Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

17/04/2024, 08:54

240417-kt955aad45 7

17/04/2024, 08:54

240417-kt9jlaad44 7

17/04/2024, 08:54

240417-kt8masad42 7

17/04/2024, 08:54

240417-kt8bjabh6x 7

17/04/2024, 08:54

240417-kt7p1abh6w 7

17/04/2024, 06:26

240417-g7dsashd8w 7

Analysis

  • max time kernel
    301s
  • max time network
    306s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/04/2024, 06:26

General

  • Target

    ac075628b6cdb15172f6a76f0d3331316934e09cf0f0bd3a94c0e5e23b02a352.exe

  • Size

    14.1MB

  • MD5

    ca8759c6ed97044b07af776617d63e60

  • SHA1

    8d9c7a6ae0d7b04965881640f890fb824e17aa15

  • SHA256

    ac075628b6cdb15172f6a76f0d3331316934e09cf0f0bd3a94c0e5e23b02a352

  • SHA512

    8c90dbb2d346c52d6c0a2a34df3fa4258c573df654a57e9a2d1304b55e770a18f9ff8d7c5006e9ec3e3890e27723516ada82d10429666d3985dabe6ce2166c36

  • SSDEEP

    196608:zCKlOXcCT0AdpHeFsfghvbxyUPbHjTV2JOogd3dB3q91okxWeOZSzsvwQv/bUYLH:WSuQsoNxDV6oNr3qoL3Zy6wQvjUeWw

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 6 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 13 IoCs
  • Loads dropped DLL 10 IoCs
  • AutoIT Executable 2 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • NTFS ADS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of FindShellTrayWindow 33 IoCs
  • Suspicious use of SendNotifyMessage 33 IoCs
  • Suspicious use of WriteProcessMemory 26 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ac075628b6cdb15172f6a76f0d3331316934e09cf0f0bd3a94c0e5e23b02a352.exe
    "C:\Users\Admin\AppData\Local\Temp\ac075628b6cdb15172f6a76f0d3331316934e09cf0f0bd3a94c0e5e23b02a352.exe"
    1⤵
    • NTFS ADS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:8
    • C:\Users\Admin\AppData\Local\Temp\CL_Debug_Log.txt
      C:\Users\Admin\AppData\Local\Temp\CL_Debug_Log.txt e -p"JDQJndnqwdnqw2139dn21n3b312idDQDB" "C:\Users\Admin\AppData\Local\Temp\CR_Debug_Log.txt" -o"C:\Users\Admin\AppData\Local\Temp\"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:5108
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks.exe /Create /XML "C:\Users\Admin\AppData\Local\Temp\SystemCheck.xml" /TN "System\SystemCheck"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1028
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks.exe /Create /XML "C:\Users\Admin\AppData\Local\Temp\SystemCheck.xml" /TN "System\SystemCheck"
        3⤵
        • Creates scheduled task(s)
        PID:676
  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
    1⤵
    • Checks computer location settings
    • Executes dropped EXE
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4740
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck80104
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • NTFS ADS
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:1268
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
        7z e -p"DxSqsNKKOxqPrM4Y3xeK" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor.tmp" -o"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\"
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:3420
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\tor.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\tor.exe" -f TorConfig
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:2284
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3808 --field-trial-handle=2264,i,15001568551143786084,90255922961447677,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:1332
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
      1⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:3004
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck80104
        2⤵
        • Executes dropped EXE
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:3640
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
      1⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:3764
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck80104
        2⤵
        • Executes dropped EXE
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:396
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
      1⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:4152
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck80104
        2⤵
        • Executes dropped EXE
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:1200
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
      1⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:3020
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck80104
        2⤵
        • Executes dropped EXE
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2992

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\32.exe

      Filesize

      6.7MB

      MD5

      8c6d737d2266a938b8e771b661005e17

      SHA1

      94c29a32cac2540ffd996a97ada23a14504441d6

      SHA256

      f19a0113ff2e113dbb719a6851242aff2cd7463e9766eaafedc00cf3326513d9

      SHA512

      fcf801bb69cd76d0f0507a37f6b121fe90d9539101df0dd54d8acc56bf37a2af1ef64067dc2a850471ef9871d350cd6ec61997ba7acfb88117f6a8da3a2270df

