Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    1206s
  • max time network
    1214s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/04/2024, 18:15

General

  • Target

    Multi_Menu_Injector_V2.exe

  • Size

    337KB

  • MD5

    940ca5f0664cb25bd69e771fc2fc3935

  • SHA1

    de610bb532a61898aff07e51eae6e81e47b88b70

  • SHA256

    5843a30474524689d1972bde16bca17160632b0f20200b61ea2f78ace5d4d905

  • SHA512

    afff043c973a859014d883bdac2fa56115a98cf8f4e7a5c9ffd9f966d379b6afb4a435df1675e0ed2303dca97e2569509e13f5e342723cc100b3e7ca948177e4

  • SSDEEP

    6144:Toob0G8fgKSqBKpGNrvo6ilVfpf5h4KdUgr9RjczIyAD8fU6bkD+NrgJf9:hILYKbBKpG5QlVl5h1dDr96ADTD+RgJF

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 20 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 22 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\Multi_Menu_Injector_V2.exe
    "C:\Users\Admin\AppData\Local\Temp\Multi_Menu_Injector_V2.exe"
    1⤵
    • Checks computer location settings
    • Drops startup file
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4792
    • C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "WindowsSubDir" /tr "C:\Users\Admin\AppData\Roaming\WindowsSubDir.exe"
      2⤵
      • Creates scheduled task(s)
      PID:3192
  • C:\Users\Admin\AppData\Roaming\WindowsSubDir.exe
    C:\Users\Admin\AppData\Roaming\WindowsSubDir.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:1828
  • C:\Users\Admin\AppData\Roaming\WindowsSubDir.exe
    C:\Users\Admin\AppData\Roaming\WindowsSubDir.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:752
  • C:\Users\Admin\AppData\Roaming\WindowsSubDir.exe
    C:\Users\Admin\AppData\Roaming\WindowsSubDir.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:4564
  • C:\Users\Admin\AppData\Roaming\WindowsSubDir.exe
    C:\Users\Admin\AppData\Roaming\WindowsSubDir.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:1916
  • C:\Users\Admin\AppData\Roaming\WindowsSubDir.exe
    C:\Users\Admin\AppData\Roaming\WindowsSubDir.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:4080
  • C:\Users\Admin\AppData\Roaming\WindowsSubDir.exe
    C:\Users\Admin\AppData\Roaming\WindowsSubDir.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:2212
  • C:\Users\Admin\AppData\Roaming\WindowsSubDir.exe
    C:\Users\Admin\AppData\Roaming\WindowsSubDir.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:4616
  • C:\Users\Admin\AppData\Roaming\WindowsSubDir.exe
    C:\Users\Admin\AppData\Roaming\WindowsSubDir.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:4056
  • C:\Users\Admin\AppData\Roaming\WindowsSubDir.exe
    C:\Users\Admin\AppData\Roaming\WindowsSubDir.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:4608
  • C:\Users\Admin\AppData\Roaming\WindowsSubDir.exe
    C:\Users\Admin\AppData\Roaming\WindowsSubDir.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:100
  • C:\Users\Admin\AppData\Roaming\WindowsSubDir.exe
    C:\Users\Admin\AppData\Roaming\WindowsSubDir.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:3360
  • C:\Users\Admin\AppData\Roaming\WindowsSubDir.exe
    C:\Users\Admin\AppData\Roaming\WindowsSubDir.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:3356
  • C:\Users\Admin\AppData\Roaming\WindowsSubDir.exe
    C:\Users\Admin\AppData\Roaming\WindowsSubDir.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:2032
  • C:\Users\Admin\AppData\Roaming\WindowsSubDir.exe
    C:\Users\Admin\AppData\Roaming\WindowsSubDir.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:456
  • C:\Users\Admin\AppData\Roaming\WindowsSubDir.exe
    C:\Users\Admin\AppData\Roaming\WindowsSubDir.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:3608
  • C:\Users\Admin\AppData\Roaming\WindowsSubDir.exe
    C:\Users\Admin\AppData\Roaming\WindowsSubDir.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:1768
  • C:\Users\Admin\AppData\Roaming\WindowsSubDir.exe
    C:\Users\Admin\AppData\Roaming\WindowsSubDir.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:3412
  • C:\Users\Admin\AppData\Roaming\WindowsSubDir.exe
    C:\Users\Admin\AppData\Roaming\WindowsSubDir.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:952
  • C:\Users\Admin\AppData\Roaming\WindowsSubDir.exe
    C:\Users\Admin\AppData\Roaming\WindowsSubDir.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:1880
  • C:\Users\Admin\AppData\Roaming\WindowsSubDir.exe
    C:\Users\Admin\AppData\Roaming\WindowsSubDir.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:3256

