Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    51s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/06/2024, 20:25

General

  • Target

    363aeefc9adb17cdc816347f4ce7ae519eb89e4ef2ab12f48da5401c5767802b.exe

  • Size

    88KB

  • MD5

    672986c018e259d92efb948d60fe0d50

  • SHA1

    650b11fbd0d94cc539d94e13b462479e6a483a5c

  • SHA256

    363aeefc9adb17cdc816347f4ce7ae519eb89e4ef2ab12f48da5401c5767802b

  • SHA512

    173a99b17ccafc45d8de5c5646e66e73b89cc3f528be87b5f1c9094f155ecdf1cc2ce407397f8dc89582b33d2162fee61d65ea1a77dfc93c459c5a67e0f81cd0

  • SSDEEP

    1536:ahUDofByDJWbMGcEFLPEPKOJUsy1+VMA:aIofBHbKMP0PvMA

Score
9/10

Malware Config

Signatures

  • UPX dump on OEP (original entry point) 7 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 39 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\363aeefc9adb17cdc816347f4ce7ae519eb89e4ef2ab12f48da5401c5767802b.exe
    "C:\Users\Admin\AppData\Local\Temp\363aeefc9adb17cdc816347f4ce7ae519eb89e4ef2ab12f48da5401c5767802b.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:836
    • C:\Users\Admin\AppData\Local\Temp\363aeefc9adb17cdc816347f4ce7ae519eb89e4ef2ab12f48da5401c5767802b.exe
      "C:\Users\Admin\AppData\Local\Temp\363aeefc9adb17cdc816347f4ce7ae519eb89e4ef2ab12f48da5401c5767802b.exe"
      2⤵
      • Checks computer location settings
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1828
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VCDAJ.bat" "
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1832
        • C:\Windows\SysWOW64\reg.exe
          REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Video Driver" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\config\explorer.exe" /f
          4⤵
          • Adds Run key to start application
          PID:1560
      • C:\Users\Admin\AppData\Roaming\config\explorer.exe
        "C:\Users\Admin\AppData\Roaming\config\explorer.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:520
        • C:\Users\Admin\AppData\Roaming\config\explorer.exe
          "C:\Users\Admin\AppData\Roaming\config\explorer.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:3616
        • C:\Users\Admin\AppData\Roaming\config\explorer.exe
          "C:\Users\Admin\AppData\Roaming\config\explorer.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:2104
          • C:\Users\Admin\AppData\Roaming\config\explorer.exe
            "C:\Users\Admin\AppData\Roaming\config\explorer.exe"
            5⤵
            • Executes dropped EXE
            PID:428

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\VCDAJ.txt

    Filesize

    149B

    MD5

    fc1798b7c7938454220fda837a76f354

    SHA1

    b232912930b2bc24ff18bf7ecd58f872bbe01ea0

    SHA256

    7f0a5917b5aca9c5beb153aad0ef95bf0aeafb83768da5b086c3f029ba42d7c8

    SHA512

    d1abdd45a8e5d33893b9d19424174a07feed145d2e6b4be318ab5fde503f850579a4a101a010f30e16ecde2c7123f45357a8341214655321ee0f0097ca911331

  • C:\Users\Admin\AppData\Roaming\config\explorer.exe

    Filesize

    88KB

    MD5

    0a7136ccea50fc9bd6156f64859961e5

    SHA1

    83fb8a11f2d5a0a77e534c23ec1a6fee0f396bb3

    SHA256

    c1bf8e13638f1c97b03d133c9bd17472a423a5bd813c62c71519f5d3ed151c8b

    SHA512

    2e7eb7e20acb913da2533217382001c409f208f58a21776d68b1f65759357027d13ad79f45e2951d6b721dfc0ec448dc1ed12863e05faee5fa12e5a462e584b1

  • memory/428-72-0x0000000000400000-0x0000000000404000-memory.dmp

    Filesize

    16KB

  • memory/428-70-0x0000000000400000-0x0000000000404000-memory.dmp

    Filesize

    16KB

  • memory/428-65-0x0000000000400000-0x0000000000404000-memory.dmp

    Filesize

    16KB

  • memory/520-54-0x0000000000400000-0x0000000000416000-memory.dmp

    Filesize

    88KB

  • memory/836-2-0x0000000002190000-0x0000000002191000-memory.dmp

    Filesize

    4KB

  • memory/836-12-0x0000000002250000-0x0000000002251000-memory.dmp

    Filesize

    4KB

  • memory/836-10-0x0000000002230000-0x0000000002231000-memory.dmp

    Filesize

    4KB

  • memory/836-9-0x0000000002220000-0x0000000002221000-memory.dmp

    Filesize

    4KB

  • memory/836-8-0x0000000002210000-0x0000000002211000-memory.dmp

    Filesize

    4KB

  • memory/836-7-0x0000000002200000-0x0000000002201000-memory.dmp

    Filesize

    4KB

  • memory/836-6-0x00000000021F0000-0x00000000021F1000-memory.dmp

    Filesize

    4KB

  • memory/836-5-0x00000000021E0000-0x00000000021E1000-memory.dmp

    Filesize

    4KB

  • memory/836-3-0x00000000021C0000-0x00000000021C1000-memory.dmp

    Filesize

    4KB

  • memory/836-4-0x00000000021D0000-0x00000000021D1000-memory.dmp

    Filesize

    4KB

  • memory/836-16-0x0000000002AE0000-0x0000000002AE1000-memory.dmp

    Filesize

    4KB

  • memory/836-13-0x0000000002260000-0x0000000002261000-memory.dmp

    Filesize

    4KB

  • memory/836-15-0x0000000002AD0000-0x0000000002AD1000-memory.dmp

    Filesize

    4KB

  • memory/836-11-0x0000000002240000-0x0000000002241000-memory.dmp

    Filesize

    4KB

  • memory/836-14-0x0000000002AC0000-0x0000000002AC1000-memory.dmp

    Filesize

    4KB

  • memory/1828-23-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/1828-64-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/1828-19-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/1828-17-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/1828-20-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/2104-52-0x0000000000400000-0x0000000000403000-memory.dmp

    Filesize

    12KB

  • memory/2104-61-0x0000000000400000-0x0000000000403000-memory.dmp

    Filesize

    12KB

  • memory/2104-60-0x0000000000400000-0x0000000000403000-memory.dmp

    Filesize

    12KB

  • memory/2104-56-0x0000000000400000-0x0000000000403000-memory.dmp

    Filesize

    12KB

  • memory/2104-67-0x0000000000400000-0x0000000000403000-memory.dmp

    Filesize

    12KB

  • memory/3616-59-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/3616-71-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB