Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/03/2024, 09:25

General

  • Target

    Revised Purchase Order.exe

  • Size

    705KB

  • MD5

    8c762ec76d202e8e5aeeefae06814bff

  • SHA1

    b0008c82f2107bc627d2269f58858c7b0104006d

  • SHA256

    7d7e60a0fa22587c8187fd3077934bff0d596aa5c0da1767096ebbeb10a235a1

  • SHA512

    f7a6dfca98a6847bf8df390f95c298e06001ad94d28672ba50fa60d5ab48384dedbbfe77c2063cc0135d329881a76a35514dd019d03fda7cf796ff13dfe62be4

  • SSDEEP

    12288:nvM2iNlw0HXUxzzRmb/kGTzdIPqBN09jW6qjrRSlo7qyTwDgWMQ8WeikR:U1XP6zcoYdIKN09jW6qxXTOgwJeR

Score
5/10

Malware Config

Signatures

  • Suspicious use of SetThreadContext 5 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of UnmapMainImage
    PID:3372
    • C:\Users\Admin\AppData\Local\Temp\Revised Purchase Order.exe
      "C:\Users\Admin\AppData\Local\Temp\Revised Purchase Order.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1384
      • C:\Users\Admin\AppData\Local\Temp\Revised Purchase Order.exe
        "C:\Users\Admin\AppData\Local\Temp\Revised Purchase Order.exe"
        3⤵
          PID:1836
        • C:\Users\Admin\AppData\Local\Temp\Revised Purchase Order.exe
          "C:\Users\Admin\AppData\Local\Temp\Revised Purchase Order.exe"
          3⤵
            PID:3116
          • C:\Users\Admin\AppData\Local\Temp\Revised Purchase Order.exe
            "C:\Users\Admin\AppData\Local\Temp\Revised Purchase Order.exe"
            3⤵
            • Suspicious use of SetThreadContext
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of WriteProcessMemory
            PID:4696
            • C:\Windows\SysWOW64\MuiUnattend.exe
              "C:\Windows\SysWOW64\MuiUnattend.exe"
              4⤵
              • Suspicious use of SetThreadContext
              • Modifies Internet Explorer settings
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious behavior: MapViewOfSection
              • Suspicious use of WriteProcessMemory
              PID:460
              • C:\Program Files\Mozilla Firefox\Firefox.exe
                "C:\Program Files\Mozilla Firefox\Firefox.exe"
                5⤵
                  PID:2952

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/460-19-0x00000000008A0000-0x00000000008E0000-memory.dmp

          Filesize

          256KB

        • memory/460-28-0x00000000011B0000-0x0000000001254000-memory.dmp

          Filesize

          656KB

        • memory/460-27-0x00000000008A0000-0x00000000008E0000-memory.dmp

          Filesize

          256KB

        • memory/460-25-0x00000000011B0000-0x0000000001254000-memory.dmp

          Filesize

          656KB

        • memory/460-24-0x00000000008A0000-0x00000000008E0000-memory.dmp

          Filesize

          256KB

        • memory/460-23-0x0000000001260000-0x00000000015AA000-memory.dmp

          Filesize

          3.3MB

        • memory/460-20-0x00000000008A0000-0x00000000008E0000-memory.dmp

          Filesize

          256KB

        • memory/1384-8-0x00000000058A0000-0x00000000058AC000-memory.dmp

          Filesize

          48KB

        • memory/1384-2-0x0000000005C20000-0x00000000061C4000-memory.dmp

          Filesize

          5.6MB

        • memory/1384-9-0x0000000006D40000-0x0000000006DCA000-memory.dmp

          Filesize

          552KB

        • memory/1384-4-0x00000000055A0000-0x00000000055B0000-memory.dmp

          Filesize

          64KB

        • memory/1384-12-0x0000000074F20000-0x00000000756D0000-memory.dmp

          Filesize

          7.7MB

        • memory/1384-5-0x0000000005620000-0x000000000562A000-memory.dmp

          Filesize

          40KB

        • memory/1384-3-0x0000000005670000-0x0000000005702000-memory.dmp

          Filesize

          584KB

        • memory/1384-0-0x0000000000BB0000-0x0000000000C60000-memory.dmp

          Filesize

          704KB

        • memory/1384-6-0x0000000005900000-0x000000000599C000-memory.dmp

          Filesize

          624KB

        • memory/1384-1-0x0000000074F20000-0x00000000756D0000-memory.dmp

          Filesize

          7.7MB

        • memory/1384-7-0x0000000005880000-0x0000000005892000-memory.dmp

          Filesize

          72KB

        • memory/2952-37-0x00000132A5ED0000-0x00000132A5FC1000-memory.dmp

          Filesize

          964KB

        • memory/3372-18-0x0000000008E70000-0x00000000091ED000-memory.dmp

          Filesize

          3.5MB

        • memory/3372-30-0x0000000008950000-0x0000000008A74000-memory.dmp

          Filesize

          1.1MB

        • memory/3372-29-0x0000000008950000-0x0000000008A74000-memory.dmp

          Filesize

          1.1MB

        • memory/3372-26-0x0000000008E70000-0x00000000091ED000-memory.dmp

          Filesize

          3.5MB

        • memory/3372-38-0x0000000008950000-0x0000000008A74000-memory.dmp

          Filesize

          1.1MB

        • memory/4696-15-0x0000000000400000-0x0000000000443000-memory.dmp

          Filesize

          268KB

        • memory/4696-22-0x0000000001010000-0x0000000001035000-memory.dmp

          Filesize

          148KB

        • memory/4696-21-0x0000000000400000-0x0000000000443000-memory.dmp

          Filesize

          268KB

        • memory/4696-17-0x0000000001010000-0x0000000001035000-memory.dmp

          Filesize

          148KB

        • memory/4696-16-0x0000000000400000-0x0000000000443000-memory.dmp

          Filesize

          268KB

        • memory/4696-14-0x0000000000400000-0x0000000000443000-memory.dmp

          Filesize

          268KB

        • memory/4696-13-0x0000000001050000-0x000000000139A000-memory.dmp

          Filesize

          3.3MB

        • memory/4696-10-0x0000000000400000-0x0000000000443000-memory.dmp

          Filesize

          268KB