Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/06/2024, 16:23

General

  • Target

    243630e4469d7601cae94bd9dc09488313845a009d679e135f0d43bd703cc89c.exe

  • Size

    6.0MB

  • MD5

    db692724da053d4853cc4ad602da9edc

  • SHA1

    29ee8e69e979f9a5efb8c2ad10c6c5dd0570b54b

  • SHA256

    243630e4469d7601cae94bd9dc09488313845a009d679e135f0d43bd703cc89c

  • SHA512

    1ebce4fd3369a0b878d59799bbd5c92247496f8b9873d9f5d7b985a3b592dda7182d8ee2fc259fb6a1ecbfdb9ac5a541fbf6461ae4494ca22bd16a0d0ad66bed

  • SSDEEP

    98304:fbdhDqohDS1F+CRcB27OgUWZHw8VQjr+/bJBAUZLb:fbdhDD23a2sWKjr+TJVX

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • UPX packed file 26 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\243630e4469d7601cae94bd9dc09488313845a009d679e135f0d43bd703cc89c.exe
    "C:\Users\Admin\AppData\Local\Temp\243630e4469d7601cae94bd9dc09488313845a009d679e135f0d43bd703cc89c.exe"
    1⤵
    • Loads dropped DLL
    • Writes to the Master Boot Record (MBR)
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4972
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://changkongbao.lanzouq.com/ikW9T1cfeg5e
      2⤵
        PID:716
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4416,i,6870419347051655189,5491911050420577193,262144 --variations-seed-version --mojo-platform-channel-handle=4172 /prefetch:8
      1⤵
        PID:3108
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --field-trial-handle=4404,i,6870419347051655189,5491911050420577193,262144 --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:1
        1⤵
          PID:4508
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --field-trial-handle=3924,i,6870419347051655189,5491911050420577193,262144 --variations-seed-version --mojo-platform-channel-handle=2784 /prefetch:1
          1⤵
            PID:3536
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=5152,i,6870419347051655189,5491911050420577193,262144 --variations-seed-version --mojo-platform-channel-handle=4128 /prefetch:8
            1⤵
              PID:180
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --field-trial-handle=5312,i,6870419347051655189,5491911050420577193,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:8
              1⤵
                PID:4968
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --field-trial-handle=5448,i,6870419347051655189,5491911050420577193,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:1
                1⤵
                  PID:4780
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --field-trial-handle=5628,i,6870419347051655189,5491911050420577193,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:1
                  1⤵
                    PID:4560

                  Network

                  MITRE ATT&CK Enterprise v15

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\Users\Admin\AppData\Local\Temp\ExuiKrnln_Win32_20230421.lib

                    Filesize

                    1.5MB

                    MD5

                    ef48d7cc52338513cc0ce843c5e3916b

                    SHA1

                    20965d86b7b358edf8b5d819302fa7e0e6159c18

                    SHA256

                    835bfef980ad0cedf10d8ade0cf5671d9f56062f2b22d0a0547b07772ceb25a8

                    SHA512

                    fd4602bd487eaad5febb5b3e9d8fe75f4190d1e44e538e7ae2d2129087f35b72b254c85d7335a81854aa2bdb4f0f2fa22e02a892ee23ac57b78cdd03a79259b9

                  • C:\Users\Admin\AppData\Local\Temp\·½°¸.ini

                    Filesize

                    10KB

                    MD5

                    842d9e10867153ad73a1a80d79afef13

                    SHA1

                    33a49d893273182e8aba6e9531c3077d4ab86516

                    SHA256

                    2823197bddf0203ea011003a4e70f2687da234a3388b5090a76da2c2562d33e4

                    SHA512

                    e6e10f63c7d3e65358bd6e66a7328f7d06d096b2ed936cd4504cfb8c6b5f4081dd55884bb915191156965b0eb9b3fda6a97b5b1a1eee45d59a41a4e375d1e518

                  • C:\Users\Admin\AppData\Local\Temp\·½°¸.ini

                    Filesize

                    8KB

                    MD5

                    16ef8177433976c14d23f839a8c1152a

                    SHA1

                    2b653ca841498be9292cbbc8b5119504e225f56d

                    SHA256

                    2a30dc50f2e6e73b059d7419b34924114bffcfa8d99f7703bfbdd4f9e5da8855

                    SHA512

                    9cccf0eb97b898988e5da63584e195528dd3a0f34d0608844a33c6ac5928d83c8159151a7a15d5382a10114b819cb72d8c5840d254d9ac1023ad6ac22ac4833e

                  • C:\Users\Admin\AppData\Local\Temp\¿ì½Ý·¢ÑÔ·½°¸.txt

                    Filesize

                    189B

                    MD5

                    322f59ce015ff2f1f00ecbe4fdfce380

                    SHA1

                    eb4756a5bb023f6d1feacdbeac6e94013e15d5b0

                    SHA256

                    c96ef901d8f23cb7626ef980c4cf5bece7aafeef9b2b8b28829d3a11a51562c1

                    SHA512

                    2610ce1c0a55da67faa9ddaca26529a87bf5ebc6706621682d54024fa887ca9cd54cdc5b854f8b79ea99b02a5277d6931f633fa876107d9ec1bf503bee23a02c

                  • C:\Users\Admin\AppData\Local\Temp\ÉèÖÃ.ini

                    Filesize

                    103B

                    MD5

                    62417cec773969a0ad264d73e8c06dd5

                    SHA1

                    aaa287afa9bd45430a7708a67fdbca8984a55d92

                    SHA256

                    b0600c7ab1c9a6c937713e8f71d712a1f6f9d6991a6078f1a36f420a3f07846b

                    SHA512

                    a3788224ab0b1f3adb664820f0d6cb2cf2e38d5b0d09ed8678774b712a569e33d24bf1039edd941fa16ee765e36d348808cfd7b96a5f89b9d9756a481903a161

