Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
01/06/2024, 21:06 UTC
General
-
Target
4ba112cc4ce872bdfa046d4ceccb7ed9f44d701505bb2b41a3a5428a231c396b.dll
-
Size
1.1MB
-
MD5
4ed6c48e50b91d3c6993889d7722eee9
-
SHA1
2128dfcda57a5a4743db141beddd415612a15dc8
-
SHA256
4ba112cc4ce872bdfa046d4ceccb7ed9f44d701505bb2b41a3a5428a231c396b
-
SHA512
f605539e9dab2779405c9296dae164d9e90e151ce56e60e5fc49228d2510b1a7d15885cff13f3ac64ab566445f912aab455b5483900195f835e10735dc591929
-
SSDEEP
6144:Ci05kH9OyU2uv5SRf/FWgFgtBgqIRAUW9kVYeVprU4wfhTv5xD2ZP0GVGdXcukT4:trHGPv5Smpt6DmUWuVZkxikdXcq
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in System32 directory 2 IoCs
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies registry class 10 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 14 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ba112cc4ce872bdfa046d4ceccb7ed9f44d701505bb2b41a3a5428a231c396b.dll,#11⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\PrintBrmUi.exeC:\Windows\system32\PrintBrmUi.exe1⤵
-
C:\Windows\system32\MicrosoftEdgeSH.exeC:\Windows\system32\MicrosoftEdgeSH.exe1⤵
-
C:\Windows\system32\fixmapi.exeC:\Windows\system32\fixmapi.exe1⤵
-
C:\Windows\system32\AppHostRegistrationVerifier.exeC:\Windows\system32\AppHostRegistrationVerifier.exe1⤵
-
C:\Windows\system32\newdev.exeC:\Windows\system32\newdev.exe1⤵
-
C:\Windows\system32\MicrosoftEdgeCP.exeC:\Windows\system32\MicrosoftEdgeCP.exe1⤵
-
C:\Windows\system32\PresentationHost.exeC:\Windows\system32\PresentationHost.exe1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\xlL2A.cmd1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Delete /F /TN "User_Feed_Synchronization-{5ad6d10e-57ab-26f6-20b7-72f3d4024a3d}"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks.exe /Delete /F /TN "User_Feed_Synchronization-{5ad6d10e-57ab-26f6-20b7-72f3d4024a3d}"2⤵
-
-
C:\Windows\system32\LogonUI.exeC:\Windows\system32\LogonUI.exe1⤵
-
C:\Windows\system32\rekeywiz.exeC:\Windows\system32\rekeywiz.exe1⤵
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe1⤵
-
C:\Windows\system32\MultiDigiMon.exeC:\Windows\system32\MultiDigiMon.exe1⤵
-
C:\Windows\system32\baaupdate.exeC:\Windows\system32\baaupdate.exe1⤵
-
C:\Windows\system32\VSSVC.exeC:\Windows\system32\VSSVC.exe1⤵
-
C:\Windows\system32\RdpSa.exeC:\Windows\system32\RdpSa.exe1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\GmZd1h1.cmd1⤵
- Drops file in System32 directory
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\8m1QWvb.cmd2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks.exe /Create /F /TN "Hukrqpujurvgmz" /SC minute /MO 60 /TR "C:\Windows\system32\2458\RdpSa.exe" /RL highest3⤵
- Creates scheduled task(s)
-
-
Network
-
DNS241.150.49.20.in-addr.arpaRemote address:8.8.8.8:53Request241.150.49.20.in-addr.arpaIN PTRResponse -
DNS4.159.190.20.in-addr.arpaRemote address:8.8.8.8:53Request4.159.190.20.in-addr.arpaIN PTRResponse
-
DNS144.107.17.2.in-addr.arpaRemote address:8.8.8.8:53Request144.107.17.2.in-addr.arpaIN PTRResponse144.107.17.2.in-addr.arpaIN PTRa2-17-107-144deploystaticakamaitechnologiescom
-
DNS95.221.229.192.in-addr.arpaRemote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
DNS183.59.114.20.in-addr.arpaRemote address:8.8.8.8:53Request183.59.114.20.in-addr.arpaIN PTRResponse
-
DNS198.187.3.20.in-addr.arpaRemote address:8.8.8.8:53Request198.187.3.20.in-addr.arpaIN PTRResponse
-
