Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    128s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/04/2024, 23:16

General

  • Target

    8e20ced4ef597ed583128275717ee2ca42d7d80814f3dc032c775f589b07674b.exe

  • Size

    3.9MB

  • MD5

    e50f625af23074889460dc76e73f9c40

  • SHA1

    ca3f32c8bce1f7b1b8f36e03928feed509ec8e97

  • SHA256

    8e20ced4ef597ed583128275717ee2ca42d7d80814f3dc032c775f589b07674b

  • SHA512

    b3f3136921db681633b6ab7e09cd11de39bdd30959e32b2751d4a175edb42fb154c0e1a41e0c9c3ba158192a7571807a6bfd1bfab344ec67f73501fd91b591d7

  • SSDEEP

    98304:RSptXL6pUrrW1FpuvDcX9Gdsd/DQ1C75vLpve:4tbIOebX9GqBU05zpG

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Modifies Installed Components in the registry 2 TTPs 8 IoCs
  • Executes dropped EXE 4 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs
  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of SetWindowsHookEx 22 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8e20ced4ef597ed583128275717ee2ca42d7d80814f3dc032c775f589b07674b.exe
    "C:\Users\Admin\AppData\Local\Temp\8e20ced4ef597ed583128275717ee2ca42d7d80814f3dc032c775f589b07674b.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:380
    • \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visiblity of hidden/system files in Explorer
      • Modifies Installed Components in the registry
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1992
      • \??\c:\windows\system\spoolsv.exe
        c:\windows\system\spoolsv.exe SE
        3⤵
        • Executes dropped EXE
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2280
        • \??\c:\windows\system\svchost.exe
          c:\windows\system\svchost.exe
          4⤵
          • Modifies WinLogon for persistence
          • Modifies visiblity of hidden/system files in Explorer
          • Modifies Installed Components in the registry
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1416
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe PR
            5⤵
            • Executes dropped EXE
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Suspicious use of SetWindowsHookEx
            PID:3996
          • C:\Windows\SysWOW64\at.exe
            at 23:18 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
            5⤵
              PID:2524
            • C:\Windows\SysWOW64\at.exe
              at 23:19 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
              5⤵
                PID:628
              • C:\Windows\SysWOW64\at.exe
                at 23:20 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
                5⤵
                  PID:4780

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Roaming\mrsys.exe

          Filesize

          3.9MB

          MD5

          47cecd846121bd2570e0989b1b4dc941

          SHA1

          c140e3cc7193025d04282c802893b2a279894338

          SHA256

          d731c2a7b1e606f46972be3582f4b082b14a10216564a881a0e74aeaa0b23e69

          SHA512

          1bd2ce7ba56c313c8e3483203242395b7eacdd0eef4d8324672a265d6abbeae2cfe0029d2160c79109703cb3f65513bef0b04386f257c746c3e680830a14dd56

        • C:\Windows\System\spoolsv.exe

          Filesize

          3.9MB

          MD5

          3f467bfda5c756bccb8da68b8b1b2488

          SHA1

          9c2b20b3ade5b9a089d670583670eb972ef6e35f

          SHA256

          ef68a2633b83136fc79ce5e8aa9d0e3f3a08ec42633bbc7c6ba55ebe1e69ae3c

          SHA512

          556cfb176ff5b55011fd0ce9273a8fdca1db14888bec350dab63d97f9b3fe8085e6b6c314508152353306a6b3a73e3bf7efa847d1d2faeb7315204366bcf60fc

        • \??\c:\windows\system\explorer.exe

          Filesize

          3.9MB

          MD5

          a80205e66ddb43f5d0b1c127920f97a6

          SHA1

          92a85095a53e9cfa1787eaee6e5ee02ba3988507

          SHA256

          48cf84258432d7306eb31fe65e207cd83c204cb5c3bac02addd2159a19879cee

          SHA512

          d3aeea2c7591597437fcf764e32677bb907b241c863ba04bef86b2bf4b8e90d0f570d35c3f5a931d0b69987ed5472382bf23c7c61864d3aff7eba121c37ab9d7

        • \??\c:\windows\system\svchost.exe

          Filesize

          3.9MB

          MD5

          01b8978899b4994fa349603a59e0e6b3

          SHA1

          27d4280b3d2707aae53c09369bd0635282deed66

          SHA256

          358fbd7abb7ea32b6cbc2fe53a41b97e4d26bda458bd5687082c63c3046fe7bc

          SHA512

          6a4174bbfe14419fe5ba266b7dc2f0fd5f1cceeea2beb296dc6210fc8f3ec5946676b9d7ca232d2d23dddeb5219d72b66fb9aba7ff6b7d5a76c9b7bd79a20440