                  • C:\Users\Admin\AppData\Local\Temp\ÉèÖÃ.ini

                    Filesize

                    246B

                    MD5

                    b06ddcfdb64cc28ca0a0ef609de5f05f

                    SHA1

                    bd95d141935795e249d2ab00824839fd42c8f505

                    SHA256

                    da0a5d79dc6a120811b556885b704f9fd158b1f19dd5a9c595719feb56065f00

                    SHA512

                    a1dd3cc527ce6a6c4b0ea2c369d4370f6f1bf332c9255e1a8eebfd5986c133dacc2e6c6a55071e5bcf4724f37ff2920f2e17567ca32571e664b458e526be72b5

                  • C:\Users\Admin\AppData\Local\Temp\ÉèÖÃ.ini

                    Filesize

                    260B

                    MD5

                    924bf7a4ce305dad87743ba3c5773aa9

                    SHA1

                    12d0fddb472394b23e5176ab4ede38974e723b81

                    SHA256

                    01faf5e88442653bf38adc145d517f44d3495398e0aa666c7486b7030c126cbd

                    SHA512

                    2380c957717d3bc97ae2de96aba9cd3b50a1774eb96dc47840add1b12ee13485ee6cc6c4d30953b8f42d32ae3b02657966229fcbe58a60843df0cbd6170eb44e

                  • memory/4972-16-0x0000000010000000-0x000000001003E000-memory.dmp

                    Filesize

                    248KB

                  • memory/4972-6-0x0000000010000000-0x000000001003E000-memory.dmp

                    Filesize

                    248KB

                  • memory/4972-45-0x0000000010000000-0x000000001003E000-memory.dmp

                    Filesize

                    248KB

                  • memory/4972-43-0x0000000010000000-0x000000001003E000-memory.dmp

                    Filesize

                    248KB

                  • memory/4972-41-0x0000000010000000-0x000000001003E000-memory.dmp

                    Filesize

                    248KB

                  • memory/4972-39-0x0000000010000000-0x000000001003E000-memory.dmp

                    Filesize

                    248KB

                  • memory/4972-33-0x0000000010000000-0x000000001003E000-memory.dmp

                    Filesize

                    248KB

                  • memory/4972-31-0x0000000010000000-0x000000001003E000-memory.dmp

                    Filesize

                    248KB

                  • memory/4972-29-0x0000000010000000-0x000000001003E000-memory.dmp

                    Filesize

                    248KB

                  • memory/4972-27-0x0000000010000000-0x000000001003E000-memory.dmp

                    Filesize

                    248KB

                  • memory/4972-23-0x0000000010000000-0x000000001003E000-memory.dmp

                    Filesize

                    248KB

                  • memory/4972-25-0x0000000010000000-0x000000001003E000-memory.dmp

                    Filesize

                    248KB

                  • memory/4972-18-0x0000000010000000-0x000000001003E000-memory.dmp

                    Filesize

                    248KB

                  • memory/4972-0-0x0000000001150000-0x000000000115B000-memory.dmp

                    Filesize

                    44KB

                  • memory/4972-14-0x0000000010000000-0x000000001003E000-memory.dmp

                    Filesize

                    248KB

                  • memory/4972-12-0x0000000010000000-0x000000001003E000-memory.dmp

                    Filesize

                    248KB

                  • memory/4972-10-0x0000000010000000-0x000000001003E000-memory.dmp

                    Filesize

                    248KB

                  • memory/4972-46-0x0000000010000000-0x000000001003E000-memory.dmp

                    Filesize

                    248KB

                  • memory/4972-4-0x0000000010000000-0x000000001003E000-memory.dmp

                    Filesize

                    248KB

                  • memory/4972-3-0x0000000010000000-0x000000001003E000-memory.dmp

                    Filesize

                    248KB

                  • memory/4972-2-0x0000000010000000-0x000000001003E000-memory.dmp

                    Filesize

                    248KB

                  • memory/4972-52-0x0000000002A30000-0x0000000002A31000-memory.dmp

                    Filesize

                    4KB

                  • memory/4972-55-0x0000000002A40000-0x0000000002A41000-memory.dmp

                    Filesize

                    4KB

                  • memory/4972-54-0x0000000002A50000-0x0000000002A51000-memory.dmp

                    Filesize

                    4KB

                  • memory/4972-47-0x0000000010000000-0x000000001003E000-memory.dmp

                    Filesize

                    248KB

                  • memory/4972-100-0x0000000006240000-0x0000000006241000-memory.dmp

                    Filesize

                    4KB

                  • memory/4972-99-0x0000000006250000-0x0000000006251000-memory.dmp

                    Filesize

                    4KB

                  • memory/4972-48-0x0000000001180000-0x0000000001181000-memory.dmp

                    Filesize

                    4KB

                  • memory/4972-49-0x0000000001150000-0x000000000115B000-memory.dmp

                    Filesize

                    44KB

                  • memory/4972-37-0x0000000010000000-0x000000001003E000-memory.dmp

                    Filesize

                    248KB

                  • memory/4972-22-0x0000000010000000-0x000000001003E000-memory.dmp

                    Filesize

                    248KB

                  • memory/4972-8-0x0000000010000000-0x000000001003E000-memory.dmp

                    Filesize

                    248KB

                  • memory/4972-1-0x0000000000400000-0x0000000000A6D000-memory.dmp

                    Filesize

                    6.4MB