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\WindowsSubDir.exe.log

    Filesize

    654B

    MD5

    2ff39f6c7249774be85fd60a8f9a245e

    SHA1

    684ff36b31aedc1e587c8496c02722c6698c1c4e

    SHA256

    e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced

    SHA512

    1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1

  • C:\Users\Admin\AppData\Roaming\WindowsSubDir.exe

    Filesize

    337KB

    MD5

    940ca5f0664cb25bd69e771fc2fc3935

    SHA1

    de610bb532a61898aff07e51eae6e81e47b88b70

    SHA256

    5843a30474524689d1972bde16bca17160632b0f20200b61ea2f78ace5d4d905

    SHA512

    afff043c973a859014d883bdac2fa56115a98cf8f4e7a5c9ffd9f966d379b6afb4a435df1675e0ed2303dca97e2569509e13f5e342723cc100b3e7ca948177e4

  • memory/100-42-0x00007FFD01CF0000-0x00007FFD027B1000-memory.dmp

    Filesize

    10.8MB

  • memory/100-41-0x00007FFD01CF0000-0x00007FFD027B1000-memory.dmp

    Filesize

    10.8MB

  • memory/456-53-0x00007FFD01CF0000-0x00007FFD027B1000-memory.dmp

    Filesize

    10.8MB

  • memory/456-54-0x00007FFD01CF0000-0x00007FFD027B1000-memory.dmp

    Filesize

    10.8MB

  • memory/752-17-0x00007FFD01CF0000-0x00007FFD027B1000-memory.dmp

    Filesize

    10.8MB

  • memory/752-18-0x00007FFD01CF0000-0x00007FFD027B1000-memory.dmp

    Filesize

    10.8MB

  • memory/952-66-0x00007FFD01CF0000-0x00007FFD027B1000-memory.dmp

    Filesize

    10.8MB

  • memory/952-65-0x00007FFD01CF0000-0x00007FFD027B1000-memory.dmp

    Filesize

    10.8MB

  • memory/1768-60-0x00007FFD01CF0000-0x00007FFD027B1000-memory.dmp

    Filesize

    10.8MB

  • memory/1768-59-0x00007FFD01CF0000-0x00007FFD027B1000-memory.dmp

    Filesize

    10.8MB

  • memory/1828-13-0x00007FFD01CF0000-0x00007FFD027B1000-memory.dmp

    Filesize

    10.8MB

  • memory/1828-11-0x00007FFD01CF0000-0x00007FFD027B1000-memory.dmp

    Filesize

    10.8MB

  • memory/1880-68-0x00007FFD01CF0000-0x00007FFD027B1000-memory.dmp

    Filesize

    10.8MB

  • memory/1880-69-0x00007FFD01CF0000-0x00007FFD027B1000-memory.dmp

    Filesize

    10.8MB

  • memory/1916-24-0x00007FFD01CF0000-0x00007FFD027B1000-memory.dmp

    Filesize

    10.8MB

  • memory/1916-23-0x00007FFD01CF0000-0x00007FFD027B1000-memory.dmp

    Filesize

    10.8MB

  • memory/2032-50-0x00007FFD01CF0000-0x00007FFD027B1000-memory.dmp

    Filesize

    10.8MB

  • memory/2032-51-0x00007FFD01CF0000-0x00007FFD027B1000-memory.dmp

    Filesize

    10.8MB

  • memory/2212-30-0x00007FFD01CF0000-0x00007FFD027B1000-memory.dmp

