Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

30e777e73b...89.exe

windows7-x64

7

30e777e73b...89.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    161s
  • max time network
    165s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/03/2024, 18:46

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    30e777e73b1db299d0b5bf492a65ff0cb1a749ee6d636e58843e4b8b3ab2a589.exe

  • Size

    421KB

  • MD5

    c7a72087a3c79b49f8a976e9aa044cdf

  • SHA1

    c5ccc17fb40b77dbb32febabd7cb23504d0eb79a

  • SHA256

    30e777e73b1db299d0b5bf492a65ff0cb1a749ee6d636e58843e4b8b3ab2a589

  • SHA512

    1601c7c7eb58701c202edaff830ee7aa280a167c99ebc693fbdde2692917cbe81426615f77feb48ecf1ca450df6f512167c2c5abad43f01d4a225283f3d439fb

  • SSDEEP

    6144:WZT3H5umWrA7oSLvd5Gr83KS1PCG0LlZYO/G/lxRVQinwdYrjzUderlmsOVKkaq5:Wh3ZukLF5fRYZmLd7FDIsOPczRfv3+7

Score
7/10
persistence

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops file in Program Files directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 43 IoCs
    adwarespyware
  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\30e777e73b1db299d0b5bf492a65ff0cb1a749ee6d636e58843e4b8b3ab2a589.exe
    "C:\Users\Admin\AppData\Local\Temp\30e777e73b1db299d0b5bf492a65ff0cb1a749ee6d636e58843e4b8b3ab2a589.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3972
    • C:\Users\Admin\AppData\Local\Temp\30e777e73b1db299d0b5bf492a65ff0cb1a749ee6d636e58843e4b8b3ab2a589.exe
      "C:\Users\Admin\AppData\Local\Temp\30e777e73b1db299d0b5bf492a65ff0cb1a749ee6d636e58843e4b8b3ab2a589.exe" C:\Users\Admin\AppData\Local\Temp\30e777e73b1db299d0b5bf492a65ff0cb1a749ee6d636e58843e4b8b3ab2a589.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3844
    • C:\Program Files (x86)\Adobe\acrotray.exe
      "C:\Program Files (x86)\Adobe\acrotray.exe" C:\Users\Admin\AppData\Local\Temp\30e777e73b1db299d0b5bf492a65ff0cb1a749ee6d636e58843e4b8b3ab2a589.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2980
      • C:\Program Files (x86)\Adobe\acrotray.exe
        "C:\Program Files (x86)\Adobe\acrotray.exe" C:\Program Files (x86)\Adobe\acrotray.exe" C:\Users\Admin\AppData\Local\Temp\30e777e73b1db299d0b5bf492a65ff0cb1a749ee6d636e58843e4b8b3ab2a589.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3768
      • C:\Program Files (x86)\Adobe\acrotray .exe
        "C:\Program Files (x86)\Adobe\acrotray .exe" C:\Program Files (x86)\Adobe\acrotray.exe" C:\Users\Admin\AppData\Local\Temp\30e777e73b1db299d0b5bf492a65ff0cb1a749ee6d636e58843e4b8b3ab2a589.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4924
        • C:\Program Files (x86)\Adobe\acrotray .exe
          "C:\Program Files (x86)\Adobe\acrotray .exe" C:\Program Files (x86)\Adobe\acrotray .exe" C:\Program Files (x86)\Adobe\acrotray.exe" C:\Users\Admin\AppData\Local\Temp\30e777e73b1db299d0b5bf492a65ff0cb1a749ee6d636e58843e4b8b3ab2a589.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4540
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1340 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:4400
    • C:\Program Files (x86)\Internet Explorer\ielowutil.exe
      "C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
      1⤵
        PID:4592
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
        1⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4864
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4864 CREDAT:17410 /prefetch:2
          2⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:4060
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4864 CREDAT:82950 /prefetch:2
          2⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:3876
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4864 CREDAT:82958 /prefetch:2
          2⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:3808

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files (x86)\Adobe\acrotray .exe
        Filesize

        422KB

        MD5

        8009f95831b51ace0ff865b0d3a141de

        SHA1

        0a6e54e1404ad2afe1f16b9adee89ba9ad035b64

        SHA256

        836c61d0d717e8cdc94f5a0e1f22847a78b77c6968083528f48c00f7e1ad6897

        SHA512

        eea552c910a75e6cd2eba8aee559b66fde9a1eaf6b4b7a72c8d99592a18d3af757e8e0cf038bf0e57dd66a66d7f1d1a591ac02e879c0b4ffd56bbec1c66539d0

        Download Submit

      • C:\Program Files (x86)\Adobe\acrotray .exe
        Filesize

        179KB

        MD5

        c445ee1fcc373bbcf4ea9f2c06b388fe

        SHA1

        5bb445c0cf3de93f21d95852e4b55b2cef3b21f5

        SHA256

        197f17a7e8e5f2a6f99394ecd7eb199a33cc0bc0bc3d87e98c11380b3fbc9a1f

        SHA512

        944c859922f7991f2eea3d79b59074c22cb9e1042f742d24fb8097275b0b7fd549487be8e557007f785eefbf0e9fc5462b2b6b31193eba9a2c9a3eac390efaf6

        Download Submit

      • C:\Program Files (x86)\Adobe\acrotray.exe
        Filesize

        455KB

        MD5

        a2abc833e64e21a76e08ca2b16b7c388

        SHA1

        2d50d84c502d9dbf35e1c19a8e4c39b47c48bff3

        SHA256

        e943059aaaec67bfe9fc6588706df0ed098f873b1c23ccf469985d5efbd01516

        SHA512

        c6a6f458af10019ab7524252d03e318476625ef3633acc9aeffa52b0938c7d56d74725aeee10711e80facfe218afcc0e099516d59bd3f7f053bdd2ea3c1c33aa

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BHC2O5WS\suggestions[1].en-US
        Filesize

        17KB

        MD5

        5a34cb996293fde2cb7a4ac89587393a

        SHA1

        3c96c993500690d1a77873cd62bc639b3a10653f

        SHA256

        c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

        SHA512

        e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\X0OFMNIL\bcgJXjdrf[1].js
        Filesize

        32KB

        MD5

        481b762cb35e9b51e29d4c3fd951d90a

        SHA1

        24d87cbe34c340b2963499748cee47cd0bea00af

        SHA256

        dca4905f387f0954bb5e1bc86181072e58c18bbc04593e19284253e7f85bac0d

        SHA512

        25f4802ef9f14278641da53616828048901e488ae533617b9b4c24f7feebd7043d96ac5836ce57c7efc25f869baabaa4e4ecba95ebd2c16207b49b529e48430c

        Download Submit

      • memory/3972-0-0x0000000010000000-0x0000000010010000-memory.dmp

        Filesize

        64KB

        Download