID 2832 wrote to memory of 2136 2832 SanPaliaSetup.exe 98 PID 2832 wrote to memory of 3744 2832 SanPaliaSetup.exe 101 PID 2832 wrote to memory of 3744 2832 SanPaliaSetup.exe 101
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\SanPalia.rar1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\SanPalia.rar"2⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Users\Admin\AppData\Local\Temp\7zO0A3AB0A7\SanPaliaSetup.exe"C:\Users\Admin\AppData\Local\Temp\7zO0A3AB0A7\SanPaliaSetup.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "chcp"4⤵
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Windows\system32\chcp.comchcp5⤵PID:5052
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -c "Add-Type -Name Window -Namespace Console -MemberDefinition ' [DllImport(\"Kernel32.dll\")] public static extern IntPtr GetConsoleWindow(); [DllImport(\"user32.dll\")] public static extern bool ShowWindow(IntPtr hWnd, Int32 nCmdShow); ' $consolePtr = [Console.Window]::GetConsoleWindow() #0 hide [Console.Window]::ShowWindow($consolePtr, 0) "4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\x45txilg\x45txilg.cmdline"5⤵
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC8CE.tmp" "c:\Users\Admin\AppData\Local\Temp\x45txilg\CSC9317C658EA6F4830BE29A69EA5FD2A0.TMP"6⤵PID:2364
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""undefined\VBoxManage.exe" list vms --long"4⤵PID:4832
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1916
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2136
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3744
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD55f4c933102a824f41e258078e34165a7
SHA1d2f9e997b2465d3ae7d91dad8d99b77a2332b6ee
SHA256d69b7d84970cb04cd069299fd8aa9cef8394999588bead979104dc3cb743b4f2
SHA512a7556b2be1a69dbc1f7ff4c1c25581a28cb885c7e1116632c535fee5facaa99067bcead8f02499980f1d999810157d0fc2f9e45c200dee7d379907ef98a6f034
-
Filesize
1KB
MD50254494a4c89bf8f623066957ccb7ea1
SHA10a31bf0f80c2e5caaf36fdf4266b72379cfb3751
SHA256ffda9233d24b63e14924cddc16d3885111c7cf09abe840547c0a266c2000687f
SHA5128f8c04122ae09f4a544d482eb72c30fc6d1ae9840e4247eb9e7a5cbe6e912fbff9132afc78974509923c24c30a8049199d43d83aba49b8a66ab78316546673bb
-
Filesize
1KB
MD5c0eb9583ac0a313eb0a02b0ece142516
SHA14d883d8abc27ab41547fc596c57afa884e15b10b
SHA256927a46a6722835eab810935b74fa7f2bff7a63da27096258f780d10832dde34d
SHA512c821d092c5ed9aa739046f39a5956d3f60e7f2d4454e7cff00d564d1ee572dca8814aa9c672f8f17ce10f1976405e79e3b7625ab74dd585ab32c3f93d8159643
-
Filesize
19.0MB
MD5aa36bb0fd148e140a0e9b229b6820f7c
SHA12a2e8ed1445b1de8fa8484007b0099bbccff1048
SHA25638e3ba029fdc0ecfea36cbc94fbe079bc82fc750e3171f0593337c89a442f48b
SHA5127e9abd573e960d9617c82751738bd078d74c25c237a0394de73a8b1b5e37029382d6ce6a42615ba537db402a4e3eb639b03adc9741993440f0f6909bdc7e6ee9
-
Filesize
15.5MB
MD5c33cf464bbe1f4c140b7a80c4c823a2a
SHA1d98b15369166d8f1e265b724cbba1ce57e167c96
SHA2565aa705b7d28dae8d30a9059ecef39dabeea0696d2ae0aa6321f4c42d03d92fd3
SHA512885af1d2e80151cbe0d539f9e67b9b993cd57b048f744ac0ef40762e66184e1e58b6884db394b434bf945c8e311567f95caa497a1c54fc46801c5be78afc6b2e
-
Filesize
13.1MB
MD5ed02a9531aca8ae9b6852972d6660fd7
SHA1a5d5ed101f937e59801d40f595ec35c162c63740
SHA256bc89da234215c71e8cd90643e0742b838f2884ee254831f05d6627667c32ce9f
SHA512a8578892b49d0518e66625c387e9bb57b0d5df4811f86338c8c490d333af7643ebf2c2de0c971b8e3eff7d77775bcfd3697ff9b9c8a5e0d4fb04518c0f4dc136
-
Filesize
1KB
MD54bee70c0f6866479d0f61d8c37d66248
SHA1f02ff03360e0dfa18ab421946ddb8cec805954ec
SHA256b2819b19c01a791c4d799b6c5c794917b6a4ea62f4cf4c925325fa08a626c43a
SHA512cea1e07862e31f89aa6133de6063c7ab103f98dc8bd881d5f6bb7b401709ad6653a6a0adfe0401a961b5cea6d8060d0fc350ca528075b51c3a7a2656500e9274
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
3KB
MD588a9a600777109cfcbdb687a22c03a23
SHA17f3839f1685203b8b89f363d9b87ad2208f43cd9
SHA2564760c7ea4735aab1119fd90c66c14c21e5dbba071014a619c00a3d7f525266e9
SHA51298e62c0dbb8c24c60597a6e8f8324e2442727bc159d483b3b08e16c5245c282525364fe52c79ae202f44284e130fb366b48fa82719ef435042247aa04af611ad
-
Filesize
652B
MD5adb1270c9bc75688f0dbc611067c3668
SHA15d06ede5ce8e703d6638f1530a5cf6f0e9d24a17
SHA256cb7dddb3a122cf6e83f03b517780cdb94909dfe5fb7177d85007b5dd75457030
SHA5129c740482596165f507214fb438969e7cca404ea7af3c44e162b31ce9475bff8d3284f6d7c44b2645be31b07719ccd92da44cb4a8b71de8524b66f83e67fa2bee
-
Filesize
312B
MD5ecbf151f81ff98f7dff196304a40239e
SHA1ccf6b97b6f8276656b042d64f0595963fe9ec79c
SHA256295ca195631c485c876e7c468ddcbb3fe7cd219d3e5005a2441be2de54e62ac8
SHA5124526a59055a18af6c0c13fb9f55a9a9bc15aa1407b697849e19b6cc32c88ee7206b3efff806bd154d36bce144ae1d9c407c6ea0f5077c54fbe92cd172c203720
-
Filesize
369B
MD588b1d5af6260e9242f61eabacbe23636
SHA1bcd7e1f9609d37ab108eff67daa3c5dc30cd28f5
SHA25619176023022c03c9ccdfcab748fb1f6621c668a9d7012f35783bb2a111152060
SHA51298544f559150f7b9ee3304e258d28afb1ab96d6a7be17e49b0aeb5c2d663e5e3cc1c951eae9fe05976e9d5713528d34968020a6d3f3c44228001255600c36a65