Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/06/2024, 18:49

General

  • Target

    0e61a1dd0f40778656a0c365121eff1ee1322f3af79f9789bee205e4e85ff453.exe

  • Size

    88KB

  • MD5

    ae8f1df7db72ab5b597d78ab00c4f664

  • SHA1

    2256d81dc7cbd686567cd2304023699934755d41

  • SHA256

    0e61a1dd0f40778656a0c365121eff1ee1322f3af79f9789bee205e4e85ff453

  • SHA512

    e7181075975ed268a65a8dfb09ee048a055483714518cbd1ed82b3c0715923f376dbc9f63f118625d8bada0c0cb4217919c2410ccfcc7b1703f1f98d0987d103

  • SSDEEP

    1536:ahUDofByDJWbMGcEFLPEPKOJUsy1+VMA:aIofBHbKMP0PvMA

Score
9/10

Malware Config

Signatures

  • UPX dump on OEP (original entry point) 5 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 39 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0e61a1dd0f40778656a0c365121eff1ee1322f3af79f9789bee205e4e85ff453.exe
    "C:\Users\Admin\AppData\Local\Temp\0e61a1dd0f40778656a0c365121eff1ee1322f3af79f9789bee205e4e85ff453.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3668
    • C:\Users\Admin\AppData\Local\Temp\0e61a1dd0f40778656a0c365121eff1ee1322f3af79f9789bee205e4e85ff453.exe
      "C:\Users\Admin\AppData\Local\Temp\0e61a1dd0f40778656a0c365121eff1ee1322f3af79f9789bee205e4e85ff453.exe"
      2⤵
      • Checks computer location settings
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:620
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ROCOW.bat" "
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3024
        • C:\Windows\SysWOW64\reg.exe
          REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Video Driver" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\config\explorer.exe" /f
          4⤵
          • Adds Run key to start application
          PID:1292
      • C:\Users\Admin\AppData\Roaming\config\explorer.exe
        "C:\Users\Admin\AppData\Roaming\config\explorer.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3828
        • C:\Users\Admin\AppData\Roaming\config\explorer.exe
          "C:\Users\Admin\AppData\Roaming\config\explorer.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:1944
        • C:\Users\Admin\AppData\Roaming\config\explorer.exe
          "C:\Users\Admin\AppData\Roaming\config\explorer.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:3760
          • C:\Users\Admin\AppData\Roaming\config\explorer.exe
            "C:\Users\Admin\AppData\Roaming\config\explorer.exe"
            5⤵
            • Executes dropped EXE
            PID:1592

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\ROCOW.txt

    Filesize

    149B

    MD5

    fc1798b7c7938454220fda837a76f354

    SHA1

    b232912930b2bc24ff18bf7ecd58f872bbe01ea0

    SHA256

    7f0a5917b5aca9c5beb153aad0ef95bf0aeafb83768da5b086c3f029ba42d7c8

    SHA512

    d1abdd45a8e5d33893b9d19424174a07feed145d2e6b4be318ab5fde503f850579a4a101a010f30e16ecde2c7123f45357a8341214655321ee0f0097ca911331

  • C:\Users\Admin\AppData\Roaming\config\explorer.exe

    Filesize

    88KB

    MD5

    ae8f1df7db72ab5b597d78ab00c4f664

    SHA1

    2256d81dc7cbd686567cd2304023699934755d41

    SHA256

    0e61a1dd0f40778656a0c365121eff1ee1322f3af79f9789bee205e4e85ff453

    SHA512

    e7181075975ed268a65a8dfb09ee048a055483714518cbd1ed82b3c0715923f376dbc9f63f118625d8bada0c0cb4217919c2410ccfcc7b1703f1f98d0987d103

  • memory/620-17-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/620-62-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/620-20-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/620-19-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/1592-70-0x0000000000400000-0x0000000000404000-memory.dmp

    Filesize

    16KB

  • memory/1592-68-0x0000000000400000-0x0000000000404000-memory.dmp

    Filesize

    16KB

  • memory/1592-63-0x0000000000400000-0x0000000000404000-memory.dmp

    Filesize

    16KB

  • memory/1944-69-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/3668-4-0x0000000002900000-0x0000000002901000-memory.dmp

    Filesize

    4KB

  • memory/3668-15-0x00000000029B0000-0x00000000029B1000-memory.dmp

    Filesize

    4KB

  • memory/3668-7-0x0000000002930000-0x0000000002931000-memory.dmp

    Filesize

    4KB

  • memory/3668-6-0x0000000002920000-0x0000000002921000-memory.dmp

    Filesize

    4KB

  • memory/3668-2-0x0000000002190000-0x0000000002191000-memory.dmp

    Filesize

    4KB

  • memory/3668-9-0x0000000002960000-0x0000000002961000-memory.dmp

    Filesize

    4KB

  • memory/3668-10-0x0000000002970000-0x0000000002971000-memory.dmp

    Filesize

    4KB

  • memory/3668-11-0x0000000002980000-0x0000000002981000-memory.dmp

    Filesize

    4KB

  • memory/3668-12-0x0000000002990000-0x0000000002991000-memory.dmp

    Filesize

    4KB

  • memory/3668-13-0x00000000029A0000-0x00000000029A1000-memory.dmp

    Filesize

    4KB

  • memory/3668-3-0x00000000028F0000-0x00000000028F1000-memory.dmp

    Filesize

    4KB

  • memory/3668-5-0x0000000002910000-0x0000000002911000-memory.dmp

    Filesize

    4KB

  • memory/3668-16-0x00000000029E0000-0x00000000029E1000-memory.dmp

    Filesize

    4KB

  • memory/3668-8-0x0000000002940000-0x0000000002941000-memory.dmp

    Filesize

    4KB

  • memory/3668-14-0x00000000029D0000-0x00000000029D1000-memory.dmp

    Filesize

    4KB

  • memory/3760-56-0x0000000000400000-0x0000000000403000-memory.dmp

    Filesize

    12KB

  • memory/3760-57-0x0000000000400000-0x0000000000403000-memory.dmp

    Filesize

    12KB

  • memory/3760-65-0x0000000000400000-0x0000000000403000-memory.dmp

    Filesize

    12KB

  • memory/3760-49-0x0000000000400000-0x0000000000403000-memory.dmp

    Filesize

    12KB

  • memory/3760-53-0x0000000000400000-0x0000000000403000-memory.dmp

    Filesize

    12KB

  • memory/3828-55-0x0000000000400000-0x0000000000416000-memory.dmp

    Filesize

    88KB