Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240704-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/07/2024, 14:01

General

  • Target

    17510883e112fb817eb60eda9bf9cd40N.exe

  • Size

    484KB

  • MD5

    17510883e112fb817eb60eda9bf9cd40

  • SHA1

    d2cb43908af542534dd5722e882a29867908bbf0

  • SHA256

    97f6000c5473c9a9c7499fc09faa85978c138326551b8b4bb512d3ea7241fda4

  • SHA512

    01a441ee2f8ce2653aaf98dae32cb7c8edc46f035591aef0795917fe9fdf2b01a71bcafad54d96e060685f97aba4caecb7af16c346856dc26e1943be3212002e

  • SSDEEP

    12288:kLPkCDt1EG2XVekhdeTi0TrAFQMTB6WP5sFVm2tV:kLPkQ1bqA603AOaB6WOVp

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in System32 directory 1 IoCs
  • Program crash 1 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of UnmapMainImage
    PID:3424
    • C:\Users\Admin\AppData\Local\Temp\17510883e112fb817eb60eda9bf9cd40N.exe
      "C:\Users\Admin\AppData\Local\Temp\17510883e112fb817eb60eda9bf9cd40N.exe"
      2⤵
      • Adds Run key to start application
      • Drops file in System32 directory
      • Suspicious use of WriteProcessMemory
      PID:3940
      • C:\Users\Admin\AppData\Roaming\RunLHost\edpnuirt.exe
        "C:\Users\Admin\AppData\Roaming\RunLHost"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1004
        • C:\Users\Admin\AppData\Local\Temp\~B508.tmp
          3424 496136 1004 1
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:1988
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3940 -s 620
        3⤵
        • Program crash
        PID:2600
  • C:\Windows\SysWOW64\ddodshta.exe
    C:\Windows\SysWOW64\ddodshta.exe -s
    1⤵
    • Executes dropped EXE
    • Suspicious behavior: EnumeratesProcesses
    PID:1472
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3940 -ip 3940
    1⤵
      PID:4608

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\~B508.tmp

      Filesize

      8KB

      MD5

      aac3165ece2959f39ff98334618d10d9

      SHA1

      020a191bfdc70c1fbd3bf74cd7479258bd197f51

      SHA256

      96fa6a7714670823c83099ea01d24d6d3ae8fef027f01a4ddac14f123b1c9974

      SHA512

      9eb876812a6a13dd4b090788c2b1d9e9a2e25370598ed5c040f82e6f378edc4b78d58bc8f60d5a559ea57b1edcf3a144bfe09454a9928997173db8279d5b40cf

    • C:\Users\Admin\AppData\Roaming\RunLHost\edpnuirt.exe

      Filesize

      484KB

      MD5

      2e6026e7ec826fed4667e455b3e54ae8

      SHA1

      da9688d63f22c03f9264f3b22e5e577529619546

      SHA256

      6f061c9c648f982597ebab0e0a87e166a6df1758b558cd6826d87c526e788183

      SHA512

      c31e26a91404a5154e0a72e12ef35ce81b96addc16c267ca4a958971c6824e6cf0ead5c4b13accecf186f4f9eb38e8e313b4b46c19c640ce7397df916146632a

    • memory/1004-14-0x0000000000770000-0x00000000007F3000-memory.dmp

      Filesize

      524KB

    • memory/1004-16-0x0000000000970000-0x0000000000976000-memory.dmp

      Filesize

      24KB

    • memory/1472-17-0x0000000001740000-0x0000000001746000-memory.dmp

      Filesize

      24KB

    • memory/1472-12-0x0000000001740000-0x0000000001746000-memory.dmp

      Filesize

      24KB

    • memory/1472-15-0x00000000013D0000-0x0000000001453000-memory.dmp

      Filesize

      524KB

    • memory/1472-19-0x0000000001C70000-0x0000000001C76000-memory.dmp

      Filesize

      24KB

    • memory/3424-28-0x0000000000EB0000-0x0000000000EB6000-memory.dmp

      Filesize

      24KB

    • memory/3424-18-0x0000000002DF0000-0x0000000002E79000-memory.dmp

      Filesize

      548KB

    • memory/3424-20-0x0000000002DF0000-0x0000000002E79000-memory.dmp

      Filesize

      548KB

    • memory/3424-25-0x0000000002DF0000-0x0000000002E79000-memory.dmp

      Filesize

      548KB

    • memory/3424-27-0x0000000002CC0000-0x0000000002CCD000-memory.dmp

      Filesize

      52KB

    • memory/3940-0-0x0000000000800000-0x0000000000883000-memory.dmp

      Filesize

      524KB

    • memory/3940-29-0x0000000000800000-0x0000000000883000-memory.dmp

      Filesize

      524KB