Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

Mercurial.exe

windows7-x64

7

Mercurial.exe

windows10-2004-x64

10

Resubmissions

12/06/2024, 16:00

240612-tfqzrsvcnj 3

12/06/2024, 15:48

240612-s86p9avanp 10

Analysis

  • max time kernel
    490s
  • max time network
    358s
  • platform
    windows7_x64
  • resource
    win7-20240611-en
  • resource tags

    arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
  • submitted
    12/06/2024, 15:48

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Mercurial.exe

  • Size

    3.2MB

  • MD5

    a9477b3e21018b96fc5d2264d4016e65

  • SHA1

    493fa8da8bf89ea773aeb282215f78219a5401b7

  • SHA256

    890fd59af3370e2ce12e0d11916d1ad4ee9b9c267c434347dbed11e9572e8645

  • SHA512

    66529a656865400fe37d40ae125a1d057f8be5aa17da80d367ebbe1a9dcea38f5174870d0dc5b56771f6ca5a13e2fad22d803f5357f3ef59a46e3bdf0cc5ee9c

  • SSDEEP

    98304:5kjozJ9/im8XVBKl6t1buVfRhq+5tXzgCa/T:lzJpjS346t1bIfuq07

Score
7/10
agilenet

Malware Config

Signatures

  • Obfuscated with Agile.Net obfuscator 11 IoCs

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    agilenet
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Mercurial.exe
    "C:\Users\Admin\AppData\Local\Temp\Mercurial.exe"
    1⤵
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1696
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\yv4rkjsj\yv4rkjsj.cmdline"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2160
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAB5C.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCC0E43CED17A04947B3565AEF3E2CD5A0.TMP"
        3⤵
          PID:2892
    • C:\Windows\SysWOW64\DllHost.exe
      C:\Windows\SysWOW64\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
      1⤵
        PID:2888
      • C:\Windows\SysWOW64\DllHost.exe
        C:\Windows\SysWOW64\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
        1⤵
          PID:1668
        • C:\Windows\explorer.exe
          "C:\Windows\explorer.exe"
          1⤵
            PID:1236
          • C:\Windows\system32\AUDIODG.EXE
            C:\Windows\system32\AUDIODG.EXE 0x540
            1⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:2444

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\RESAB5C.tmp
            Filesize

            1KB

            MD5

            a3e8c3243629b54c4f6cc3c379d303e0

            SHA1

            884f73d09cf9def687bb5deab4aabfb9dae59147

            SHA256

            bceed792682a8a1481c12b8892c9d8917e5194cf002d6b0e69e69e07ef9c6ad7

            SHA512

            8b6c365aec60d30fcf0c0f5ca0ff2e78792968b63bc13d2749165328d4676e6e3fb05bc2812ba3c2ad5ddd119a8763551927ec27448dd7ebc1f5cf6d284d03fd

            Download Submit

          • \??\c:\Users\Admin\AppData\Local\Temp\CSCC0E43CED17A04947B3565AEF3E2CD5A0.TMP
            Filesize

            1KB

            MD5

            59ae09c4cf689532f57b411f8c0793a9

            SHA1

            2735f01236e2b444a2fe177b128477527a8b39c7

            SHA256

            532956b031ca7e27a90cb61f1c6e1305b9c80a39522724045c816399bca22137

            SHA512

            5bf3d74f15cfa474c5390f36f7262e8e9ca9e977dd677944a58671b0c1e590e9b40b1edf0ef2ca0a3b8608d36787da5978942dba4b2205d4c4cb9d5238817e1d

            Download Submit

          • \??\c:\Users\Admin\AppData\Local\Temp\yv4rkjsj\yv4rkjsj.0.cs
            Filesize

            11KB

            MD5

            a4fb19dc6b70481ac7ed6f570e2c4f90

            SHA1

            d8e5711e0ba6ba8ed9771c6da956cfd0c1a38538

            SHA256

            789b2fb89f8974b2811071d52034fa2e9e7e0e2e598bac8157e87dd333893899

            SHA512

            3f0c3b3d6b2c99a788e768617ca336b6e1c79f00553e6dbf4d9cc6586955e3a2fc9731af83ca0d6d64b7658ed13282ce4e96f816979dd62e8e9a70f8c21cf220

            Download Submit

          • \??\c:\Users\Admin\AppData\Local\Temp\yv4rkjsj\yv4rkjsj.1.cs
            Filesize

            5KB

            MD5

            8aab1997664a604aca551b20202bfd14

            SHA1

            279cf8f218069cbf4351518ad6df9a783ca34bc5

            SHA256

            029f57fa483bbcee0dd5464e0d4d89bd03032161424d0ffd1da2b3d5db15977f

            SHA512

            cf0efea853d7e1997dcfcc9a73668ed9a5ac01cf22cbb7082a05abc141fccc7c92a936b245666071df75389cd7ebe60dc99b3c21279173fe12888a99034a5eda

