Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/05/2024, 14:55

General

  • Target

    5828d4217d31c59b79df8a93b0a52332d4d3ef267f02c2448c463338e017f48d.exe

  • Size

    318KB

  • MD5

    46e978f5dee2d39687269d77e44df3cf

  • SHA1

    f15c27a41a2e7e78b07df29c687da3e70e813e66

  • SHA256

    5828d4217d31c59b79df8a93b0a52332d4d3ef267f02c2448c463338e017f48d

  • SHA512

    81c38dd8ed41e0fc6b8a83ea536ca568c10cf1ee994edd0ef2acd00e85f45db85830f68e78e28679036d6e950617e4405e1a24fb293bf3e8fabc885f92ca9d19

  • SSDEEP

    6144:A9X0GAbjQDWEofo891UrIq5ezWQn1SGse/yuIW7Nrw0zRRb4iUH13T:G0t/voK1UwzWQ13setIWRw0NZlo13T

Score
10/10

Malware Config

Signatures

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

  • Loads dropped DLL 4 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5828d4217d31c59b79df8a93b0a52332d4d3ef267f02c2448c463338e017f48d.exe
    "C:\Users\Admin\AppData\Local\Temp\5828d4217d31c59b79df8a93b0a52332d4d3ef267f02c2448c463338e017f48d.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of SetThreadContext
    • Drops file in Windows directory
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:1124
    • C:\Users\Admin\AppData\Local\Temp\5828d4217d31c59b79df8a93b0a52332d4d3ef267f02c2448c463338e017f48d.exe
      "C:\Users\Admin\AppData\Local\Temp\5828d4217d31c59b79df8a93b0a52332d4d3ef267f02c2448c463338e017f48d.exe"
      2⤵
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:3900

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nsv494E.tmp\System.dll

    Filesize

    11KB

    MD5

    4ca4fd3fbefa2f6e87e6e9ee87d1c0b3

    SHA1

    7cdbeb5ff2b14b86af04e075d0ca651183ea5df4

    SHA256

    d09a8b3ade4ba4b7292c0b3da1bcb4b6c6e2012e0ccfd5e029a54af73a9e1b57

    SHA512

    cf0f415a97fdc74568297fed4f1295d0d2aef487a308141144ef8d5f04c669ef4795c273e745b81065429adde113fcdedf4c22717a7aeef60fdcd8d4d46f97f8

  • C:\Users\Admin\AppData\Local\Temp\nsv494E.tmp\UserInfo.dll

    Filesize

    4KB

    MD5

    035bdb470a6807313bd005bd98341ffc

    SHA1

    5017d1e5a23f1c64594f737e6fccd519729c3b3e

    SHA256

    26fa900e3426b4dd272707e1aaf428b5ee06bdc2cc2bbaecdab6b54f11f38f27

    SHA512

    f888baed5267b05b13722e839634254393aa99b2adf1a2ae6e799d3a901665e7ebda0fa1202db20a6765a8aff58e2ed6f4e822028be426db732eb10ec783aa05

  • C:\Users\Admin\AppData\Local\Temp\nsv494E.tmp\nsDialogs.dll

    Filesize

    9KB

    MD5

    eb2c74e05b30b29887b3219f4ea3fdab

    SHA1

    91173d46b34e7bae57acabdbd239111b5bcc4d9e

    SHA256

    d253ca5aba34b925796777893f114cc741b015af7868022ab1db2341288c55ed

    SHA512

    1bb035260223ec585170f891c2624b9ae98671f225e74b913b40bb77b66e3b9c2016037bc8e4b0ae16367d82590a60a0a3bd95d05139ea2454f02020d1b54dae

  • C:\Users\Public\Desktop\polres.lnk

    Filesize

    1KB

    MD5

    326b4c3b30cc04d7b135cb9d490a5315

    SHA1

    6c105e5cd66d17b94fd51ca122ae091f3526f4a1

    SHA256

    3a98c777a8fc51cb3d01562342650c099cd2d92bfd5f6d4e03380445e7c6af9c

    SHA512

    87095b56a626f907029e274a9e1477e3ac5ee7c540dcba50c77802b4f8a09bf4d795c58d251713a5def7adffe6ad739ba7cd0aa3f678081aa7156c2f1bbed20d

  • memory/1124-376-0x0000000005D90000-0x0000000008A0F000-memory.dmp

    Filesize

    44.5MB

  • memory/1124-377-0x0000000077051000-0x0000000077171000-memory.dmp

    Filesize

    1.1MB

  • memory/1124-378-0x0000000073EB4000-0x0000000073EB5000-memory.dmp

    Filesize

    4KB

  • memory/1124-381-0x0000000005D90000-0x0000000008A0F000-memory.dmp

    Filesize

    44.5MB

  • memory/1124-388-0x0000000005D90000-0x0000000008A0F000-memory.dmp

    Filesize

    44.5MB

  • memory/3900-379-0x00000000016D0000-0x000000000434F000-memory.dmp

    Filesize

    44.5MB

  • memory/3900-380-0x0000000000470000-0x00000000016C4000-memory.dmp

    Filesize

    18.3MB

  • memory/3900-383-0x00000000016D0000-0x000000000434F000-memory.dmp

    Filesize

    44.5MB