DNS25.140.123.92.in-addr.arpaRemote address:8.8.8.8:53Request25.140.123.92.in-addr.arpaIN PTRResponse25.140.123.92.in-addr.arpaIN PTRa92-123-140-25deploystaticakamaitechnologiescom
-
DNS240.221.184.93.in-addr.arpaRemote address:8.8.8.8:53Request240.221.184.93.in-addr.arpaIN PTRResponse
-
DNS14.227.111.52.in-addr.arpaRemote address:8.8.8.8:53Request14.227.111.52.in-addr.arpaIN PTRResponse
-
8.8.8.8:53241.150.49.20.in-addr.arpadns
DNS Request
241.150.49.20.in-addr.arpa
-
8.8.8.8:534.159.190.20.in-addr.arpadns
DNS Request
4.159.190.20.in-addr.arpa
-
8.8.8.8:53144.107.17.2.in-addr.arpadns
DNS Request
144.107.17.2.in-addr.arpa
-
8.8.8.8:5395.221.229.192.in-addr.arpadns
DNS Request
95.221.229.192.in-addr.arpa
-
8.8.8.8:53183.59.114.20.in-addr.arpadns
DNS Request
183.59.114.20.in-addr.arpa
-
8.8.8.8:53198.187.3.20.in-addr.arpadns
DNS Request
198.187.3.20.in-addr.arpa
-
8.8.8.8:5325.140.123.92.in-addr.arpadns
DNS Request
25.140.123.92.in-addr.arpa
-
8.8.8.8:53240.221.184.93.in-addr.arpadns
DNS Request
240.221.184.93.in-addr.arpa
-
8.8.8.8:5314.227.111.52.in-addr.arpadns
DNS Request
14.227.111.52.in-addr.arpa
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
130B
MD5dde9040c0879741d320797f74ec9c93a
SHA10d12a0383a3990a37494776884616e2c820b02d2
SHA25649ed29efd0e31bee0ade4ba7cb10ceed84cd7e50f8e155df8424d266d673fa66
SHA512f334c8b8bf88c72e6d54e2bb4fab48521d4a8bea3668afdedeae3fa3d1d333e12620468c87221e0a537cbba53392214f8be54043f1cbd1352d78d5973190e0d1
-
Filesize
189B
MD55b5512d97b32afabacd3d0e6d32c54c9
SHA1c67d3ab8c0d64e6e1c5fdab484361abea43ed9ab
SHA2565d28e969d3cea8f1b2314c86000018a5b83b6e894124fdb5520d4656c5e36444
SHA512771a3230da29e6b1458cedb80b34e8cd16fc24065d3f62b278c5578b834715fa3bc2c7eed16a663783e2b95a184456f2a392774939a3ae340b2fc963dd6a4143
-
Filesize
1.1MB
MD51b65b9308353191ac7eef9ccec5afdb2
SHA167618c5d10435b3e052066ef4dd8a3b1326e14ce
SHA25635431200e14d7681cb24e93d0fa45c297cd873d3db30765471eb8db8981b7e82
SHA5128a0d157e8d5188008002af389ca2f6488693bde93d615cc6402577a73cfa7298176c2d05677e97ac0eeaab34ea281b5215405f6dc84185faf2441f4dfe0a8117
-
Filesize
1.1MB
MD5c579631af9bc0a105bdec26692f0dcf6
SHA18baeaf51fc7bcdd426bbd1795510aa651710a694
SHA25654e8efb8a7b653a28097668e28a0490d0644cc1e8a8d7bcda39996e48d81629e
SHA5123a23b7571c0e7decb67f4894f0a28016236987455f22f18545feee119f5050a05e50237486b7b2f3a9243deb627aa00ea508f9a27268999a84b5bee891b6682f
-
Filesize
245B
MD5127604d48d171a6b43f3148a0658fbc5
SHA123eb8d939518037ca350ab56b324fed548dd40f8
SHA256c34d35fd9f2dba60b4de06eff58be7261132e4924a2ac51a1ba6ed021c94672e
SHA512ee0c4f440f20c5c0d94b545bff02fc9d7c88011ce18895194d8a47d5063ffeb1b44c60a34ea54853b36147bd6ff5ae250a1ae404c16588c7e769745fe5d312df
-
Filesize
954B
MD5761b6de3a836d6eb017665ccdc8bb3b6
SHA162f6fcca5b5228aeda5b3cddd1ffb4676f436f57
SHA2562b2ccc14fb5c71bb4a33dd986f3c095569ab1f6cc6c1fbe0e72bf915b70142ee
SHA512bfb709fc0b5e3b7023d4ae6c670458833f22098007df600cbcd06a3356e600683e66d9af9ac2fcacc53441f69456d30cd97fa225dc258285e426bbbd9353e446
-
Filesize
276KB
MD5ef27d65b92d89e8175e6751a57ed9d93
SHA17279b58e711b459434f047e9098f9131391c3778
SHA25617d6dcfaced6873a4ac0361ff14f48313f270ac9c465e9f02b5c12b5a5274c48
SHA51240f46c3a131bb0388b8a3f7aee422936f6e2aa8d2cda547c43c4e7979c163d06c5aa20033a5156d3eeee5d455eeb929cbce89bcc8bb1766cbb65d7f03dd23e2e
-
Filesize
1.1MB
-
Filesize
28KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
64KB
-
Filesize
28KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
4KB
-
Filesize
4KB