Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
18s -
max time network
26s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
26/03/2024, 19:03
Behavioral task
behavioral1
Sample
dfe148f6d2caea2150dfc967d6d295a6.exe
Resource
win7-20240215-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
dfe148f6d2caea2150dfc967d6d295a6.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
10 signatures
150 seconds
Errors
Reason
Machine shutdown
General
-
Target
dfe148f6d2caea2150dfc967d6d295a6.exe
-
Size
537KB
-
MD5
dfe148f6d2caea2150dfc967d6d295a6
-
SHA1
98a9446a04843e8281e6be98cf3e56c725401b7d
-
SHA256
d15ec2a9cbc43808cb54d1216cd1b766a9f4af1b2584a0978de26e2e25502d57
-
SHA512
4846671f0788b2eb52a7be88d27e454473a6fb18d89b4bd881a627a5b8a726d875312917b710a90d5a4eeb1bf45bda6596956504dd5332ce23e1f779dddccfe3
-
SSDEEP
12288:x068wekhxY41Nmqc8SZm4GO6KoOUmX63GEfhYFkUHsFatTRRfHu1U9XgWNyC3V:d85khxxNO5m4GhK5UNOZHfN5u4lt
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Roaming\\gog.exe" dfe148f6d2caea2150dfc967d6d295a6.exe -
resource yara_rule behavioral2/memory/3128-0-0x0000000000400000-0x000000000058C000-memory.dmp upx behavioral2/memory/3128-4-0x0000000000400000-0x000000000058C000-memory.dmp upx -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 dfe148f6d2caea2150dfc967d6d295a6.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum dfe148f6d2caea2150dfc967d6d295a6.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies data under HKEY_USERS 15 IoCs
description ioc Process Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "151" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3128 dfe148f6d2caea2150dfc967d6d295a6.exe 3128 dfe148f6d2caea2150dfc967d6d295a6.exe 3128 dfe148f6d2caea2150dfc967d6d295a6.exe 3128 dfe148f6d2caea2150dfc967d6d295a6.exe 3128 dfe148f6d2caea2150dfc967d6d295a6.exe 3128 dfe148f6d2caea2150dfc967d6d295a6.exe 3128 dfe148f6d2caea2150dfc967d6d295a6.exe 3128 dfe148f6d2caea2150dfc967d6d295a6.exe 3128 dfe148f6d2caea2150dfc967d6d295a6.exe 3128 dfe148f6d2caea2150dfc967d6d295a6.exe 3128 dfe148f6d2caea2150dfc967d6d295a6.exe 3128 dfe148f6d2caea2150dfc967d6d295a6.exe 3128 dfe148f6d2caea2150dfc967d6d295a6.exe 3128 dfe148f6d2caea2150dfc967d6d295a6.exe 3128 dfe148f6d2caea2150dfc967d6d295a6.exe 3128 dfe148f6d2caea2150dfc967d6d295a6.exe 3128 dfe148f6d2caea2150dfc967d6d295a6.exe 3128 dfe148f6d2caea2150dfc967d6d295a6.exe 3128 dfe148f6d2caea2150dfc967d6d295a6.exe 3128 dfe148f6d2caea2150dfc967d6d295a6.exe 3128 dfe148f6d2caea2150dfc967d6d295a6.exe 3128 dfe148f6d2caea2150dfc967d6d295a6.exe 3128 dfe148f6d2caea2150dfc967d6d295a6.exe 3128 dfe148f6d2caea2150dfc967d6d295a6.exe 3128 dfe148f6d2caea2150dfc967d6d295a6.exe 3128 dfe148f6d2caea2150dfc967d6d295a6.exe 3128 dfe148f6d2caea2150dfc967d6d295a6.exe 3128 dfe148f6d2caea2150dfc967d6d295a6.exe 3128 dfe148f6d2caea2150dfc967d6d295a6.exe 3128 dfe148f6d2caea2150dfc967d6d295a6.exe 3128 dfe148f6d2caea2150dfc967d6d295a6.exe 3128 dfe148f6d2caea2150dfc967d6d295a6.exe 3128 dfe148f6d2caea2150dfc967d6d295a6.exe 3128 dfe148f6d2caea2150dfc967d6d295a6.exe 3128 dfe148f6d2caea2150dfc967d6d295a6.exe 3128 dfe148f6d2caea2150dfc967d6d295a6.exe 3128 dfe148f6d2caea2150dfc967d6d295a6.exe 3128 dfe148f6d2caea2150dfc967d6d295a6.exe 3128 dfe148f6d2caea2150dfc967d6d295a6.exe 3128 dfe148f6d2caea2150dfc967d6d295a6.exe 3128 dfe148f6d2caea2150dfc967d6d295a6.exe 3128 dfe148f6d2caea2150dfc967d6d295a6.exe 3128 dfe148f6d2caea2150dfc967d6d295a6.exe 3128 dfe148f6d2caea2150dfc967d6d295a6.exe 3128 dfe148f6d2caea2150dfc967d6d295a6.exe 3128 dfe148f6d2caea2150dfc967d6d295a6.exe 3128 dfe148f6d2caea2150dfc967d6d295a6.exe 3128 dfe148f6d2caea2150dfc967d6d295a6.exe 3128 dfe148f6d2caea2150dfc967d6d295a6.exe 3128 dfe148f6d2caea2150dfc967d6d295a6.exe 3128 dfe148f6d2caea2150dfc967d6d295a6.exe 3128 dfe148f6d2caea2150dfc967d6d295a6.exe 3128 dfe148f6d2caea2150dfc967d6d295a6.exe 3128 dfe148f6d2caea2150dfc967d6d295a6.exe 3128 dfe148f6d2caea2150dfc967d6d295a6.exe 3128 dfe148f6d2caea2150dfc967d6d295a6.exe 3128 dfe148f6d2caea2150dfc967d6d295a6.exe 3128 dfe148f6d2caea2150dfc967d6d295a6.exe 3128 dfe148f6d2caea2150dfc967d6d295a6.exe 3128 dfe148f6d2caea2150dfc967d6d295a6.exe 3128 dfe148f6d2caea2150dfc967d6d295a6.exe 3128 dfe148f6d2caea2150dfc967d6d295a6.exe 3128 dfe148f6d2caea2150dfc967d6d295a6.exe 3128 dfe148f6d2caea2150dfc967d6d295a6.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeShutdownPrivilege 3128 dfe148f6d2caea2150dfc967d6d295a6.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3128 dfe148f6d2caea2150dfc967d6d295a6.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 3128 dfe148f6d2caea2150dfc967d6d295a6.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 3128 dfe148f6d2caea2150dfc967d6d295a6.exe 3128 dfe148f6d2caea2150dfc967d6d295a6.exe 4808 LogonUI.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\dfe148f6d2caea2150dfc967d6d295a6.exe"C:\Users\Admin\AppData\Local\Temp\dfe148f6d2caea2150dfc967d6d295a6.exe"1⤵
- Modifies WinLogon for persistence
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3128
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa39ab855 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4808