Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

Mercurial.exe

windows7-x64

7

Mercurial.exe

windows10-2004-x64

10

Resubmissions

12/06/2024, 16:00 UTC

240612-tfqzrsvcnj 3

12/06/2024, 15:48 UTC

240612-s86p9avanp 10

Analysis

  • max time kernel
    490s
  • max time network
    358s
  • platform
    windows7_x64
  • resource
    win7-20240611-en
  • resource tags

    arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
  • submitted
    12/06/2024, 15:48 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Mercurial.exe

  • Size

    3.2MB

  • MD5

    a9477b3e21018b96fc5d2264d4016e65

  • SHA1

    493fa8da8bf89ea773aeb282215f78219a5401b7

  • SHA256

    890fd59af3370e2ce12e0d11916d1ad4ee9b9c267c434347dbed11e9572e8645

  • SHA512

    66529a656865400fe37d40ae125a1d057f8be5aa17da80d367ebbe1a9dcea38f5174870d0dc5b56771f6ca5a13e2fad22d803f5357f3ef59a46e3bdf0cc5ee9c

  • SSDEEP

    98304:5kjozJ9/im8XVBKl6t1buVfRhq+5tXzgCa/T:lzJpjS346t1bIfuq07

Score
7/10
agilenet

Malware Config

Signatures

  • Obfuscated with Agile.Net obfuscator 11 IoCs

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    agilenet
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Mercurial.exe
    "C:\Users\Admin\AppData\Local\Temp\Mercurial.exe"
    1⤵
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1696
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\yv4rkjsj\yv4rkjsj.cmdline"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2160
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAB5C.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCC0E43CED17A04947B3565AEF3E2CD5A0.TMP"
        3⤵
          PID:2892
    • C:\Windows\SysWOW64\DllHost.exe
      C:\Windows\SysWOW64\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
      1⤵
        PID:2888
      • C:\Windows\SysWOW64\DllHost.exe
        C:\Windows\SysWOW64\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
        1⤵
          PID:1668
        • C:\Windows\explorer.exe
          "C:\Windows\explorer.exe"
          1⤵
            PID:1236
          • C:\Windows\system32\AUDIODG.EXE
            C:\Windows\system32\AUDIODG.EXE 0x540
            1⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:2444

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\RESAB5C.tmp
            Filesize

            1KB

            MD5

            a3e8c3243629b54c4f6cc3c379d303e0

            SHA1

            884f73d09cf9def687bb5deab4aabfb9dae59147

            SHA256

            bceed792682a8a1481c12b8892c9d8917e5194cf002d6b0e69e69e07ef9c6ad7

            SHA512

            8b6c365aec60d30fcf0c0f5ca0ff2e78792968b63bc13d2749165328d4676e6e3fb05bc2812ba3c2ad5ddd119a8763551927ec27448dd7ebc1f5cf6d284d03fd

            Download Submit

          • \??\c:\Users\Admin\AppData\Local\Temp\CSCC0E43CED17A04947B3565AEF3E2CD5A0.TMP
            Filesize

            1KB

            MD5

            59ae09c4cf689532f57b411f8c0793a9

            SHA1

            2735f01236e2b444a2fe177b128477527a8b39c7

            SHA256

            532956b031ca7e27a90cb61f1c6e1305b9c80a39522724045c816399bca22137

            SHA512

            5bf3d74f15cfa474c5390f36f7262e8e9ca9e977dd677944a58671b0c1e590e9b40b1edf0ef2ca0a3b8608d36787da5978942dba4b2205d4c4cb9d5238817e1d

            Download Submit

          • \??\c:\Users\Admin\AppData\Local\Temp\yv4rkjsj\yv4rkjsj.0.cs
            Filesize

            11KB

            MD5

            a4fb19dc6b70481ac7ed6f570e2c4f90

            SHA1

            d8e5711e0ba6ba8ed9771c6da956cfd0c1a38538

            SHA256

            789b2fb89f8974b2811071d52034fa2e9e7e0e2e598bac8157e87dd333893899

            SHA512

            3f0c3b3d6b2c99a788e768617ca336b6e1c79f00553e6dbf4d9cc6586955e3a2fc9731af83ca0d6d64b7658ed13282ce4e96f816979dd62e8e9a70f8c21cf220

            Download Submit

          • \??\c:\Users\Admin\AppData\Local\Temp\yv4rkjsj\yv4rkjsj.1.cs
            Filesize

            5KB

            MD5

            8aab1997664a604aca551b20202bfd14

            SHA1

            279cf8f218069cbf4351518ad6df9a783ca34bc5

            SHA256

            029f57fa483bbcee0dd5464e0d4d89bd03032161424d0ffd1da2b3d5db15977f

            SHA512

            cf0efea853d7e1997dcfcc9a73668ed9a5ac01cf22cbb7082a05abc141fccc7c92a936b245666071df75389cd7ebe60dc99b3c21279173fe12888a99034a5eda

