Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

3

0e095c3092...d9.exe

windows7-x64

8

0e095c3092...d9.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    135s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/04/2024, 03:08

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0e095c3092315573dfadd39e8ca0d7f4d300f207837b8ae5f6e5412f906fbdd9.exe

  • Size

    403KB

  • MD5

    425368e2d60f948abb74bb3cc93140da

  • SHA1

    786a4092d9c50c39d28d30587ac62c9959c426e0

  • SHA256

    0e095c3092315573dfadd39e8ca0d7f4d300f207837b8ae5f6e5412f906fbdd9

  • SHA512

    0b7eff963a9c9ef76f300167c6abf4108cdbe25a7456fbcabce51912f26ad68c16304a00e3cf24cec9198a631f3acfeb69f482ad881c4e817f9b389ebee84196

  • SSDEEP

    6144:3w9D91dOrcN3ZGXNYFNmIkYvUIelVjjVtGRyFH4g:gtRfJcNYFNm8UhlZGseg

Score
8/10
bootkitpersistencespywarestealer

Malware Config

Signatures

  • Blocklisted process makes network request 8 IoCs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0e095c3092315573dfadd39e8ca0d7f4d300f207837b8ae5f6e5412f906fbdd9.exe
    "C:\Users\Admin\AppData\Local\Temp\0e095c3092315573dfadd39e8ca0d7f4d300f207837b8ae5f6e5412f906fbdd9.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3160
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c ping 127.0.0.1 -n 2&C:\Users\Admin\AppData\Local\Temp\\htwqphui.exe "C:\Users\Admin\AppData\Local\Temp\0e095c3092315573dfadd39e8ca0d7f4d300f207837b8ae5f6e5412f906fbdd9.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1160
      • C:\Windows\SysWOW64\PING.EXE
        ping 127.0.0.1 -n 2
        3⤵
        • Runs ping.exe
        PID:3076
      • C:\Users\Admin\AppData\Local\Temp\htwqphui.exe
        C:\Users\Admin\AppData\Local\Temp\\htwqphui.exe "C:\Users\Admin\AppData\Local\Temp\0e095c3092315573dfadd39e8ca0d7f4d300f207837b8ae5f6e5412f906fbdd9.exe"
        3⤵
        • Deletes itself
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2060
        • \??\c:\windows\SysWOW64\rundll32.exe
          c:\windows\system32\rundll32.exe "c:\Program Files\uzvylbk\hrbgzd.dll",Verify C:\Users\Admin\AppData\Local\Temp\htwqphui.exe
          4⤵
          • Blocklisted process makes network request
          • Loads dropped DLL
          • Adds Run key to start application
          • Enumerates connected drives
          • Writes to the Master Boot Record (MBR)
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Checks processor information in registry
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1048

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\htwqphui.exe
    Filesize

    403KB

    MD5

    5f006a15bce896b5fd55c1f6ccd0145e

    SHA1

    5f43113b9ec2598273f7533395005bfd41be6cfd

    SHA256

    1b25acbc55a3c3755c440a2d38657fcefac1f6bed65561d26ee3655007d89f0c

    SHA512

    bbe06e948ef9664533f0c3d654abbbd9fc21a6356d272ba9dc69bdde4da5e605fb954623e05f48edfc5023df373bc672d289e60de6170d0c325a24fcf8d34878

    Download Submit

  • \??\c:\Program Files\uzvylbk\hrbgzd.dll
    Filesize

    228KB

    MD5

    697d489336b69a7f4844319211d15b6d

    SHA1

    095b2e0de3ba398b7aa7a2d7937c8ac1d15bd406

    SHA256

    15b3a9af168cd8f22d4dd35185b2c1856076b964fde89d4aada75805fa35d332

    SHA512

    b11dff55e06a883c0cb4917e7475d03a4a81d4b4ee740ba7e1ecb75b99c16a0a10ba94c86124cddbfcebe6b79fd44aa9c0c9ae91bb19bc3054b10f238d6d6edf

    Download Submit

  • memory/1048-11-0x0000000010000000-0x0000000010080000-memory.dmp

    Filesize

    512KB

    Download

  • memory/1048-12-0x0000000010000000-0x0000000010080000-memory.dmp

    Filesize

    512KB

    Download

  • memory/1048-14-0x0000000010000000-0x0000000010080000-memory.dmp

    Filesize

    512KB

    Download

  • memory/2060-6-0x0000000000400000-0x0000000000464000-memory.dmp

    Filesize

    400KB

    Download

  • memory/2060-8-0x0000000000400000-0x0000000000464000-memory.dmp

    Filesize

    400KB

    Download

  • memory/3160-0-0x0000000000400000-0x0000000000464000-memory.dmp

    Filesize

    400KB

    Download

  • memory/3160-2-0x0000000000400000-0x0000000000464000-memory.dmp

    Filesize

    400KB

    Download