Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    7s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240426-en
  • resource tags

    arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    27/04/2024, 04:41

General

  • Target

    ConfigureDefender.exe

  • Size

    2.3MB

  • MD5

    9913d5f652dbf25d363ff3d7b5cd1fc2

  • SHA1

    151de1e486bcf572b9334472355f3623ea10b05a

  • SHA256

    cb97e869fa64eb7c797a1b817f20d63cbd8310a26f4249c5727be2b776c98f16

  • SHA512

    7ca70bc1f6b75677ee1f565ca5f22be0224b47f2e7000b82a7b22c8edb0e3306c058bbb67f68ca6a403fae1b6f02d75b6b7f2f0306cc2a814ae0447c0879997b

  • SSDEEP

    49152:XLqgyALphFVTPAb3FbfxPBfV0Esz40BOdo6dPsdjvf3xTZtVYEszl:XLqgyUplPAb3JfxZfV0EUp0PsdjX3xFa

Score
7/10
upx

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 3 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ConfigureDefender.exe
    "C:\Users\Admin\AppData\Local\Temp\ConfigureDefender.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:5100
    • C:\Windows\Temp\241538342459015213\0\ConfigureDefender_x64.exe
      "C:\Windows\Temp\241538342459015213\0\ConfigureDefender_x64.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of WriteProcessMemory
      PID:404
      • C:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.exe
        C:\Windows\System32\WindowsPowerShell\v1.0\PowerShell -NonInteractive -WindowStyle hidden $Preferences=Get-MpPreference;$path='HKLM:\SOFTWARE\Policies\Microsoft\Windows\safer_Hard_Configurator\Defender\TEMP'; New-ItemProperty -Path $path -Name 'PreferencesTest' -Value $Preferences.DisableRealtimeMonitoring -PropertyType String -Force | Out-Null; function SetRegistryKey ([string]$name){$svalue=$Preferences.$name;New-ItemProperty -Path $path -Name $name -Value $svalue -PropertyType DWORD -Force | Out-Null}; SetRegistryKey('EnableNetworkProtection'); SetRegistryKey( 'EnableControlledFolderAccess');SetRegistryKey('DisableRealtimeMonitoring'); SetRegistryKey('DisableBehaviorMonitoring'); SetRegistryKey('DisableBlockAtFirstSeen'); SetRegistryKey('MAPSReporting');SetRegistryKey('SubmitSamplesConsent');SetRegistryKey('DisableIOAVProtection'); SetRegistryKey('DisableScriptScanning'); SetRegistryKey('PUAProtection'); SetRegistryKey('ScanAvgCPULoadFactor');
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1560

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3mx43fhc.com.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • C:\Users\Admin\AppData\Local\Temp\nsd4150.tmp\System.dll

    Filesize

    12KB

    MD5

    cff85c549d536f651d4fb8387f1976f2

    SHA1

    d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e

    SHA256

    8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8

    SHA512

    531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88

  • C:\Users\Admin\AppData\Local\Temp\nsd4150.tmp\nsRandom.dll

    Filesize

    21KB

    MD5

    ab467b8dfaa660a0f0e5b26e28af5735

    SHA1

    596abd2c31eaff3479edf2069db1c155b59ce74d

    SHA256

    db267d9920395b4badc48de04df99dfd21d579480d103cae0f48e6578197ff73

    SHA512

    7d002dc203997b8a4d8ec20c92cd82848e29d746414f4a61265c76d4afb12c05bce826fc63f4d2bd3d527f38506c391855767d864c37584df11b5db9ca008301

  • C:\Windows\Temp\241538342459015213\0\ConfigureDefender_x64.exe

    Filesize

    1.8MB

    MD5

    0f8ee39a0e3662205aa268c9a44f694f

    SHA1

    56271747a560ae2f2af08bd5fafd3e404baf21c2

    SHA256

    5b431d9be209a84b0e6c366bb676956c5e2b6a6b8d9d525a062b1931f4f30aad

    SHA512

    a43249ef57533c2f509470775a82729a3de9f06ce8d22571afb1e7057c7560880e13c967d16f74a5b430d41d6289c98b382afcb89a3e839b1788de24af826a76

  • memory/1560-24-0x000001F74C440000-0x000001F74C462000-memory.dmp

    Filesize

    136KB

  • memory/1560-25-0x00007FFB53380000-0x00007FFB53E42000-memory.dmp

    Filesize

    10.8MB

  • memory/1560-28-0x000001F732540000-0x000001F732550000-memory.dmp

    Filesize

    64KB

  • memory/1560-27-0x000001F732540000-0x000001F732550000-memory.dmp

    Filesize

    64KB

  • memory/1560-26-0x000001F732540000-0x000001F732550000-memory.dmp

    Filesize

    64KB

  • memory/1560-30-0x00007FFB53380000-0x00007FFB53E42000-memory.dmp

    Filesize

    10.8MB

  • memory/5100-7-0x0000000000B30000-0x0000000000B42000-memory.dmp

    Filesize

    72KB

  • memory/5100-6-0x0000000000B30000-0x0000000000B42000-memory.dmp

    Filesize

    72KB