Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    145s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/04/2024, 00:00

General

  • Target

    PHOTO-DEVOCHKA.exe

  • Size

    149KB

  • MD5

    13135ec7bee7db877b3654059374ebde

  • SHA1

    f3f3a8c6b395211ebdbb2a73769e21c401d34e0c

  • SHA256

    7dbe9bdea098a5cb0608135c1705d2aa2e080ebc4146a02001a793ff0970252a

  • SHA512

    3f7eb418322b1abbe60b2fa6845ffb3e530808739b0dc542707c713f83bc4b02a4a1568a28e9badeb71bd5512e14a47387abe80b2edf0b440f2c40cc3cc08db8

  • SSDEEP

    3072:lBAp5XhKpN4eOyVTGfhEClj8jTk+0hiqtAhp:AbXE9OiTGfhEClq9QtAhp

Score
8/10

Malware Config

Signatures

  • Blocklisted process makes network request 1 IoCs
  • Drops file in Drivers directory 3 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 9 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\PHOTO-DEVOCHKA.exe
    "C:\Users\Admin\AppData\Local\Temp\PHOTO-DEVOCHKA.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Program Files directory
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2828
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\Company\NewProduct\koollapsa.bat" "
      2⤵
      • Drops file in Drivers directory
      • Checks computer location settings
      • Drops file in Program Files directory
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2448
      • C:\Windows\SysWOW64\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Company\NewProduct\al99999.vbs"
        3⤵
        • Blocklisted process makes network request
        PID:1900
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Company\NewProduct\all2.vbs"
      2⤵
      • Drops file in Drivers directory
      PID:1704
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3936 --field-trial-handle=2304,i,6987730730348465820,3913273227385401271,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:3856

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\Company\NewProduct\al99999.pp

      Filesize

      234B

      MD5

      0ed4d363b23de2f2e155f12a2caad6c6

      SHA1

      ca01261735a2368e29c3b2695e0156a447099aa2

      SHA256

      0832d445cecf5f174085cb2209c073f83c5ddc48c95d8d1642eaba37c2ab5567

      SHA512

      7d889d3be545c1aff88db384923d88aa229fbd66540dae0b788e12ed58573e4b3f7c52c2d5db18343fc3a33382b6e169c2cca7233778700da1df5cd16d055e4f

    • C:\Program Files (x86)\Company\NewProduct\all2.vbs

      Filesize

      678B

      MD5

      bf72f45eb64682832ec502a1d3d2fe36

      SHA1

      a77c4751b9a679c0b31c1d854dffaf0d2886d4ab

      SHA256

      c2efdbb412e438c9d74954778935676013f4485bf16d8076b23c191a3f81fa05

      SHA512

      438832c895db8d26dcbfb9ac3575d4f6478649c871ca9c52b588cec751a5eb6ad187c5f00a0b6d150205036a306e4ab8000a1f16a54cfb7d783b4492a1be0407

    • C:\Program Files (x86)\Company\NewProduct\hhhh.txt

      Filesize

      27B

      MD5

      213c0742081a9007c9093a01760f9f8c

      SHA1

      df53bb518c732df777b5ce19fc7c02dcb2f9d81b

      SHA256

      9681429a2b00c27fe6cb0453f255024813944a7cd460d18797e3c35e81c53d69

      SHA512

      55182c2e353a0027f585535a537b9c309c3bf57f47da54a16e0c415ed6633b725bf40e40a664b1071575feeb7e589d775983516728ec3e51e87a0a29010c4eb9

    • C:\Program Files (x86)\Company\NewProduct\koollapsa.bat

      Filesize

      3KB

      MD5

      2180c017ea68ff374d8a37aea32f6b8d

      SHA1

      bdc5a525249a41e434cba309e79b8eac0aeb6865

      SHA256

      e541a4b41252542251096f388810d4ec2d0e1f1e96f222134982d95581abd3a1

      SHA512

      a70d00862535e055fc7283d367921f1f037ea1fce71b57bdd74463f00428eb2dd5b8006cb61ce882e586cce8825c620f202498ceaaa8d727cf16a5d4aef29aca

    • C:\Program Files (x86)\Company\NewProduct\slonik.po

      Filesize

      65B

      MD5

      ad13b5db4d7ddfa3f5239e5b5f06e8e5

      SHA1

      24c28d82adacac1b118f5d1abbc12218583431e9

      SHA256

      7dc870d6e2fb495c37409b887f79e02d74bdd6bef3ba45a8ac8a3003d33ae73e

      SHA512

      4b71633dcf9f5ad986cc09c22da7956a7b006563df4e752cc9d3507743c4c3dc55a309a68fe17ef8a0c6779ae694dd55b7f61c4b3638cf8806722a6fbdf8af03

    • C:\Windows\System32\drivers\etc\hosts

      Filesize

      1KB

      MD5

      d9a93296f8c62ab96271667c72d7a3b3

      SHA1

      abcf5a6ed773cfc978fc2176138778ad406c188a

      SHA256

      f6c84e7c7fced4ae3ee3ca143fd5e134a183eb1e2f67ab71a6e9a902596be993

      SHA512

      f91de9fbc57397c895aa1bda0ed18601711b1da377ceeee9d5a5ff48a4a3ba2e4feaacf3c64475c07daf584d6374e79d8206a49d1e25bc3044b2e4b6c7d4bd02

    • memory/2828-3-0x0000000000400000-0x0000000000422000-memory.dmp

      Filesize

      136KB

    • memory/2828-28-0x0000000000400000-0x0000000000422000-memory.dmp

      Filesize

      136KB

    • memory/2828-59-0x0000000000400000-0x0000000000422000-memory.dmp

      Filesize

      136KB