    • C:\Users\Admin\AppData\Local\Temp\64.exe

      Filesize

      7.2MB

      MD5

      211f02e41dac48e00425276ecacfb4aa

      SHA1

      1f14aa92dcf21c82d20b953b42e18c46cf430dba

      SHA256

      193276f5205f9e85066726c045ce1277059ff095ac21bc0801c4b95960898845

      SHA512

      03e0bfb1cc8b09d3601bb5612622a4e79943077c22accad53d04fba441747bcd6ca2e58e3f161a2249f03bec84fadf3c1def263acc3be3ab3c8e5fe9a96c7975

    • C:\Users\Admin\AppData\Local\Temp\CL_Debug_Log.txt

      Filesize

      722KB

      MD5

      43141e85e7c36e31b52b22ab94d5e574

      SHA1

      cfd7079a9b268d84b856dc668edbb9ab9ef35312

      SHA256

      ea308c76a2f927b160a143d94072b0dce232e04b751f0c6432a94e05164e716d

      SHA512

      9119ae7500aa5cccf26a0f18fd8454245347e3c01dabba56a93dbaaab86535e62b1357170758f3b3445b8359e7dd5d37737318a5d8a6047c499d32d5b64126fc

    • C:\Users\Admin\AppData\Local\Temp\CR_Debug_Log.txt

      Filesize

      12.8MB

      MD5

      34c5a0f1e8e6bb660d79bafb4847ef3e

      SHA1

      92470fcb2e0b9cece22ad621e69a0767e002c029

      SHA256

      bb683ad4e14fffa2b9e852f0d1a51eb0218798502962c655f98d68a1bc3cc670

      SHA512

      c4d496de0463cb7795a43de43b0c89fd8dca5ef33e98beea01bdfe05f7e0c41328096a7e67913df72c7d086ae512537273ba05cea9847221cee5595b10b4e48a

    • C:\Users\Admin\AppData\Local\Temp\SystemCheck.xml

      Filesize

      2KB

      MD5

      9160347bec74471e1a79edfd950629ae

      SHA1

      c149a7e5aab6e349a70b7b458d0eaaa9d301c790

      SHA256

      0fe356f3d04bb43f772604b049fd2b20f3038ca2ce84bf9778b8ccdd481d77ab

      SHA512

      b8061834f658567a1e742496c38688bdecd60191a92163d47470f64aa1fba23e92dd36fa1d2bb7efa36f14002c0606013973718b9f107e62d845a17be4b0d358

    • C:\Users\Admin\AppData\Local\Temp\autFAB.tmp

      Filesize

      12.8MB

      MD5

      c80b046f7570cbb66be8162691ec5cbd

      SHA1

      71f42723bc23f6ca62295d84f444f80e29794372

      SHA256

      e26b37f53825e059fad1bd7ed23fed1bca84e1bdd65cb466bcd370e5340de4f3

      SHA512

      84bc317c3eb8a405ba5793153d782a04073d42381304568f9950466464e127126bc206e928a2ba19d05974dfdd7ae3083663a73033b185eea6b4d5ac67c175dc

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor.tmp

      Filesize

      2.1MB

      MD5

      4cd3f07fef4d2d847f9cbba628e8edb8

      SHA1

      bb901200c646be4bd215f713f9df9a965517dd13

      SHA256

      3925bef7666a8c8d8d3ab3a15733f7b64d4297741006348d25a703c338389e04

      SHA512

      cf0b29a45f499ed67ec639df591cd9b8ff592e91934d7e6957caaf6ed3c24b751a9885f854616bf3813898b73b253cb054f66540575ba3c19fa18c303de99e83

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\TorDataSocksListenAddress 127.0.0.1\cached-microdescs.new

      Filesize

      9.8MB

      MD5

      84d73abc7fd4790acdc8c2f1a054d621

      SHA1

      b1120e29746017de92037b3805ec5e064ae106e2

      SHA256

      a5ae0ea739ac3966af073a17f62aff6c125126b5f6bebb1dc75cc83d1555aea5

      SHA512

      29f98589b41a6dc5c66674991268b1fc96e054e7e976b71bbaff7fb592352d3493e743069491258492810be2bbfaacbbfef6383f1e0bdcb28ac17996b02f0e34

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\TorData\TorConfig

      Filesize

      201B

      MD5

      b9d2fe9cfa840518fa39039c928d4938

      SHA1

      0561516b7cfa784cf400349983817c8b18817256

      SHA256

      69d57bfb46ef8097c1cfca65885790421d0e0965b7778f165cd7df9368807776

      SHA512

      894510d39a044a37325d73b8348860960b3a78c54e7cdf81357f4b50e8dcf5d47ab98c768e6439949ba835802b2a5e98314441127d9655b027caf246e09e013d

