Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    126s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/05/2024, 05:20

General

  • Target

    StarVPN.exe

  • Size

    150.4MB

  • MD5

    3c63b18fc7ddc2626dc61118093f0f63

  • SHA1

    d24f921aae3c600cc5696bc142115f526bf648a0

  • SHA256

    93b638342b85eeb2547eed26fe98b1e418e6d97aff539c71d3006c66b7e59787

  • SHA512

    d9dbbe71503682487a35e0a413c03ad75fdd4a9c578f38af55bc4f42ec8c753c5494f836a7f66d887b40f3dcce71d9272171ddc6de0df28fdcffe65156e2549f

  • SSDEEP

    1572864:XlAhthKM29V6LLWANUB9IinJn1cpGN4vM+JlhrZnQ9I4FdUrczKrk4Ze2OC2+S:MtSD64Jnqrt5v2b

Score
5/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Modifies system certificate store 2 TTPs 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Suspicious use of SendNotifyMessage 6 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\StarVPN.exe
    "C:\Users\Admin\AppData\Local\Temp\StarVPN.exe"
    1⤵
    • Checks computer location settings
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3460
    • C:\Windows\System32\Wbem\wmic.exe
      wmic path Win32_NetworkAdapterConfiguration where IPEnabled=true get DefaultIPGateway,GatewayCostMetric,IPConnectionMetric,Index /format:table
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4952
    • C:\Users\Admin\AppData\Local\Temp\StarVPN.exe
      "C:\Users\Admin\AppData\Local\Temp\StarVPN.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\StarVPN" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1728 --field-trial-handle=1868,i,974009519220743804,15431095058819221805,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
      2⤵
        PID:4440
      • C:\Users\Admin\AppData\Local\Temp\StarVPN.exe
        "C:\Users\Admin\AppData\Local\Temp\StarVPN.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\StarVPN" --mojo-platform-channel-handle=2152 --field-trial-handle=1868,i,974009519220743804,15431095058819221805,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
        2⤵
          PID:1356
        • C:\Users\Admin\AppData\Local\Temp\StarVPN.exe
          "C:\Users\Admin\AppData\Local\Temp\StarVPN.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\StarVPN" --app-user-model-id=⁣ --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --enable-sandbox --first-renderer-process --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2468 --field-trial-handle=1868,i,974009519220743804,15431095058819221805,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
          2⤵
          • Checks computer location settings
          PID:944
        • C:\Windows\system32\cmd.exe
          cmd.exe /d /s /c "netsh "wlan" "show" "interface""
          2⤵
            PID:2188
            • C:\Windows\system32\netsh.exe
              netsh "wlan" "show" "interface"
              3⤵
                PID:2972
            • C:\Windows\System32\Wbem\wmic.exe
              wmic path Win32_NetworkAdapter where Index=1 get NetConnectionID,MACAddress /format:table
              2⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:4940
            • C:\Windows\System32\Wbem\wmic.exe
              wmic path Win32_NetworkAdapterConfiguration where IPEnabled=true get DefaultIPGateway,GatewayCostMetric,IPConnectionMetric,Index /format:table
              2⤵
                PID:5044
              • C:\Windows\System32\Wbem\wmic.exe
                wmic path Win32_NetworkAdapter where Index=1 get NetConnectionID,MACAddress /format:table
                2⤵
                  PID:1060
                • C:\Windows\System32\Wbem\wmic.exe
                  wmic path Win32_NetworkAdapterConfiguration where IPEnabled=true get DefaultIPGateway,GatewayCostMetric,IPConnectionMetric,Index /format:table
                  2⤵
                    PID:452
                  • C:\Windows\System32\Wbem\wmic.exe
                    wmic path Win32_NetworkAdapter where Index=1 get NetConnectionID,MACAddress /format:table
                    2⤵
                      PID:5108
                    • C:\Windows\System32\Wbem\wmic.exe
                      wmic path Win32_NetworkAdapterConfiguration where IPEnabled=true get DefaultIPGateway,GatewayCostMetric,IPConnectionMetric,Index /format:table
                      2⤵
                        PID:4152
                      • C:\Windows\System32\Wbem\wmic.exe
                        wmic path Win32_NetworkAdapter where Index=1 get NetConnectionID,MACAddress /format:table
                        2⤵
                          PID:4868
                        • C:\Windows\System32\Wbem\wmic.exe
                          wmic path Win32_NetworkAdapterConfiguration where IPEnabled=true get DefaultIPGateway,GatewayCostMetric,IPConnectionMetric,Index /format:table
                          2⤵
                            PID:4532
                          • C:\Windows\System32\Wbem\wmic.exe
                            wmic path Win32_NetworkAdapter where Index=1 get NetConnectionID,MACAddress /format:table
                            2⤵
                              PID:2296
                            • C:\Windows\System32\Wbem\wmic.exe
                              wmic path Win32_NetworkAdapterConfiguration where IPEnabled=true get DefaultIPGateway,GatewayCostMetric,IPConnectionMetric,Index /format:table
                              2⤵
                                PID:4872
                              • C:\Windows\System32\Wbem\wmic.exe
                                wmic path Win32_NetworkAdapter where Index=1 get NetConnectionID,MACAddress /format:table
                                2⤵
                                  PID:3828
                                • C:\Windows\System32\Wbem\wmic.exe
                                  wmic path Win32_NetworkAdapterConfiguration where IPEnabled=true get DefaultIPGateway,GatewayCostMetric,IPConnectionMetric,Index /format:table
                                  2⤵
                                    PID:4612
                                  • C:\Windows\System32\Wbem\wmic.exe
                                    wmic path Win32_NetworkAdapter where Index=1 get NetConnectionID,MACAddress /format:table
                                    2⤵
                                      PID:3096
                                    • C:\Windows\System32\Wbem\wmic.exe
                                      wmic path Win32_NetworkAdapterConfiguration where IPEnabled=true get DefaultIPGateway,GatewayCostMetric,IPConnectionMetric,Index /format:table
                                      2⤵
                                        PID:5036
                                      • C:\Windows\System32\Wbem\wmic.exe
                                        wmic path Win32_NetworkAdapter where Index=1 get NetConnectionID,MACAddress /format:table
                                        2⤵
                                          PID:2396