            Download Submit

          • \??\c:\Users\Admin\AppData\Local\Temp\yv4rkjsj\yv4rkjsj.2.cs
            Filesize

            7KB

            MD5

            6fdae9afc1f8e77e882f1ba6b5859a4e

            SHA1

            33eb96f75ffe9a1c4f94388e7465b997320265a5

            SHA256

            a365264dd2d3388acc38b2f5c8f3c267bbf83ca463f70fbf6c8459123a7cc33d

            SHA512

            97bb77e8c9c7a1a46fa416a917787ddced3439f72ea35558f22fa2450fbbd11928f3442baec0b33b14576683baa6c1c6b3e1376bd7742da358c808bf07db28e9

            Download Submit

          • \??\c:\Users\Admin\AppData\Local\Temp\yv4rkjsj\yv4rkjsj.3.cs
            Filesize

            8KB

            MD5

            6ba707982ee7e5f0ae55ce3fa5ccad17

            SHA1

            d094c98491058ed49861ce82701abe1f38385f18

            SHA256

            19af9bea270f830354af8250cd82db32fdcab6327d139e2720713fb7d43a5797

            SHA512

            d9cf480c32bfb806c72a2dc6fe211c4806388ccf548d55b059e633e8f814d46c80ef73eacfb02398fd3b1e75b7c44b8a1ba0b29476edbf9fe1b29322798d3cfa

            Download Submit

          • \??\c:\Users\Admin\AppData\Local\Temp\yv4rkjsj\yv4rkjsj.4.cs
            Filesize

            2KB

            MD5

            fae5458a5b3cee952e25d44d6eb9db85

            SHA1

            060d40137e9cce9f40adbb3b3763d1f020601e42

            SHA256

            240478bb9c522341906a0ef376e0188ce6106856a26a3ae0f7b58af07a377a06

            SHA512

            25f406f747518aef3a1c5c3d66e8bd474429b05ef994303c5f7bc5d3669d691d9dc21ea8f8a35e20b84f8c406bf89835f2f5007a8f743df755e67b4c380fa236

            Download Submit

          • \??\c:\Users\Admin\AppData\Local\Temp\yv4rkjsj\yv4rkjsj.5.cs
            Filesize

            4KB

            MD5

            42f157ad8e79e06a142791d6e98e0365

            SHA1

            a05e8946e04907af3f631a7de1537d7c1bb34443

            SHA256

            e30402cd45589982489719678adf59b016674faa6f7a9af074601e978cc9a0ed

            SHA512

            e214e1cd49e677e1ed632e86e4d1680b0d04a7a0086a273422c14c28485dc549cc5b4bde13e45336f0c4b842751dfd6ef702df3524bc6570c477a4f713db09dc

            Download Submit

          • \??\c:\Users\Admin\AppData\Local\Temp\yv4rkjsj\yv4rkjsj.6.cs
            Filesize

            6KB

            MD5

            8ec0f0e49ffe092345673ab4d9f45641

            SHA1

            401bd9e2894e9098504f7cc8f8d52f86c3ebe495

            SHA256

            93b9f783b5faed3ecfafbe20dfcf1bee3ce33f66909879cd39ae88c36acbdfac

            SHA512

            60363b36587a3ace9ae1dbc21ffd39f903e5f51945eebdcf0316904eee316c9d711d7a014b28977d54eef25dec13f659aab06325f761d9f3ce9baca3cb12f248

            Download Submit

          • \??\c:\Users\Admin\AppData\Local\Temp\yv4rkjsj\yv4rkjsj.7.cs
            Filesize

            16KB

            MD5

            05206d577ce19c1ef8d9341b93cd5520

            SHA1

            1ee5c862592045912eb45f9d94376f47b5410d3d

            SHA256

            e2bbdc7ba4236f9c4cb829d63137fdac3a308fd5da96acea35212beafe01b877

            SHA512

            4648fa7ea0a35a148e9dac1f659601ebf48910ca699ed9ef8d46614c7cbe14fcf47fa30dc87af53b987934a2a56cd71fd0e58182ef36a97ed47bd84637b54855

            Download Submit

          • \??\c:\Users\Admin\AppData\Local\Temp\yv4rkjsj\yv4rkjsj.8.cs
            Filesize

            561B

            MD5

            7ae06a071e39d392c21f8395ef5a9261

            SHA1

            007e618097c9a099c9f5c3129e5bbf1fc7deb930

            SHA256

            00e152629bdbf25a866f98e6fc30626d2514527beef1b76ebb85b1f5f9c83718

            SHA512

            5203c937597e51b97273040fe441392e0df7841f680fcca0d761ac6d47b72d02c8918614f030fbf23d8a58cb5625b702546e4c6f93e130cc5d3b41c154c42655

            Download Submit

          • \??\c:\Users\Admin\AppData\Local\Temp\yv4rkjsj\yv4rkjsj.9.cs
            Filesize

