Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/03/2024, 07:44

General

  • Target

    e1254d7196cfeef80181eb075633e905.exe

  • Size

    14KB

  • MD5

    e1254d7196cfeef80181eb075633e905

  • SHA1

    404c688e9fc99ea172c7d321954f0074b630bc98

  • SHA256

    1612082491f40f3317035632aa95b9f46a21bf280adabf6d0d248e22c1d50de6

  • SHA512

    4ee9e7ea212abf8842603914859f1361f7f638bfe7f3f309b7f518932bd553a0e26b76cdf38adcc87934bf8a13aa9eb90e55498c924099c770b56b16257e9005

  • SSDEEP

    384:M/lNdn0Jp7lCqjYcMVerN3Zzj8vnqR+Vq+XUi:M/tIbjYcMQzjknqAqCUi

Score
10/10

Malware Config

Signatures

  • Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Drops file in System32 directory 3 IoCs
  • Modifies registry class 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e1254d7196cfeef80181eb075633e905.exe
    "C:\Users\Admin\AppData\Local\Temp\e1254d7196cfeef80181eb075633e905.exe"
    1⤵
    • Adds autorun key to be loaded by Explorer.exe on startup
    • Loads dropped DLL
    • Drops file in System32 directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3592
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\B97C.tmp.bat
      2⤵
        PID:2444

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\B97C.tmp.bat

      Filesize

      179B

      MD5

      70542992205d019844e2b683c2690bc3

      SHA1

      94796f9b12c71dc36fd8d5be425772e19ee9b940

      SHA256

      7a15cd726570ee93cb75971d03cfd0b6c1b650d86660d5ffea7bc3b24eed630c

      SHA512

      26e085277b8029775b164cf99c509192ecc7651a1a5ab29217380d46bf63b6c8964191dc82850efb53097fe09f1c8f71f83372be99b45d06bf947d75ad4b4458

    • C:\Windows\SysWOW64\cliconfgzx.dll

      Filesize

      543KB

      MD5

      767a7aec5f3b54e5960cf391bba04d93

      SHA1

      06e0efbfd7be23667c38ebb473b68e70289f58c5

      SHA256

      6c085eb75ba4f6b4d8441f42b6ff53fc386fd798e3d142341c00b85fb16e74b9

      SHA512

      1ddd6fcd93472e6fb05f9d2e58c8acfdaf5d16b8df04a9420bdda039b8dfcb0fae6ead52a4ef61aba46b9b2a55125a0b1ef429cdbe75cd6a9d0269a4d21fadd0

    • memory/3592-9-0x0000000020000000-0x000000002006C000-memory.dmp

      Filesize

      432KB

    • memory/3592-13-0x0000000020000000-0x000000002006C000-memory.dmp

      Filesize

      432KB