            Download Submit

          • \??\c:\Users\Admin\AppData\Local\Temp\yv4rkjsj\yv4rkjsj.2.cs
            Filesize

            7KB

            MD5

            6fdae9afc1f8e77e882f1ba6b5859a4e

            SHA1

            33eb96f75ffe9a1c4f94388e7465b997320265a5

            SHA256

            a365264dd2d3388acc38b2f5c8f3c267bbf83ca463f70fbf6c8459123a7cc33d

            SHA512

            97bb77e8c9c7a1a46fa416a917787ddced3439f72ea35558f22fa2450fbbd11928f3442baec0b33b14576683baa6c1c6b3e1376bd7742da358c808bf07db28e9

            Download Submit

          • \??\c:\Users\Admin\AppData\Local\Temp\yv4rkjsj\yv4rkjsj.3.cs
            Filesize

            8KB

            MD5

            6ba707982ee7e5f0ae55ce3fa5ccad17

            SHA1

            d094c98491058ed49861ce82701abe1f38385f18

            SHA256

            19af9bea270f830354af8250cd82db32fdcab6327d139e2720713fb7d43a5797

            SHA512

            d9cf480c32bfb806c72a2dc6fe211c4806388ccf548d55b059e633e8f814d46c80ef73eacfb02398fd3b1e75b7c44b8a1ba0b29476edbf9fe1b29322798d3cfa

            Download Submit

          • \??\c:\Users\Admin\AppData\Local\Temp\yv4rkjsj\yv4rkjsj.4.cs
            Filesize

            2KB

            MD5

            fae5458a5b3cee952e25d44d6eb9db85

            SHA1

            060d40137e9cce9f40adbb3b3763d1f020601e42

            SHA256

            240478bb9c522341906a0ef376e0188ce6106856a26a3ae0f7b58af07a377a06

            SHA512

            25f406f747518aef3a1c5c3d66e8bd474429b05ef994303c5f7bc5d3669d691d9dc21ea8f8a35e20b84f8c406bf89835f2f5007a8f743df755e67b4c380fa236

            Download Submit

          • \??\c:\Users\Admin\AppData\Local\Temp\yv4rkjsj\yv4rkjsj.5.cs
            Filesize

            4KB

            MD5

            42f157ad8e79e06a142791d6e98e0365

            SHA1

            a05e8946e04907af3f631a7de1537d7c1bb34443

            SHA256

            e30402cd45589982489719678adf59b016674faa6f7a9af074601e978cc9a0ed

            SHA512

            e214e1cd49e677e1ed632e86e4d1680b0d04a7a0086a273422c14c28485dc549cc5b4bde13e45336f0c4b842751dfd6ef702df3524bc6570c477a4f713db09dc

            Download Submit

          • \??\c:\Users\Admin\AppData\Local\Temp\yv4rkjsj\yv4rkjsj.6.cs
            Filesize

            6KB

            MD5

            8ec0f0e49ffe092345673ab4d9f45641

            SHA1

            401bd9e2894e9098504f7cc8f8d52f86c3ebe495

            SHA256

            93b9f783b5faed3ecfafbe20dfcf1bee3ce33f66909879cd39ae88c36acbdfac

            SHA512

            60363b36587a3ace9ae1dbc21ffd39f903e5f51945eebdcf0316904eee316c9d711d7a014b28977d54eef25dec13f659aab06325f761d9f3ce9baca3cb12f248

            Download Submit

          • \??\c:\Users\Admin\AppData\Local\Temp\yv4rkjsj\yv4rkjsj.7.cs
            Filesize

            16KB

            MD5

            05206d577ce19c1ef8d9341b93cd5520

            SHA1

            1ee5c862592045912eb45f9d94376f47b5410d3d

            SHA256

            e2bbdc7ba4236f9c4cb829d63137fdac3a308fd5da96acea35212beafe01b877

            SHA512

            4648fa7ea0a35a148e9dac1f659601ebf48910ca699ed9ef8d46614c7cbe14fcf47fa30dc87af53b987934a2a56cd71fd0e58182ef36a97ed47bd84637b54855

            Download Submit

          • \??\c:\Users\Admin\AppData\Local\Temp\yv4rkjsj\yv4rkjsj.8.cs
            Filesize

            561B

            MD5

            7ae06a071e39d392c21f8395ef5a9261

            SHA1

            007e618097c9a099c9f5c3129e5bbf1fc7deb930

            SHA256

            00e152629bdbf25a866f98e6fc30626d2514527beef1b76ebb85b1f5f9c83718

            SHA512

            5203c937597e51b97273040fe441392e0df7841f680fcca0d761ac6d47b72d02c8918614f030fbf23d8a58cb5625b702546e4c6f93e130cc5d3b41c154c42655

            Download Submit

          • \??\c:\Users\Admin\AppData\Local\Temp\yv4rkjsj\yv4rkjsj.9.cs
            Filesize

