Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    133s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    26/03/2024, 01:53

General

  • Target

    Biomolecule/Shopmaid.ps1

  • Size

    61KB

  • MD5

    d003bc3b0862bfceec3a0869b7872b8a

  • SHA1

    477a3475ffe393390c6faf530887d0d162662feb

  • SHA256

    994c3a38ec25e17024e4260571b946d006aac11fcceb754bc68e18d13c394b51

  • SHA512

    ae2a0a61e7d03afd55ede91c0712d89fa9b4504ac9b5db23a7e5f30d8a1fb226e71e9c6383bd1ec55b15cef61e952124b44f77cafd74aa5af4db6d7a92dab88a

  • SSDEEP

    1536:tMfur/H2ttlMwEcdJwK7OqcgwwO+5DPMEi18:Q8f2BMojUqXNAh8

Score
8/10

Malware Config

Signatures

  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 13 IoCs
  • Suspicious use of FindShellTrayWindow 29 IoCs
  • Suspicious use of SendNotifyMessage 22 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Biomolecule\Shopmaid.ps1
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3048
    • C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "set /A 1^^0"
      2⤵
        PID:2132
      • C:\Windows\system32\wermgr.exe
        "C:\Windows\system32\wermgr.exe" "-outproc" "3048" "1140"
        2⤵
          PID:2576
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Modifies Installed Components in the registry
        • Modifies registry class
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2700

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\OutofProcReport259406370.txt

        Filesize

        1KB

        MD5

        24ab25c722b87ed520b65583f8bd56ac

        SHA1

        14914773aa9a9a35e5f2ce6cf1df676c20fc97f9

        SHA256

        39a667bbc4c45d24a618b640d9a63cc3e0844f8678784ddde013eba3c2f628e8

        SHA512

        408bc8bb1ab1f1fe57ba4e336ac0a4845e3052e42e4e8f05d7dadc34a6ad641466ed399f112bef678e092bb1ee94aa5c108d9efe73cdd57b61151636c74415c8

      • memory/2700-24-0x0000000002A50000-0x0000000002A60000-memory.dmp

        Filesize

        64KB

      • memory/2700-20-0x0000000004250000-0x0000000004251000-memory.dmp

        Filesize

        4KB

      • memory/2700-19-0x0000000004250000-0x0000000004251000-memory.dmp

        Filesize

        4KB

      • memory/3048-13-0x0000000002C90000-0x0000000002D10000-memory.dmp

        Filesize

        512KB

      • memory/3048-9-0x0000000002C90000-0x0000000002D10000-memory.dmp

        Filesize

        512KB

      • memory/3048-10-0x0000000002C90000-0x0000000002D10000-memory.dmp

        Filesize

        512KB

      • memory/3048-11-0x0000000002C90000-0x0000000002D10000-memory.dmp

        Filesize

        512KB

      • memory/3048-5-0x000007FEF5AA0000-0x000007FEF643D000-memory.dmp

        Filesize

        9.6MB

      • memory/3048-15-0x0000000002BC0000-0x0000000002BC4000-memory.dmp

        Filesize

        16KB

      • memory/3048-7-0x0000000001ED0000-0x0000000001ED8000-memory.dmp

        Filesize

        32KB

      • memory/3048-17-0x0000000002C90000-0x0000000002D10000-memory.dmp

        Filesize

        512KB

      • memory/3048-18-0x000007FEF5AA0000-0x000007FEF643D000-memory.dmp

        Filesize

        9.6MB

      • memory/3048-8-0x000007FEF5AA0000-0x000007FEF643D000-memory.dmp

        Filesize

        9.6MB

      • memory/3048-6-0x0000000002C90000-0x0000000002D10000-memory.dmp

        Filesize

        512KB

      • memory/3048-4-0x000000001B5F0000-0x000000001B8D2000-memory.dmp

        Filesize

        2.9MB