Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

1

Beni Oku -...Me.vbe

windows7-x64

1

Beni Oku -...Me.vbe

windows10-2004-x64

1

Ne ararsan...in.url

windows7-x64

1

Ne ararsan...in.url

windows10-2004-x64

1

homepage.url

windows7-x64

6

homepage.url

windows10-2004-x64

3

setup.exe

windows7-x64

8

setup.exe

windows10-2004-x64

8

setup64.exe

windows7-x64

8

setup64.exe

windows10-2004-x64

8

vac.chm

windows7-x64

1

vac.chm

windows10-2004-x64

1

x64/audiorepeater.exe

windows7-x64

1

x64/audiorepeater.exe

windows10-2004-x64

1

x64/audior...ks.exe

windows7-x64

1

x64/audior...ks.exe

windows10-2004-x64

1

x64/vcctlpan.exe

windows7-x64

1

x64/vcctlpan.exe

windows10-2004-x64

1

x64/vrtaucbl.sys

windows7-x64

1

x64/vrtaucbl.sys

windows10-2004-x64

1

x86/audiorepeater.exe

windows7-x64

1

x86/audiorepeater.exe

windows10-2004-x64

1

x86/audior...ks.exe

windows7-x64

1

x86/audior...ks.exe

windows10-2004-x64

1

x86/vcctlpan.exe

windows7-x64

1

x86/vcctlpan.exe

windows10-2004-x64

1

x86/vrtaucbl.sys

windows7-x64

1

x86/vrtaucbl.sys

windows10-2004-x64

1

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/05/2024, 18:24

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    setup.exe

  • Size

    82KB

  • MD5

    39d9f87b6eac02adac83157f55a65e26

  • SHA1

    67c7d19666939804e1d08261b915e49c8829be20

  • SHA256

    19bde26e840546d79ac6930106c0edeae0b61412eeb1634dd7e2379618e9ee27

  • SHA512

    75c15fcecb1829cf003b2c925337bd264da38307c0123c3ab1e34bf5f8723a9201836498437939a1caa69c8cd74fad70e8416404530895da784c028db1559818

  • SSDEEP

    1536:9gagi9op3hsjWdC2Re3jeTSWpqyViZXseg:9gK9oZhsjWdCPKTSWpq4iJ5g

Score
8/10

Malware Config

Signatures

  • Drops file in Drivers directory 6 IoCs
  • Manipulates Digital Signatures 1 TTPs 1 IoCs

    Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 17 IoCs
  • Drops file in Program Files directory 11 IoCs
  • Drops file in Windows directory 7 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 42 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 42 IoCs
  • Suspicious use of AdjustPrivilegeToken 16 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\setup.exe
    "C:\Users\Admin\AppData\Local\Temp\setup.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:2832
    • C:\Users\Admin\AppData\Local\Temp\setup64.exe
      "C:\Users\Admin\AppData\Local\Temp\setup64.exe"
      2⤵
      • Drops file in Drivers directory
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      PID:820
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
    1⤵
    • Drops file in Windows directory
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3408
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{082ad56a-4aa5-e849-af69-7b0c64a561e3}\vrtaucbl.inf" "9" "468e82127" "0000000000000148" "WinSta0\Default" "0000000000000158" "208" "c:\users\admin\appdata\local\temp"
      2⤵
      • Manipulates Digital Signatures
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Modifies data under HKEY_USERS
      • Suspicious use of WriteProcessMemory
      PID:396
      • C:\Windows\system32\rundll32.exe
        rundll32.exe C:\Windows\system32\pnpui.dll,InstallSecurityPromptRunDllW 20 Global\{b3f36715-e21a-2840-a5fb-3e15bde0e3fb} Global\{82f6c8ba-bc8f-0f4a-a79e-eb5b9629a5a0} C:\Windows\System32\DriverStore\Temp\{d18367ff-20a6-ec49-9b36-be9c3b456447}\vrtaucbl.inf C:\Windows\System32\DriverStore\Temp\{d18367ff-20a6-ec49-9b36-be9c3b456447}\vrtaucbl.cat
        3⤵
        • Drops file in Windows directory
        PID:1444
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "2" "11" "ROOT\MEDIA\0000" "C:\Windows\INF\oem3.inf" "oem3.inf:3beb73af0c48fa1f:DevInst:4.15.0.7314:eumusdesign_vac_wdm," "468e82127" "0000000000000148"
      2⤵
      • Drops file in Drivers directory
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      PID:1784

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\{082AD~1\x64\vrtaucbl.sys
    Filesize

    111KB

    MD5

    fa179e2c627478688aea97755be41e08

    SHA1

    7fadc17c026a0c2071d0f83363be1d739ceb4510

    SHA256

    93f0e39029a802abb06115a89827a9a1d2a2eb28e0cacef16a59ed06c9d30113

    SHA512

    3da57630cecfd6eab011df8820ca35f9a11cce770b8333b3ee9a74a2ee1cb105c5b036553666f77ffa78eee4f1d9605cdd69c2eba8757c13a2746466b683b3a4

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\{082ad56a-4aa5-e849-af69-7b0c64a561e3}\vrtaucbl.inf
    Filesize

    146KB

    MD5

    cd284d30d5ec39f83b7c821613da2976

    SHA1

    5e3f1354c586c151707835862c6e5057452c0d98

    SHA256

    99ef786db4ba2d50baafbe92f03260f54897dc6fba44690e167d80fb10d2553a

    SHA512

    ee586d46bf046a7ff41e0aab2602de33f05eb91f4116981ca9afbd5ac8004ef8ff7b18f77470204607eedc8800abac7b348ebfef31069c87ca4229d7873680fa

    Download Submit

  • C:\Windows\System32\DriverStore\Temp\{d18367ff-20a6-ec49-9b36-be9c3b456447}\SET3341.tmp
    Filesize

    7KB

    MD5

    a78e7c41c8db9704715878d3d8384228

    SHA1

    e0f3380d8814cbf68bd058f2f0432ecfa290816d

    SHA256

    5ad66cbffcd35c77516d47b99a96e0dad0c3eb76defc03eeb3357d904d30ea5d

    SHA512

    2cc622f888d9653aca374639f0f41312d580877baba78f227fe4da2f0bea2f16605c620ce834066434695ff7e8f400ea786c83bfa647eae6d702ab351c5d426a

    Download Submit