            10KB

            MD5

            380d15f61b0e775054eefdce7279510d

            SHA1

            47285dc55dafd082edd1851eea8edc2f7a1d0157

            SHA256

            bef491a61351ad58cda96b73dba70027fdbe4966917e33145ba5cfa8c83bc717

            SHA512

            d4cbaad29d742d55926fea6b3fa1cf754c3e71736e763d9271dc983e08fce5251fa849d4ecdc1187c29f92e27adab22b8f99791e46302b5d9c2e90b832c28c28

            Download Submit

          • \??\c:\Users\Admin\AppData\Local\Temp\yv4rkjsj\yv4rkjsj.cmdline
            Filesize

            840B

            MD5

            60dc33061ddbd1b9ac3de08167646b89

            SHA1

            49c1ef2a11b0c520a0cc82b3d7260c14dd0c6955

            SHA256

            93996258cd6f29387bc076709d97d052b85f826612f29770748797cb1cbc5a5f

            SHA512

            1bdf6f2376ecdfdcff3708c62668de6558281b7b8005a87e07d0e5928328cf69cf661784661c27c6ae00fd39a86065f53e82ab095b91d25286b9a4bab73aaa51

            Download Submit

          • memory/1696-10-0x0000000000610000-0x0000000000646000-memory.dmp

            Filesize

            216KB

            Download

          • memory/1696-28-0x0000000005850000-0x0000000005852000-memory.dmp

            Filesize

            8KB

            Download

          • memory/1696-15-0x00000000008C0000-0x00000000008F0000-memory.dmp

            Filesize

            192KB

            Download

          • memory/1696-16-0x0000000074510000-0x0000000074BFE000-memory.dmp

            Filesize

            6.9MB

            Download

          • memory/1696-17-0x0000000005350000-0x0000000005358000-memory.dmp

            Filesize

            32KB

            Download

          • memory/1696-18-0x0000000074510000-0x0000000074BFE000-memory.dmp

            Filesize

            6.9MB

            Download

          • memory/1696-19-0x0000000074510000-0x0000000074BFE000-memory.dmp

            Filesize

            6.9MB

            Download

          • memory/1696-20-0x0000000074510000-0x0000000074BFE000-memory.dmp

            Filesize

            6.9MB

            Download

          • memory/1696-21-0x000000007451E000-0x000000007451F000-memory.dmp

            Filesize

            4KB

            Download

          • memory/1696-22-0x0000000074510000-0x0000000074BFE000-memory.dmp

            Filesize

            6.9MB

            Download

          • memory/1696-23-0x0000000074510000-0x0000000074BFE000-memory.dmp

            Filesize

            6.9MB

            Download

          • memory/1696-24-0x0000000074510000-0x0000000074BFE000-memory.dmp

            Filesize

            6.9MB

            Download

          • memory/1696-25-0x0000000074510000-0x0000000074BFE000-memory.dmp

            Filesize

            6.9MB

            Download

          • memory/1696-26-0x0000000074510000-0x0000000074BFE000-memory.dmp

            Filesize

            6.9MB

            Download

          • memory/1696-27-0x0000000074510000-0x0000000074BFE000-memory.dmp

            Filesize

            6.9MB

            Download

          • memory/1696-14-0x0000000005460000-0x0000000005576000-memory.dmp

            Filesize

            1.1MB

            Download

          • memory/1696-29-0x0000000074510000-0x0000000074BFE000-memory.dmp

            Filesize

            6.9MB

            Download

          • memory/1696-13-0x0000000004CE0000-0x0000000004E2A000-memory.dmp

            Filesize

            1.3MB

            Download

          • memory/1696-11-0x0000000000710000-0x000000000071E000-memory.dmp

            Filesize

            56KB

            Download

          • memory/1696-12-0x0000000000720000-0x000000000072E000-memory.dmp

            Filesize

            56KB

            Download

          • memory/1696-0-0x000000007451E000-0x000000007451F000-memory.dmp

            Filesize

            4KB

            Download

          • memory/1696-9-0x0000000000590000-0x00000000005AE000-memory.dmp

            Filesize

            120KB

            Download

          • memory/1696-8-0x0000000000850000-0x00000000008BE000-memory.dmp

            Filesize

            440KB

            Download

          • memory/1696-7-0x0000000000580000-0x0000000000594000-memory.dmp

            Filesize

            80KB

            Download

          • memory/1696-6-0x00000000004E0000-0x00000000004F0000-memory.dmp

            Filesize

            64KB

            Download

          • memory/1696-5-0x00000000004C0000-0x00000000004E0000-memory.dmp

            Filesize

            128KB

            Download

          • memory/1696-3-0x0000000000450000-0x0000000000470000-memory.dmp

            Filesize

            128KB

            Download

          • memory/1696-4-0x0000000074510000-0x0000000074BFE000-memory.dmp

            Filesize

            6.9MB

            Download

          • memory/1696-2-0x0000000000420000-0x000000000043C000-memory.dmp

            Filesize

            112KB

            Download

          • memory/1696-1-0x0000000000BE0000-0x0000000000F1A000-memory.dmp

            Filesize

            3.2MB

            Download