Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    100s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/05/2024, 00:18

General

  • Target

    98aff4f56a9dc4336459d1ab6d25a8e6948de10f6e117d820cffc3ae1764652c.exe

  • Size

    234KB

  • MD5

    1f88f1bce5e1d74b30f89808880fb4d6

  • SHA1

    40bd02e6f8b5b82576ea652552c85f32aaeedd7a

  • SHA256

    98aff4f56a9dc4336459d1ab6d25a8e6948de10f6e117d820cffc3ae1764652c

  • SHA512

    524abb3523c4f8f16d1156d415404ead694a551ec82d12105145e0542a94cea6741a9e4b47a56bb41f5710692ae81682e2192e7890b6b0f40c584b572c90c56c

  • SSDEEP

    6144:/eIcZPAjQN79B8aDT2SCguONhWV9NgHd6Z:/erZPAm74g/dNhQG

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in System32 directory 1 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of UnmapMainImage
    PID:3480
    • C:\Users\Admin\AppData\Local\Temp\98aff4f56a9dc4336459d1ab6d25a8e6948de10f6e117d820cffc3ae1764652c.exe
      "C:\Users\Admin\AppData\Local\Temp\98aff4f56a9dc4336459d1ab6d25a8e6948de10f6e117d820cffc3ae1764652c.exe"
      2⤵
      • Adds Run key to start application
      • Drops file in System32 directory
      • Suspicious use of WriteProcessMemory
      PID:1516
      • C:\Users\Admin\AppData\Roaming\grpcywiz\provinit.exe
        "C:\Users\Admin\AppData\Roaming\grpcywiz"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:5112
        • C:\Users\Admin\AppData\Local\Temp\~5AF1.tmp
          3480 239624 5112 1
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:4388
  • C:\Windows\SysWOW64\dialpart.exe
    C:\Windows\SysWOW64\dialpart.exe -s
    1⤵
    • Executes dropped EXE
    PID:4580

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\~5AF1.tmp

    Filesize

    8KB

    MD5

    86dc243576cf5c7445451af37631eea9

    SHA1

    99a81c47c4c02f32c0ab456bfa23c306c7a09bf9

    SHA256

    25d2a671e1b5b5b95697ac0234ce4d46e0d0894919521b54aabebd9daecf994a

    SHA512

    c7310524f9b65f811146c1eb6ae944966351ac88a95fbc1ac422d8810730e5e212a7e28090ad758ea23c96ba38073e7fcf42460575e7f09dbc759a45c5d5a4a4

  • C:\Users\Admin\AppData\Roaming\grpcywiz\provinit.exe

    Filesize

    234KB

    MD5

    a21630069ad090ba51c87d613d05a1ca

    SHA1

    5cb171eba6f1226178f5adc22aaab45aa7710f4b

    SHA256

    b2d47ecf8d027b0c866d99f4cb2dcc4023ebdd9796c4bdb3a3e52388d7fffb9a

    SHA512

    375908abd7b8a44eaf4d2375e01eea03cbfad61ed7a3155eb92b887069ab8a6cee2afaaaae3a30574a8fb78055ad5a5fd2a978524bcd485ecea7f0dd929b1ecc

  • memory/1516-1-0x0000000000510000-0x0000000000553000-memory.dmp

    Filesize

    268KB

  • memory/1516-0-0x0000000000400000-0x000000000043F000-memory.dmp

    Filesize

    252KB

  • memory/1516-23-0x0000000000400000-0x000000000043F000-memory.dmp

    Filesize

    252KB

  • memory/3480-25-0x00000000026D0000-0x00000000026DD000-memory.dmp

    Filesize

    52KB

  • memory/3480-24-0x00000000026C0000-0x00000000026C6000-memory.dmp

    Filesize

    24KB

  • memory/3480-21-0x0000000002D90000-0x0000000002DDA000-memory.dmp

    Filesize

    296KB

  • memory/3480-16-0x0000000002D90000-0x0000000002DDA000-memory.dmp

    Filesize

    296KB

  • memory/4580-19-0x0000000000400000-0x000000000043F000-memory.dmp

    Filesize

    252KB

  • memory/4580-20-0x0000000000440000-0x0000000000483000-memory.dmp

    Filesize

    268KB

  • memory/5112-6-0x0000000000400000-0x000000000043F000-memory.dmp

    Filesize

    252KB

  • memory/5112-22-0x0000000000400000-0x000000000043F000-memory.dmp

    Filesize

    252KB

  • memory/5112-9-0x0000000000440000-0x0000000000483000-memory.dmp

    Filesize

    268KB

  • memory/5112-10-0x00000000004B0000-0x00000000004B5000-memory.dmp

    Filesize

    20KB