    Filesize

    10.8MB

  • memory/2212-29-0x00007FFD01CF0000-0x00007FFD027B1000-memory.dmp

    Filesize

    10.8MB

  • memory/3256-72-0x00007FFD01CF0000-0x00007FFD027B1000-memory.dmp

    Filesize

    10.8MB

  • memory/3256-71-0x00007FFD01CF0000-0x00007FFD027B1000-memory.dmp

    Filesize

    10.8MB

  • memory/3356-47-0x00007FFD01CF0000-0x00007FFD027B1000-memory.dmp

    Filesize

    10.8MB

  • memory/3356-48-0x00007FFD01CF0000-0x00007FFD027B1000-memory.dmp

    Filesize

    10.8MB

  • memory/3360-44-0x00007FFD01CF0000-0x00007FFD027B1000-memory.dmp

    Filesize

    10.8MB

  • memory/3360-45-0x00007FFD01CF0000-0x00007FFD027B1000-memory.dmp

    Filesize

    10.8MB

  • memory/3412-63-0x00007FFD01CF0000-0x00007FFD027B1000-memory.dmp

    Filesize

    10.8MB

  • memory/3412-62-0x00007FFD01CF0000-0x00007FFD027B1000-memory.dmp

    Filesize

    10.8MB

  • memory/3608-56-0x00007FFD01CF0000-0x00007FFD027B1000-memory.dmp

    Filesize

    10.8MB

  • memory/3608-57-0x00007FFD01CF0000-0x00007FFD027B1000-memory.dmp

    Filesize

    10.8MB

  • memory/4056-36-0x00007FFD01CF0000-0x00007FFD027B1000-memory.dmp

    Filesize

    10.8MB

  • memory/4056-35-0x00007FFD01CF0000-0x00007FFD027B1000-memory.dmp

    Filesize

    10.8MB

  • memory/4080-27-0x00007FFD01CF0000-0x00007FFD027B1000-memory.dmp

    Filesize

    10.8MB

  • memory/4080-26-0x00007FFD01CF0000-0x00007FFD027B1000-memory.dmp

    Filesize

    10.8MB

  • memory/4564-21-0x00007FFD01CF0000-0x00007FFD027B1000-memory.dmp

    Filesize

    10.8MB

  • memory/4564-20-0x00007FFD01CF0000-0x00007FFD027B1000-memory.dmp

    Filesize

    10.8MB

  • memory/4608-38-0x00007FFD01CF0000-0x00007FFD027B1000-memory.dmp

    Filesize

    10.8MB

  • memory/4608-39-0x00007FFD01CF0000-0x00007FFD027B1000-memory.dmp

    Filesize

    10.8MB

  • memory/4616-33-0x00007FFD01CF0000-0x00007FFD027B1000-memory.dmp

    Filesize

    10.8MB

  • memory/4616-32-0x00007FFD01CF0000-0x00007FFD027B1000-memory.dmp

    Filesize

    10.8MB

  • memory/4792-0-0x0000000000210000-0x000000000026E000-memory.dmp

    Filesize

    376KB

  • memory/4792-8-0x000000001AD60000-0x000000001AD70000-memory.dmp

    Filesize

    64KB

  • memory/4792-7-0x00007FFD01CF0000-0x00007FFD027B1000-memory.dmp

    Filesize

    10.8MB

  • memory/4792-2-0x000000001AD60000-0x000000001AD70000-memory.dmp

    Filesize

    64KB

  • memory/4792-1-0x00007FFD01CF0000-0x00007FFD027B1000-memory.dmp

    Filesize

    10.8MB