Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    142s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/04/2024, 00:04

General

  • Target

    a67b142a24413f171257225a4de7742dd738e2dd4810f2405f6621a836ee3cd5.exe

  • Size

    217KB

  • MD5

    83f557aa5169668c7fbf72243da80d24

  • SHA1

    bc7935296343fee42ce2cdbddeaa900832c39e57

  • SHA256

    a67b142a24413f171257225a4de7742dd738e2dd4810f2405f6621a836ee3cd5

  • SHA512

    be1062701dd8e6389c89832f418d23ea37fa8dc1bcf8ae5a360abf0ea4b6f1dc1aca0f32dbfd76a6847654bfa403c461f9755ecd3c9f0ab69c8f44c8fa6ad95b

  • SSDEEP

    6144:KrRaTyDOnlo7eM+mlkWgRXOqobzWjozm2ulYM6Y:QsTbzu1glovW4EH6Y

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Modifies WinLogon 2 TTPs 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a67b142a24413f171257225a4de7742dd738e2dd4810f2405f6621a836ee3cd5.exe
    "C:\Users\Admin\AppData\Local\Temp\a67b142a24413f171257225a4de7742dd738e2dd4810f2405f6621a836ee3cd5.exe"
    1⤵
    • Modifies WinLogon
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:3508
    • C:\Windows\apppatch\svchost.exe
      "C:\Windows\apppatch\svchost.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Executes dropped EXE
      • Modifies WinLogon
      • Suspicious behavior: EnumeratesProcesses
      PID:1588

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\SB302YPZ\login[5].htm

    Filesize

    168B

    MD5

    d57e3a550060f85d44a175139ea23021

    SHA1

    2c5cb3428a322c9709a34d04dd86fe7628f8f0a6

    SHA256

    43edf068d34276e8ade4113d4d7207de19fc98a2ae1c07298e593edae2a8774c

    SHA512

    0364fe6a010fce7a3f4a6344c84468c64b20fd131f3160fc649db78f1075ba52d8a1c4496e50dbe27c357e01ee52e94cdcda8f7927cba28d5f2f45b9da690063

  • C:\Users\Admin\AppData\Local\Temp\5863.tmp

    Filesize

    22KB

    MD5

    2b11dbd97ddcccf18ca3bf003f64627f

    SHA1

    9799b905f0b0cb579d39cbdcd8c3255b62e959f5

    SHA256

    e45a55b6038dbc4f680348ebb135a663621cf41f91b14ecbf806e21f0a372575

    SHA512

    84e43aaf75bde730554c9a9020aa7be29f364d65c85e26869b375cbd9d4a567de29017f970ed310ed872c257f11be79445b7178d0bbb6cd196e70d6a902c6c5c

  • C:\Users\Admin\AppData\Local\Temp\61F1.tmp

    Filesize

    481B

    MD5

    8fd618a9682afadc7b5f16d04b897d20

    SHA1

    5dd4128b8ec769cb3a339f4aa8746ec7fdf5df54

    SHA256

    76af337688ef9bd7e4575dc4f1a61d87540c256db588335d7f70d25ad689aa14

    SHA512

    9883a613570dee32921c45e83cdb0d4db25d9c37c46dfdde35cbe254aac67253c915bcf9b8ebc905ef3edfafe8efaa1d5bf0bd6902b6a2c54190bb8292b5661b

  • C:\Users\Admin\AppData\Local\Temp\74FE.tmp

    Filesize

    593B

    MD5

    926512864979bc27cf187f1de3f57aff

    SHA1

    acdeb9d6187932613c7fa08eaf28f0cd8116f4b5

    SHA256

    b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f

    SHA512

    f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b

  • C:\Users\Admin\AppData\Local\Temp\E979.tmp

    Filesize

    42KB

    MD5

    2e5bfe6c34d205dff0fab0305902fdf9

    SHA1

    5dae289e59ac882005515fb1c8e8582970418a32

    SHA256

    44ff27df05739568d579cc5de219da363b9b80c52fd22e35977f316493bee262

    SHA512

    fe4212f109ac0d388f427516f9adff6c5cde420257c05463a23558c000fa7e78f0fd29a55eb041ac62c8546d9bd27a59fdb9238a753abd56669c14ca064906f9

  • C:\Users\Admin\AppData\Local\Temp\EA17.tmp

    Filesize

    481B

    MD5

    42331834f458d7c20ffd3d48e4f46564

    SHA1

    98be5937890866e43063cc7de2e77f43b760b596

    SHA256

    faa00c3a3f877a0bb42ea11ab13dee46ca5703d7043cb026e512f4cd60529d43

    SHA512

    90dd5cfeb5f68d63b528dcf531d782a5b4b63c1e11da80e2ecd21261fcbeed45e37d6747579ea7a8aa3f15bcb67d91b21b69ed9bba5086f850f89905eef67e7b

  • C:\Windows\apppatch\svchost.exe

    Filesize

    217KB

    MD5

    b01f18edd5f5bd9e0e3d1a2a3f39b1fe

    SHA1

    54a9cfba34387cdf471793a88dbda329252e2bb1

    SHA256

    482639d35f9539ecc08ce66cc9abc4f159e0647e243ef4731ce52bf58a6491ad

    SHA512

    5d785028a2c08d7d340c7c7cabdb1d69a2c5e640dd7f2187870ec09e5770af08290d4fb530ddff00a25904518811c468a4e81b0b0315b5e6dd20086ccf780e07

  • memory/1588-42-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

  • memory/1588-47-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

  • memory/1588-23-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

  • memory/1588-24-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

  • memory/1588-26-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

  • memory/1588-25-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

  • memory/1588-27-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

  • memory/1588-28-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

  • memory/1588-29-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

  • memory/1588-30-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

  • memory/1588-32-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

  • memory/1588-33-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

  • memory/1588-34-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

  • memory/1588-36-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

  • memory/1588-37-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

  • memory/1588-38-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

  • memory/1588-39-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

  • memory/1588-40-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

  • memory/1588-41-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

  • memory/1588-18-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

  • memory/1588-43-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

  • memory/1588-44-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

  • memory/1588-45-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

  • memory/1588-21-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

  • memory/1588-57-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

  • memory/1588-59-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

  • memory/1588-60-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

  • memory/1588-61-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

  • memory/1588-63-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

  • memory/1588-67-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

  • memory/1588-68-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

  • memory/1588-71-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

  • memory/1588-76-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

  • memory/1588-79-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

  • memory/1588-13-0x0000000000400000-0x0000000000589000-memory.dmp

    Filesize

    1.5MB

  • memory/1588-15-0x00000000024D0000-0x0000000002521000-memory.dmp

    Filesize

    324KB

  • memory/1588-319-0x0000000000400000-0x0000000000589000-memory.dmp

    Filesize

    1.5MB

  • memory/1588-320-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

  • memory/1588-17-0x00000000028B0000-0x0000000002958000-memory.dmp

    Filesize

    672KB

  • memory/1588-16-0x0000000000400000-0x0000000000589000-memory.dmp

    Filesize

    1.5MB

  • memory/3508-0-0x0000000000400000-0x0000000000589000-memory.dmp

    Filesize

    1.5MB

  • memory/3508-1-0x00000000022D0000-0x0000000002321000-memory.dmp

    Filesize

    324KB

  • memory/3508-2-0x0000000000400000-0x0000000000589000-memory.dmp

    Filesize

    1.5MB

  • memory/3508-11-0x00000000022D0000-0x0000000002321000-memory.dmp

    Filesize

    324KB

  • memory/3508-14-0x0000000000400000-0x0000000000589000-memory.dmp

    Filesize

    1.5MB