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\libeay32.dll

      Filesize

      2.5MB

      MD5

      b57e3160f18f33dc9f69ec4ac83f8b0d

      SHA1

      651d39de229ce63ff85fba1d4ba3408bd93d8537

      SHA256

      c09d060e4f78e25bf6e27a6ac790871ac2eb87d8f18eb9f2dff8c7ac9c8d6330

      SHA512

      4e00f998151d81c05325b3537c9a4ff87279d96a7205f267cd5c1cbe78f460aad82ce98c868d4a63c6dae3812810614f4ea340051dd646aecb5f67a5b12deff4

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\libevent-2-1-6.dll

      Filesize

      840KB

      MD5

      52dc140cbb14e2154e9087ecbc8cdc28

      SHA1

      68a2c92e99a283a67b898fd3208c19160cd36617

      SHA256

      b946b94a6abec862e0685327f76f5f55ed690268c4cd3ceb4018acd6e0e12d6e

      SHA512

      4dc2bd64cfcf4fce6f2030b2077df212da260d89505f16e71e1f06eae7d45437831c34e4de6c1d24ae0b02ca142e261eb363b495595cfd6e404d2304c403ebb0

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\libgcc_s_sjlj-1.dll

      Filesize

      967KB

      MD5

      286cdf5fdb6414f3e0508c446af62c30

      SHA1

      394d333371cad5735f09ed8bed128448b1b965ea

      SHA256

      481c13cf972fafa748486fbbd0366a44babaeabd19ba56e691bb3a064c653153

      SHA512

      9ffe9f6d881df0b6a35e9cc7636b64097196102115d9451dd4db71d22fb37ccedfe32879952cd979f85247bb8168f9df95af18dc0eba478deafb2301a6b24c1c

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\libssp-0.dll

      Filesize

      272KB

      MD5

      606110186930c205e48942975a851ca4

      SHA1

      d2b7a21bd55a035e2a7813eccc9e33f5f7815823

      SHA256

      33115d4f22517c23939d8f8ab65bbb35cccb5d463ba81b44623e3cb57c8867f7

      SHA512

      3b00c7fecdbaec3fced8f8ecb2b0351d406a3d0a461011140f60d9e1e52afcef3b92baa8c1079ce01716ba266a975c0f54e16f282bf4cf97fafa2e0164c0245c

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\libwinpthread-1.dll

      Filesize

      499KB

      MD5

      40a7215c1bd90c1da72b1d4e139f1821

      SHA1

      9106d6140ceec25059c6fd8bbead9005346c88a9

      SHA256

      c115d1a52cd1e848969928a07dbc5312c53c10380bf44a7cdd82a31d5f37404e

      SHA512

      11d1b8a704d02b413822a2bdf8f0c9ea4e5a72509484e1ce96033b226ffb6ef3bdfed0bb05ea3c2396bc7543d9fa0d1f04169277deeeb341186e2ae9de500019

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\ssleay32.dll

      Filesize

      769KB

      MD5

      6536e58d90b2e9ded05097163d81642c

      SHA1

      ce1b8e8db12a8bc5de1eba1f25a02e4e2e9ac22a

      SHA256

      e6093fe75346ec927fe3f0eb79ea0d331a3b0493267d488018c8693c9cef9252

      SHA512

      8a766313525cd4268a27843daf588adbbb5ea7476fe0c2c33321ec2e5d9219d6fa335c8f8dcfbb073578631d032416d8ccf7bfa4a7fd89031314bbc981feefea

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\tor.exe

      Filesize

      3.6MB

      MD5

      6b179fa8138ae6135d194f19c93e38af

      SHA1

      0a18edd6b76ff09b6132be574caa4502d8ef4d03

      SHA256

      c3d44f93c33999447dc2c1a7197e14ad5278116a5c42b770e974c172162ce963

      SHA512

      f84235149adbbd0b6bcd364b6692f772411e23db80559ceb193252e3e0b4d64de289bff82c23364e998c12168373fa1a5b625d5e85eb3e954f6d1f7db14f95b2

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\zlib1.dll

      Filesize

      105KB

      MD5

      7b7f33f2d84c9cfbfdd0f755140d2bbf

      SHA1

      98b084b1f3f2637fad742ce497659c052ce1e310

      SHA256

      6d2c002ba600b97e0d514166bcf33667553f41fcbd73e2cd87baef74d4c6f060

      SHA512

      66e8540a4da9c248980096d20a368458a221facb47a353907da636e39bbad9dd3fb70679b8d7cf6b1d6b3d0ffad3ac8b29148c9998fbdbdbb217c1597c839708