            10KB

            MD5

            380d15f61b0e775054eefdce7279510d

            SHA1

            47285dc55dafd082edd1851eea8edc2f7a1d0157

            SHA256

            bef491a61351ad58cda96b73dba70027fdbe4966917e33145ba5cfa8c83bc717

            SHA512

            d4cbaad29d742d55926fea6b3fa1cf754c3e71736e763d9271dc983e08fce5251fa849d4ecdc1187c29f92e27adab22b8f99791e46302b5d9c2e90b832c28c28

            Download Submit

          • \??\c:\Users\Admin\AppData\Local\Temp\yv4rkjsj\yv4rkjsj.cmdline
            Filesize

            840B

            MD5

            60dc33061ddbd1b9ac3de08167646b89

            SHA1

            49c1ef2a11b0c520a0cc82b3d7260c14dd0c6955

            SHA256

            93996258cd6f29387bc076709d97d052b85f826612f29770748797cb1cbc5a5f

            SHA512

            1bdf6f2376ecdfdcff3708c62668de6558281b7b8005a87e07d0e5928328cf69cf661784661c27c6ae00fd39a86065f53e82ab095b91d25286b9a4bab73aaa51

            Download Submit

          • memory/1696-10-0x0000000000610000-0x0000000000646000-memory.dmp

            Filesize

            216KB

            Download

          • memory/1696-28-0x0000000005850000-0x0000000005852000-memory.dmp

            Filesize

            8KB

            Download

          • memory/1696-15-0x00000000008C0000-0x00000000008F0000-memory.dmp

            Filesize

            192KB

            Download

          • memory/1696-16-0x0000000074510000-0x0000000074BFE000-memory.dmp

            Filesize

            6.9MB

            Download

          • memory/1696-17-0x0000000005350000-0x0000000005358000-memory.dmp

            Filesize

            32KB

            Download

          • memory/1696-18-0x0000000074510000-0x0000000074BFE000-memory.dmp

            Filesize

            6.9MB

            Download

          • memory/1696-19-0x0000000074510000-0x0000000074BFE000-memory.dmp

            Filesize

            6.9MB

            Download

          • memory/1696-20-0x0000000074510000-0x0000000074BFE000-memory.dmp

            Filesize

            6.9MB

            Download

          • memory/1696-21-0x000000007451E000-0x000000007451F000-memory.dmp

            Filesize

            4KB

            Download

          • memory/1696-22-0x0000000074510000-0x0000000074BFE000-memory.dmp

            Filesize

            6.9MB

            Download

          • memory/1696-23-0x0000000074510000-0x0000000074BFE000-memory.dmp

            Filesize

            6.9MB

            Download

          • memory/1696-24-0x0000000074510000-0x0000000074BFE000-memory.dmp

            Filesize

            6.9MB

            Download

          • memory/1696-25-0x0000000074510000-0x0000000074BFE000-memory.dmp

            Filesize

            6.9MB

            Download

          • memory/1696-26-0x0000000074510000-0x0000000074BFE000-memory.dmp

            Filesize

            6.9MB

            Download

          • memory/1696-27-0x0000000074510000-0x0000000074BFE000-memory.dmp

            Filesize

            6.9MB

            Download

          • memory/1696-14-0x0000000005460000-0x0000000005576000-memory.dmp

            Filesize

            1.1MB

            Download

          • memory/1696-29-0x0000000074510000-0x0000000074BFE000-memory.dmp

            Filesize

            6.9MB

            Download

          • memory/1696-13-0x0000000004CE0000-0x0000000004E2A000-memory.dmp

            Filesize

            1.3MB

            Download

          • memory/1696-11-0x0000000000710000-0x000000000071E000-memory.dmp

            Filesize

            56KB

            Download

          • memory/1696-12-0x0000000000720000-0x000000000072E000-memory.dmp

            Filesize

            56KB

            Download

          • memory/1696-0-0x000000007451E000-0x000000007451F000-memory.dmp

            Filesize

            4KB

            Download

          • memory/1696-9-0x0000000000590000-0x00000000005AE000-memory.dmp

            Filesize

            120KB

            Download

          • memory/1696-8-0x0000000000850000-0x00000000008BE000-memory.dmp

            Filesize

            440KB

            Download

          • memory/1696-7-0x0000000000580000-0x0000000000594000-memory.dmp

            Filesize

            80KB

            Download

          • memory/1696-6-0x00000000004E0000-0x00000000004F0000-memory.dmp

            Filesize

            64KB

            Download

          • memory/1696-5-0x00000000004C0000-0x00000000004E0000-memory.dmp

            Filesize

            128KB

            Download

          • memory/1696-3-0x0000000000450000-0x0000000000470000-memory.dmp

            Filesize

            128KB

            Download

          • memory/1696-4-0x0000000074510000-0x0000000074BFE000-memory.dmp

            Filesize

            6.9MB

            Download

          • memory/1696-2-0x0000000000420000-0x000000000043C000-memory.dmp

            Filesize

            112KB

            Download

          • memory/1696-1-0x0000000000BE0000-0x0000000000F1A000-memory.dmp

            Filesize

            3.2MB

            Download

          We care about your privacy.

          This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.