Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

23/04/2024, 14:27

240423-rsfnfshb26 3

23/04/2024, 14:24

240423-rqq2eaha3t 3

Analysis

  • max time kernel
    1801s
  • max time network
    1696s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-es
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-eslocale:es-esos:windows10-2004-x64systemwindows
  • submitted
    23/04/2024, 14:27

General

  • Target

    Toolbox OptimizerV1.0.exe

  • Size

    455KB

  • MD5

    0569b38220c2d30697ffbc398308f213

  • SHA1

    d01b93f9b2c6c6f8269e47134ee2a8639cdb29af

  • SHA256

    cdb4690f2f00fef918fc2f175c19045f0fb346a499e59f0b8ec2a6f64b03f52e

  • SHA512

    380ad86a1f83d2f9cd2461f666fc38245c8a0dea1a6bcdf5ad5b161fd72d092826cb5fb33bb278cec09866e9a8dfa95b054fa1d35719e52665e85cfbdfe9374f

  • SSDEEP

    3072:Q7DhdC6kzWypvaQ0FxyNTBf87pzseuW8Rz7m2klts+CDiVsgw7b6:QBlkZvaF4NTBE7LUKwzgw7b6

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Toolbox OptimizerV1.0.exe
    "C:\Users\Admin\AppData\Local\Temp\Toolbox OptimizerV1.0.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3932
    • C:\Windows\system32\cmd.exe
      "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\BA33.tmp\BAD0.tmp\BAE1.bat "C:\Users\Admin\AppData\Local\Temp\Toolbox OptimizerV1.0.exe""
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3324
      • C:\Windows\system32\mode.com
        mode con:cols=128 lines=40
        3⤵
          PID:1048
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=6292 --field-trial-handle=1984,i,6250324430674571549,669234090731242346,262144 --variations-seed-version /prefetch:8
      1⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:1536
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=6068 --field-trial-handle=1984,i,6250324430674571549,669234090731242346,262144 --variations-seed-version /prefetch:8
      1⤵
        PID:932
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5196 --field-trial-handle=1984,i,6250324430674571549,669234090731242346,262144 --variations-seed-version /prefetch:8
        1⤵
          PID:4584

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\BA33.tmp\BAD0.tmp\BAE1.bat

          Filesize

          87KB

          MD5

          3512b263fbfaa854e3dffc248d511dd4

          SHA1

          db752939ffb2659bd32b9c4b91c2173a6a505082

          SHA256

          7dc4222c41085904ae65a81d758911fd0b1ef3f0578368fc5d17c3e0240d2450

          SHA512

          8f54d744bf9e1368352049f3ec9aa5422494c66d7ea1e9893b3d0daecc773810148076dcfe1160b2f36ee93aa5b18ff013992b6e3abd1c8517429ff76b54cba2