                                      Network

                                      MITRE ATT&CK Enterprise v15

                                      Replay Monitor

                                      Loading Replay Monitor...

                                      Downloads

                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

                                        Filesize

                                        2B

                                        MD5

                                        f3b25701fe362ec84616a93a45ce9998

                                        SHA1

                                        d62636d8caec13f04e28442a0a6fa1afeb024bbb

                                        SHA256

                                        b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

                                        SHA512

                                        98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

                                      • C:\Users\Admin\AppData\Roaming\StarVPN\Network\Network Persistent State

                                        Filesize

                                        300B

                                        MD5

                                        00ebf7191eb82b69bb59f45b78c5eeda

                                        SHA1

                                        85d94745970161f2c715aa65511c6addffca5b43

                                        SHA256

                                        ec2231d9bd8e8f25b3d305b17adf38fa3f87b6610be5c3138b3f1d0f5ae5b9c5

                                        SHA512

                                        9c2f2073630aaaeb085b0db4412353e7da3db019ebd0bc935b7787987f79a6c0c1f3ca2de3ed1da0206dc33058e7eec5481abff4d358ba984452426fb88ca2c5

                                      • C:\Users\Admin\AppData\Roaming\StarVPN\Network\Network Persistent State~RFe588d85.TMP

                                        Filesize

                                        59B

                                        MD5

                                        2800881c775077e1c4b6e06bf4676de4

                                        SHA1

                                        2873631068c8b3b9495638c865915be822442c8b

                                        SHA256

                                        226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

                                        SHA512

                                        e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

                                      • C:\Users\Admin\AppData\Roaming\StarVPN\logs\main.log

                                        Filesize

                                        4KB

                                        MD5

                                        4da17de9ef39dcee41c74ede4b75a219

                                        SHA1

                                        28ab458b62c2415baad088725ae99c7c0319534a

                                        SHA256

                                        910c61a961ea870a1e1e8705cc65a37006a27aa310c72bfddb81c6f7b7118ca3

                                        SHA512

                                        7b23523c4210539939293ba99f1da975a1eb94f70db10d9beac15ba4da5178039930cb00252414d1f1b0593db5bcecd37829413e44a62ee487732c2b3cd108f6

                                      • memory/944-15-0x00007FF97C2D0000-0x00007FF97C2D1000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/944-14-0x0000025381820000-0x0000025381821000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/944-121-0x00000253817F0000-0x000002538181B000-memory.dmp

                                        Filesize

                                        172KB

                                      • memory/4440-3-0x00007FF97C2C0000-0x00007FF97C2C1000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/4440-120-0x0000016226330000-0x000001622635B000-memory.dmp

                                        Filesize

                                        172KB