        • memory/380-1-0x000000007FA70000-0x000000007FE41000-memory.dmp

          Filesize

          3.8MB

        • memory/380-45-0x000000007FA70000-0x000000007FE41000-memory.dmp

          Filesize

          3.8MB

        • memory/380-43-0x0000000000400000-0x0000000001156000-memory.dmp

          Filesize

          13.3MB

        • memory/380-0-0x0000000000400000-0x0000000001156000-memory.dmp

          Filesize

          13.3MB

        • memory/1416-64-0x0000000000400000-0x0000000001156000-memory.dmp

          Filesize

          13.3MB

        • memory/1416-74-0x0000000000400000-0x0000000001156000-memory.dmp

          Filesize

          13.3MB

        • memory/1416-68-0x0000000000400000-0x0000000001156000-memory.dmp

          Filesize

          13.3MB

        • memory/1416-66-0x0000000000400000-0x0000000001156000-memory.dmp

          Filesize

          13.3MB

        • memory/1416-54-0x0000000000400000-0x0000000001156000-memory.dmp

          Filesize

          13.3MB

        • memory/1416-70-0x0000000000400000-0x0000000001156000-memory.dmp

          Filesize

          13.3MB

        • memory/1416-72-0x0000000000400000-0x0000000001156000-memory.dmp

          Filesize

          13.3MB

        • memory/1416-30-0x000000007FA70000-0x000000007FE41000-memory.dmp

          Filesize

          3.8MB

        • memory/1416-76-0x0000000000400000-0x0000000001156000-memory.dmp

          Filesize

          13.3MB

        • memory/1416-62-0x0000000000400000-0x0000000001156000-memory.dmp

          Filesize

          13.3MB

        • memory/1416-60-0x0000000000400000-0x0000000001156000-memory.dmp

          Filesize

          13.3MB

        • memory/1416-49-0x0000000000400000-0x0000000001156000-memory.dmp

          Filesize

          13.3MB

        • memory/1416-58-0x0000000000400000-0x0000000001156000-memory.dmp

          Filesize

          13.3MB

        • memory/1416-51-0x0000000000400000-0x0000000001156000-memory.dmp

          Filesize

          13.3MB

        • memory/1416-52-0x000000007FA70000-0x000000007FE41000-memory.dmp

          Filesize

          3.8MB

        • memory/1416-56-0x0000000000400000-0x0000000001156000-memory.dmp

          Filesize

          13.3MB

        • memory/1992-63-0x0000000000400000-0x0000000001156000-memory.dmp

          Filesize

          13.3MB

        • memory/1992-65-0x0000000000400000-0x0000000001156000-memory.dmp

          Filesize

          13.3MB

        • memory/1992-53-0x0000000000400000-0x0000000001156000-memory.dmp

          Filesize

          13.3MB

        • memory/1992-57-0x0000000000400000-0x0000000001156000-memory.dmp

          Filesize

          13.3MB

        • memory/1992-50-0x0000000000400000-0x0000000001156000-memory.dmp

          Filesize

          13.3MB

        • memory/1992-59-0x0000000000400000-0x0000000001156000-memory.dmp

          Filesize

          13.3MB

        • memory/1992-48-0x0000000000400000-0x0000000001156000-memory.dmp

          Filesize

          13.3MB

        • memory/1992-61-0x0000000000400000-0x0000000001156000-memory.dmp

          Filesize

          13.3MB

        • memory/1992-47-0x0000000000400000-0x0000000001156000-memory.dmp

          Filesize

          13.3MB

        • memory/1992-10-0x0000000000400000-0x0000000001156000-memory.dmp

          Filesize

          13.3MB

        • memory/1992-75-0x0000000000400000-0x0000000001156000-memory.dmp

          Filesize

          13.3MB

        • memory/1992-55-0x0000000000400000-0x0000000001156000-memory.dmp

          Filesize

          13.3MB

        • memory/1992-11-0x000000007FA70000-0x000000007FE41000-memory.dmp

          Filesize

          3.8MB

        • memory/1992-67-0x0000000000400000-0x0000000001156000-memory.dmp

          Filesize

          13.3MB

        • memory/1992-73-0x0000000000400000-0x0000000001156000-memory.dmp

          Filesize

          13.3MB

        • memory/1992-69-0x0000000000400000-0x0000000001156000-memory.dmp

          Filesize

          13.3MB

        • memory/1992-71-0x0000000000400000-0x0000000001156000-memory.dmp

          Filesize

          13.3MB

        • memory/2280-21-0x000000007FA70000-0x000000007FE41000-memory.dmp

          Filesize

          3.8MB

        • memory/2280-20-0x0000000000400000-0x0000000001156000-memory.dmp

          Filesize

          13.3MB

        • memory/2280-44-0x0000000000400000-0x0000000001156000-memory.dmp

          Filesize

          13.3MB

        • memory/3996-35-0x0000000000400000-0x0000000001156000-memory.dmp

          Filesize

          13.3MB

        • memory/3996-36-0x000000007FA70000-0x000000007FE41000-memory.dmp

          Filesize

          3.8MB

        • memory/3996-40-0x0000000000400000-0x0000000001156000-memory.dmp

          Filesize

          13.3MB