    • memory/8-24-0x0000000005990000-0x0000000005991000-memory.dmp

      Filesize

      4KB

    • memory/8-25-0x0000000005A20000-0x0000000005A21000-memory.dmp

      Filesize

      4KB

    • memory/8-26-0x0000000006440000-0x0000000006441000-memory.dmp

      Filesize

      4KB

    • memory/2284-115-0x0000000000400000-0x00000000007A8000-memory.dmp

      Filesize

      3.7MB

    • memory/2284-98-0x0000000075AC0000-0x0000000075B09000-memory.dmp

      Filesize

      292KB

    • memory/2284-84-0x00000000759E0000-0x0000000075A01000-memory.dmp

      Filesize

      132KB

    • memory/2284-86-0x0000000075620000-0x000000007582B000-memory.dmp

      Filesize

      2.0MB

    • memory/2284-88-0x0000000075920000-0x00000000759DD000-memory.dmp

      Filesize

      756KB

    • memory/2284-87-0x00000000759E0000-0x0000000075A01000-memory.dmp

      Filesize

      132KB

    • memory/2284-90-0x0000000000400000-0x00000000007A8000-memory.dmp

      Filesize

      3.7MB

    • memory/2284-89-0x0000000075A10000-0x0000000075AB7000-memory.dmp

      Filesize

      668KB

    • memory/2284-85-0x0000000075920000-0x00000000759DD000-memory.dmp

      Filesize

      756KB

    • memory/2284-91-0x0000000075A10000-0x0000000075AB7000-memory.dmp

      Filesize

      668KB

    • memory/2284-92-0x0000000000400000-0x00000000007A8000-memory.dmp

      Filesize

      3.7MB

    • memory/2284-189-0x0000000075620000-0x000000007582B000-memory.dmp

      Filesize

      2.0MB

    • memory/2284-102-0x0000000075830000-0x000000007591A000-memory.dmp

      Filesize

      936KB

    • memory/2284-104-0x0000000075620000-0x000000007582B000-memory.dmp

      Filesize

      2.0MB

    • memory/2284-103-0x0000000064B40000-0x0000000064BBE000-memory.dmp

      Filesize

      504KB

    • memory/2284-101-0x0000000075920000-0x00000000759DD000-memory.dmp

      Filesize

      756KB

    • memory/2284-99-0x0000000075A10000-0x0000000075AB7000-memory.dmp

      Filesize

      668KB

    • memory/2284-182-0x0000000000400000-0x00000000007A8000-memory.dmp

      Filesize

      3.7MB

    • memory/2284-97-0x0000000000400000-0x00000000007A8000-memory.dmp

      Filesize

      3.7MB

    • memory/2284-181-0x0000000075620000-0x000000007582B000-memory.dmp

      Filesize

      2.0MB

    • memory/2284-122-0x0000000075620000-0x000000007582B000-memory.dmp

      Filesize

      2.0MB

    • memory/2284-174-0x0000000000400000-0x00000000007A8000-memory.dmp

      Filesize

      3.7MB

    • memory/2284-131-0x0000000000400000-0x00000000007A8000-memory.dmp

      Filesize

      3.7MB

    • memory/2284-135-0x0000000000400000-0x00000000007A8000-memory.dmp

      Filesize

      3.7MB

    • memory/2284-142-0x0000000075620000-0x000000007582B000-memory.dmp

      Filesize

      2.0MB

    • memory/2284-151-0x0000000000400000-0x00000000007A8000-memory.dmp

      Filesize

      3.7MB

    • memory/2284-158-0x0000000075620000-0x000000007582B000-memory.dmp

      Filesize

      2.0MB

    • memory/2284-162-0x0000000000400000-0x00000000007A8000-memory.dmp

      Filesize

      3.7MB

    • memory/2284-169-0x0000000075620000-0x000000007582B000-memory.dmp

      Filesize

      2.0MB

    • memory/3420-35-0x000001A998FE0000-0x000001A999103000-memory.dmp

      Filesize

      1.1MB

    • memory/3420-40-0x000001A998FE0000-0x000001A999103000-memory.dmp

      Filesize

      1.1MB

    • memory/3420-63-0x000001A998FE0000-0x000001A999103000-memory.dmp

      Filesize

      1.1MB

    • memory/3420-38-0x000001A998FE0000-0x000001A999103000-memory.dmp

      Filesize

      1.1MB