Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    140s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    10/07/2024, 22:25

General

  • Target

    KMSAutox64.exe

  • Size

    5.9MB

  • MD5

    6ecf39f068e587aa11ee61f307b0da00

  • SHA1

    d96ba5dcd69352161a907b5b627210ef980b174a

  • SHA256

    ae8c825fb003b5aa90f7964da496033f9d0516e6744e89a010118fc6930808cb

  • SHA512

    7fc55870553f26f925fbed061b73bf3c80359b82ee1ebae9885c73b9b32b6323664b92579494c8771fb1d37cef1249b8002528e07cf8b5e05370f180661c7cb0

  • SSDEEP

    98304:BosFtqvtr/lkqM6WDEilHbShaFmv/MamYhplDsAFV6qzpuy98tKHT/EimO3SAvOb:B3TqvLXhU+k+LFV68RHTOQbN6H62UwX

Score
7/10
upx

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Modifies system certificate store 2 TTPs 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 40 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\KMSAutox64.exe
    "C:\Users\Admin\AppData\Local\Temp\KMSAutox64.exe"
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:2068
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c copy C:\Windows\system32\Tasks\KMSAuto "C:\Users\Admin\AppData\Local\Temp\KMSAuto.tmp" /Y
      2⤵
        PID:2544
      • C:\Users\Admin\AppData\Local\Temp\signtool.exe
        "C:\Users\Admin\AppData\Local\Temp\signtool.exe" verify /v /ph /sha1 648384a4dee53d4c1c87e10d67cc99307ccc9c98 "C:\Users\Admin\AppData\Local\Temp\KMSAutox64.exe"
        2⤵
        • Executes dropped EXE
        • Modifies system certificate store
        PID:2376
      • C:\Windows\System32\Wbem\wmic.exe
        "wmic.exe" path Win32_NetworkAdapter get ServiceName /value /FORMAT:List
        2⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:3000

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      304B

      MD5

      b3ddc9f8bbe70669e7cef25092671f20

      SHA1

      13c37b9c6b974ec1bdd7a28ae5de08126845189a

      SHA256

      c13734415d8c0322f08b3145c93e3520eacd0c4b0d935180cccafbd8ec9ba986

      SHA512

      4c1d3ca991abfa066025242bfb9aa5c3e00a5f83055febfd9737edbaf0641a0c0a14808a460599988230a897fa65150cd6783d2093914cbe26b0b0554c172d24

    • C:\Users\Admin\AppData\Local\Temp\CabA43D.tmp

      Filesize

      70KB

      MD5

      49aebf8cbd62d92ac215b2923fb1b9f5

      SHA1

      1723be06719828dda65ad804298d0431f6aff976

      SHA256

      b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

      SHA512

      bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

    • C:\Users\Admin\AppData\Local\Temp\TarA633.tmp

      Filesize

      181KB

      MD5

      4ea6026cf93ec6338144661bf1202cd1

      SHA1

      a1dec9044f750ad887935a01430bf49322fbdcb7

      SHA256

      8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

      SHA512

      6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

    • C:\Users\Admin\AppData\Local\Temp\signtool.exe

      Filesize

      323KB

      MD5

      05624e6d27eaef0db0673ae627bd6027

      SHA1

      b155c76bf59992a8d75d0e3a59dc94f24aff2591

      SHA256

      962a92821f54a1e706aa989973130fdc1072c7bd8b9e6d11ea1050b46eb9d313

      SHA512

      233304669aefeec9ad5d19bd2dd5bb19ea35ce31da0b3aabe5ab859259608a58725fac5993637c9635e5912138d3eb477773351f0ee81cc3ce756d713163cf31

    • memory/2068-0-0x0000000140000000-0x0000000140730000-memory.dmp

      Filesize

      7.2MB

    • memory/2068-63-0x0000000140000000-0x0000000140730000-memory.dmp

      Filesize

      7.2MB

    • memory/2068-67-0x0000000140000000-0x0000000140730000-memory.dmp

      Filesize

      7.2MB