Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/04/2024, 16:19

General

  • Target

    vts.exe

  • Size

    917KB

  • MD5

    bbecb93aeacc1abf8cee9d9b91833900

  • SHA1

    97d303be086f700918a9ddf4da58685961526738

  • SHA256

    844922b5e7c0681325cfd27ece32c4c8a319c6054d4e2dd6d5b7f22ed31c22db

  • SHA512

    af59d9ad84bc3381eb556f78d8578b76db145048fca4bfd48afa31cd03a54d75ae806f30b3f01207a5a75cf188735154c79dc5f494f5785a52b4868979150cc7

  • SSDEEP

    12288:KJv3ZOdEktgWXuuHEXqBHaYfdHIXVCvQVW7en0RnK9Fuw69oWQo71abz6cLpm1u:K1gW7ukaBHaOh8V5vsmFdMR4zRLpyu

Score
8/10

Malware Config

Signatures

  • Blocklisted process makes network request 3 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious use of FindShellTrayWindow 6 IoCs
  • Suspicious use of SendNotifyMessage 6 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\vts.exe
    "C:\Users\Admin\AppData\Local\Temp\vts.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:3944
    • C:\Windows\SysWOW64\dllhost.exe
      dllhost.exe
      2⤵
        PID:2756
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c cmd < Giu.mui
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4268
        • C:\Windows\SysWOW64\cmd.exe
          cmd
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:3260
          • C:\Windows\SysWOW64\findstr.exe
            findstr /V /R "^kQLkrNVqMvVPjUboJryRqVXWRCKioBIlzPmMjILBcJFMqlgOxKxlShsdTPxBeNRkOLcvxKVqsEcdfkVGhVNnubsunpTbglnIRxYgORx$" Sento.mui
            4⤵
              PID:1940
            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Quel.exe.com
              Quel.exe.com h
              4⤵
              • Executes dropped EXE
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              • Suspicious use of WriteProcessMemory
              PID:4216
              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Quel.exe.com
                C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Quel.exe.com h
                5⤵
                • Checks computer location settings
                • Executes dropped EXE
                • Checks processor information in registry
                • Modifies registry class
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                • Suspicious use of WriteProcessMemory
                PID:4072
                • C:\Windows\SysWOW64\WScript.exe
                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\qhgoqspnpctk.vbs"
                  6⤵
                  • Blocklisted process makes network request
                  PID:1612
            • C:\Windows\SysWOW64\PING.EXE
              ping ETDALPOV -n 30
              4⤵
              • Runs ping.exe
              PID:3980

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\E9E4.tmp

        Filesize

        297B

        MD5

        bd0c2d8e6b0fe0de4a3869c02ee43a85

        SHA1

        21d8cca90ea489f88c2953156e6c3dec6945388b

        SHA256

        3a3e433f615f99529721ee766ad453b75d73fe213cb1ab74ccbb4c0e32dcd533

        SHA512

        496b1285f1e78d50dd79b05fa2cbf4a0b655bb3e4515646be3a7c7cdf85d7db6ab35577aa1e294f3d515d707ca341652b5ae9d4b22197e4480226ef8440294b6

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Abbozzo.mui

        Filesize

        639KB

        MD5

        4e8629baecebd43750f2bbe47802bd9f

        SHA1

        84f87ce1213739e98d38d9878a535ec130dd2004

        SHA256

        e7f1abdf2fb4607f636e416b062f5b05a23aeba881a4f09a8083ca19a553811f

        SHA512

        3c355d3899100845d04be80b5537881e7ee5fd2516d4c2c89b3f2e511070c5455e8bee5dc6c6b71a0b55d6a9af6cd8a1f97fb4f46ce19a0a1412a5615340724e

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Gia.mui

        Filesize

        139KB

        MD5

        0f8a38c30c0a09f00eaf19395d8a40f2

        SHA1

        298afde1f0db4b527822370df772b7dc0371b92c

        SHA256

        aa12257d1c3ee82287d6c617359aaa2592f3bb9d0cca991f89660bb696ba8183

        SHA512

        ba89f3e76af52d7fb11e0d29c3e68a947611bcf3f18125c3ae2ba4538ff349c0fb13dac573bb3bb76cde231c464f623e266b34cdf58bd0321c96c856795a98be

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Giu.mui

        Filesize

        501B

        MD5

        c4f3aeb64246483fc44207f319c5b121

        SHA1

        b1ce99afe2e145d6e7a5d419c0b9e5614f680729

        SHA256

        0a718358ad31b418775f66874a055d4174f0f81326cd76513db2e086f908beeb

        SHA512

        deaf054f84f600b122bc7f2bd71e716fc05e0f2818cfe63b38573a9af7789ddd3134a1b2f796ff131ba1c7cd4bf74c82bd7d5136507288e872648fbe0ababd2a

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Quel.exe.com

        Filesize

        872KB

        MD5

        c56b5f0201a3b3de53e561fe76912bfd

        SHA1

        2a4062e10a5de813f5688221dbeb3f3ff33eb417

        SHA256

        237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

        SHA512

        195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Sento.mui

        Filesize

        872KB

        MD5

        84b0184010185fb22db4d7451492ae5f

        SHA1

        6f5a12664555342f958030c118db7e5b78d78d7d

        SHA256

        ddabd3d20c02f109925f46c56cba701f2bec2cffbe1f3800b2442a6cd4ab3d2d

        SHA512

        6d38495a4b85862787c7de720d2e0c71762202c770212cc91a389a8768b80fd920f52adf3e0bc0f8d81fedd15be95afa39d14c96a07617eb476908f088aec814

      • C:\Users\Admin\AppData\Local\Temp\qhgoqspnpctk.vbs

        Filesize

        136B

        MD5

        c3bcda4b5dfff7a6a73391a68a8e6f3b

        SHA1

        f51a72e61c05fc8b625a481775f971490a1b6b1b

        SHA256

        da2c59a5ceaa1642d452d896d65e220b85517430ce87c2debc963b0948b8c5e3

        SHA512

        6678f136452db27f5d9699acac6837ee15bb975ee3d0c3d1547dee3e95aa02ccf703c04db2d2ed1cb44c77bf75b15c4c7acdbd066d65febf95f4fc111f8cc541

      • memory/4072-24-0x00000000040B0000-0x00000000040D7000-memory.dmp

        Filesize

        156KB

      • memory/4072-23-0x00000000040B0000-0x00000000040D7000-memory.dmp

        Filesize

        156KB

      • memory/4072-25-0x00000000040B0000-0x00000000040D7000-memory.dmp

        Filesize

        156KB

      • memory/4072-26-0x00000000040B0000-0x00000000040D7000-memory.dmp

        Filesize

        156KB

      • memory/4072-27-0x00000000040B0000-0x00000000040D7000-memory.dmp

        Filesize

        156KB

      • memory/4072-28-0x00000000040B0000-0x00000000040D7000-memory.dmp

        Filesize

        156KB

      • memory/4072-22-0x00000000040B0000-0x00000000040D7000-memory.dmp

        Filesize

        156KB

      • memory/4072-41-0x00000000040B0000-0x00000000040D7000-memory.dmp

        Filesize

        156KB

      • memory/4072-21-0x0000000001140000-0x0000000001141000-memory.dmp

        Filesize

        4KB