Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/05/2024, 23:15

General

  • Target

    5a3be66ef3388c282c62f690d770e08eee5ae4dd5c4d92178c4ef98553c00fea.exe

  • Size

    211KB

  • MD5

    6b2e5a2bf4036c3ffa44573cf402952f

  • SHA1

    324211705a5167abab90d39b2eca7279836891d9

  • SHA256

    5a3be66ef3388c282c62f690d770e08eee5ae4dd5c4d92178c4ef98553c00fea

  • SHA512

    2be1d9e476496b37033fc5840f5bba3900f9f7da6e476c6291806dc26d0b635141b95d2764f30f1732043cf3a4fbedace945b3c8a87fb4c70f36aee032fa3e70

  • SSDEEP

    3072:dDEPeJlYW1ea8HKHSRUN3jjXs9Y+MiMVB/w68PEAjAfIrAvGPZz6sPJBIiFe/Gcu:dSAl1IK1aY+MiMVBSeI

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Modifies Installed Components in the registry 2 TTPs 8 IoCs
  • Executes dropped EXE 4 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5a3be66ef3388c282c62f690d770e08eee5ae4dd5c4d92178c4ef98553c00fea.exe
    "C:\Users\Admin\AppData\Local\Temp\5a3be66ef3388c282c62f690d770e08eee5ae4dd5c4d92178c4ef98553c00fea.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4116
    • \??\c:\windows\userinit.exe
      c:\windows\userinit.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visiblity of hidden/system files in Explorer
      • Modifies Installed Components in the registry
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3592
      • \??\c:\windows\spoolsw.exe
        c:\windows\spoolsw.exe SE
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2536
        • \??\c:\windows\swchost.exe
          c:\windows\swchost.exe
          4⤵
          • Modifies WinLogon for persistence
          • Modifies visiblity of hidden/system files in Explorer
          • Modifies Installed Components in the registry
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4884
          • \??\c:\windows\spoolsw.exe
            c:\windows\spoolsw.exe PR
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            PID:2180

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\mrsys.exe

    Filesize

    211KB

    MD5

    39f8424cf70d4ebd6a762c5b8d3dc3e8

    SHA1

    4065c6f2a1d11f016d458e325a65ae7e8ef87f34

    SHA256

    5fd29aaf0ff5fa5c7d4435d1a7748d0a050d7b36221f39eb8482f051c75a8c84

    SHA512

    2d220f088dcbfc289601f057b02a4db66fb2f143be4d6a22e7b85dd4518970d8d23c1b7c43da35f8986c9a96e8237f36c743b81b0ae7aa42933cd0c4bd0415e1

  • C:\Windows\spoolsw.exe

    Filesize

    211KB

    MD5

    dd8dc3f1bfa0880585eb19b7f0465b89

    SHA1

    8a44ed2023108740f121925b47d4c4a2de297cd3

    SHA256

    68eedf6936287c916d7f356c1f9aa53a71765f8cd4ec680b38f617a08f42350c

    SHA512

    6d75aa0f4cc27bda80c9c31e8c2276eb92adfa0f54530c42e9820b81fb03fd0bde363c90d3624971009e2528d56446bb7eabd32bc00e024d10194b690c7d689a

  • C:\Windows\swchost.exe

    Filesize

    211KB

    MD5

    6707274dc630dbf572c3e7a47b0b26e0

    SHA1

    6bd21584f323ea7ddbe3c6197101e91d47a03d7e

    SHA256

    b5291776b04d2dff0a07f97e95793fd29ae9b6c5272e42f94685f80f77503885

    SHA512

    6efcde68ce88fcbfe0262c10bbf328f7903c9c6cf7b2055d2aae4e6a7cd402c9aa09fb2509efc5caf1ddd3d223bce9a54d91d1da3b6dec6f6e3f8ac906d6c61b

  • C:\Windows\userinit.exe

    Filesize

    211KB

    MD5

    526e33de2a2d7f0e5c001880c377b7de

    SHA1

    9963ea2cd1aecf25b484abcc2c83ccbc586dac29

    SHA256

    6260c150b5a9a586388c00328f24162227c6f25f2a92e01f831c8048c59d9abe

    SHA512

    f93031040f0483479d7b9fbb322417235721eccfd053102cb4fa78d2dfc4e097f002028a6f8173b89380a5d7c515fa813c568013a2747cbc69a00f443cc562a6

  • memory/2180-33-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

  • memory/2536-17-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

  • memory/2536-36-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

  • memory/4116-0-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

  • memory/4116-38-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB