Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
27/03/2024, 09:25
Static task
static1
Behavioral task
behavioral1
Sample
Revised Purchase Order.exe
Resource
win7-20240221-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
Revised Purchase Order.exe
Resource
win10v2004-20240226-en
8 signatures
150 seconds
General
-
Target
Revised Purchase Order.exe
-
Size
705KB
-
MD5
8c762ec76d202e8e5aeeefae06814bff
-
SHA1
b0008c82f2107bc627d2269f58858c7b0104006d
-
SHA256
7d7e60a0fa22587c8187fd3077934bff0d596aa5c0da1767096ebbeb10a235a1
-
SHA512
f7a6dfca98a6847bf8df390f95c298e06001ad94d28672ba50fa60d5ab48384dedbbfe77c2063cc0135d329881a76a35514dd019d03fda7cf796ff13dfe62be4
-
SSDEEP
12288:nvM2iNlw0HXUxzzRmb/kGTzdIPqBN09jW6qjrRSlo7qyTwDgWMQ8WeikR:U1XP6zcoYdIKN09jW6qxXTOgwJeR
Score
5/10
Malware Config
Signatures
-
Suspicious use of SetThreadContext 5 IoCs
description pid Process procid_target PID 1384 set thread context of 4696 1384 Revised Purchase Order.exe 101 PID 4696 set thread context of 3372 4696 Revised Purchase Order.exe 57 PID 4696 set thread context of 460 4696 Revised Purchase Order.exe 106 PID 460 set thread context of 3372 460 MuiUnattend.exe 57 PID 460 set thread context of 2952 460 MuiUnattend.exe 113 -
description ioc Process Key created \Registry\User\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 MuiUnattend.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1384 Revised Purchase Order.exe 1384 Revised Purchase Order.exe 1384 Revised Purchase Order.exe 1384 Revised Purchase Order.exe 4696 Revised Purchase Order.exe 4696 Revised Purchase Order.exe 4696 Revised Purchase Order.exe 4696 Revised Purchase Order.exe 4696 Revised Purchase Order.exe 4696 Revised Purchase Order.exe 4696 Revised Purchase Order.exe 4696 Revised Purchase Order.exe 4696 Revised Purchase Order.exe 4696 Revised Purchase Order.exe 4696 Revised Purchase Order.exe 4696 Revised Purchase Order.exe 4696 Revised Purchase Order.exe 4696 Revised Purchase Order.exe 4696 Revised Purchase Order.exe 4696 Revised Purchase Order.exe 4696 Revised Purchase Order.exe 4696 Revised Purchase Order.exe 4696 Revised Purchase Order.exe 4696 Revised Purchase Order.exe 4696 Revised Purchase Order.exe 4696 Revised Purchase Order.exe 460 MuiUnattend.exe 460 MuiUnattend.exe 460 MuiUnattend.exe 460 MuiUnattend.exe 460 MuiUnattend.exe 460 MuiUnattend.exe 460 MuiUnattend.exe 460 MuiUnattend.exe 460 MuiUnattend.exe 460 MuiUnattend.exe 460 MuiUnattend.exe 460 MuiUnattend.exe 460 MuiUnattend.exe 460 MuiUnattend.exe 460 MuiUnattend.exe 460 MuiUnattend.exe 460 MuiUnattend.exe 460 MuiUnattend.exe 460 MuiUnattend.exe 460 MuiUnattend.exe 460 MuiUnattend.exe 460 MuiUnattend.exe 460 MuiUnattend.exe 460 MuiUnattend.exe 460 MuiUnattend.exe 460 MuiUnattend.exe 460 MuiUnattend.exe 460 MuiUnattend.exe 460 MuiUnattend.exe 460 MuiUnattend.exe 460 MuiUnattend.exe 460 MuiUnattend.exe 460 MuiUnattend.exe 460 MuiUnattend.exe 460 MuiUnattend.exe 460 MuiUnattend.exe 460 MuiUnattend.exe 460 MuiUnattend.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3372 Explorer.EXE -
Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 4696 Revised Purchase Order.exe 4696 Revised Purchase Order.exe 460 MuiUnattend.exe 460 MuiUnattend.exe 460 MuiUnattend.exe 460 MuiUnattend.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1384 Revised Purchase Order.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 3372 Explorer.EXE -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 1384 wrote to memory of 1836 1384 Revised Purchase Order.exe 99 PID 1384 wrote to memory of 1836 1384 Revised Purchase Order.exe 99 PID 1384 wrote to memory of 1836 1384 Revised Purchase Order.exe 99 PID 1384 wrote to memory of 3116 1384 Revised Purchase Order.exe 100 PID 1384 wrote to memory of 3116 1384 Revised Purchase Order.exe 100 PID 1384 wrote to memory of 3116 1384 Revised Purchase Order.exe 100 PID 1384 wrote to memory of 4696 1384 Revised Purchase Order.exe 101 PID 1384 wrote to memory of 4696 1384 Revised Purchase Order.exe 101 PID 1384 wrote to memory of 4696 1384 Revised Purchase Order.exe 101 PID 1384 wrote to memory of 4696 1384 Revised Purchase Order.exe 101 PID 1384 wrote to memory of 4696 1384 Revised Purchase Order.exe 101 PID 1384 wrote to memory of 4696 1384 Revised Purchase Order.exe 101 PID 4696 wrote to memory of 460 4696 Revised Purchase Order.exe 106 PID 4696 wrote to memory of 460 4696 Revised Purchase Order.exe 106 PID 4696 wrote to memory of 460 4696 Revised Purchase Order.exe 106 PID 460 wrote to memory of 2952 460 MuiUnattend.exe 113 PID 460 wrote to memory of 2952 460 MuiUnattend.exe 113
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of UnmapMainImage
PID:3372 -
C:\Users\Admin\AppData\Local\Temp\Revised Purchase Order.exe"C:\Users\Admin\AppData\Local\Temp\Revised Purchase Order.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1384 -
C:\Users\Admin\AppData\Local\Temp\Revised Purchase Order.exe"C:\Users\Admin\AppData\Local\Temp\Revised Purchase Order.exe"3⤵PID:1836
-
-
C:\Users\Admin\AppData\Local\Temp\Revised Purchase Order.exe"C:\Users\Admin\AppData\Local\Temp\Revised Purchase Order.exe"3⤵PID:3116
-
-
C:\Users\Admin\AppData\Local\Temp\Revised Purchase Order.exe"C:\Users\Admin\AppData\Local\Temp\Revised Purchase Order.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Windows\SysWOW64\MuiUnattend.exe"C:\Windows\SysWOW64\MuiUnattend.exe"4⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:460 -
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"5⤵PID:2952
-
-
-
-