Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    74s
  • max time network
    78s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/07/2024, 19:35

General

  • Target

    Deushack.exe

  • Size

    974KB

  • MD5

    aa5c5e8b48622d3b6d80e94f54110e61

  • SHA1

    7c1e0adac8a1dfe992793108d59814cd0b6aac8d

  • SHA256

    8c7fd0a4bc551502bc5fde36c37617bbb4c6c6d1588e554f60de0ea281eae28d

  • SHA512

    f6df3b8fe36d3974601e5b60ffd6980db743ecf7b5a2eb6ed00ad304846d527d3fd0e9e9b548378605cefa899ef9a917984d904c7a94bb0ec6e99859ee20cf59

  • SSDEEP

    24576:TLc6V9iFn4GFME6gFBxVXuNqjBs3MBAj0TEjOF8/:TfycKVAqjBsMC

Malware Config

Signatures

  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 31 IoCs
  • Suspicious use of AdjustPrivilegeToken 25 IoCs
  • Suspicious use of FindShellTrayWindow 53 IoCs
  • Suspicious use of SendNotifyMessage 53 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Deushack.exe
    "C:\Users\Admin\AppData\Local\Temp\Deushack.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1164
    • C:\Users\Admin\AppData\Local\Temp\hoamfssd.lcw.exe
      "C:\Users\Admin\AppData\Local\Temp\hoamfssd.lcw.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:3716
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3052
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1164 -s 1756
      2⤵
      • Program crash
      PID:2212
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1164 -ip 1164
    1⤵
      PID:3032
    • C:\Windows\system32\taskmgr.exe
      "C:\Windows\system32\taskmgr.exe" /4
      1⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4480
    • C:\Windows\system32\taskmgr.exe
      "C:\Windows\system32\taskmgr.exe" /4
      1⤵
        PID:2736
      • C:\Windows\System32\rundll32.exe
        C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
        1⤵
          PID:1200
        • C:\Users\Admin\AppData\Local\Temp\Deushack.exe
          "C:\Users\Admin\AppData\Local\Temp\Deushack.exe"
          1⤵
          • Checks computer location settings
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1140
          • C:\Users\Admin\AppData\Local\Temp\er4vvd4o.gna.exe
            "C:\Users\Admin\AppData\Local\Temp\er4vvd4o.gna.exe"
            2⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:2660
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
              3⤵
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2416
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 1140 -s 1772
            2⤵
            • Program crash
            PID:4076
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1140 -ip 1140
          1⤵
            PID:3956
          • C:\Users\Admin\AppData\Local\Temp\er4vvd4o.gna.exe
            "C:\Users\Admin\AppData\Local\Temp\er4vvd4o.gna.exe"
            1⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:5088
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
              2⤵
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:1452

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.log

            Filesize

            2KB

            MD5

            60ad21e008a8447fc1130a9c9c155148

            SHA1

            5dfa21d14dc33de3cc93a463688fe1d640b01730

            SHA256

            bb65e24fd8681e7af464e115fba42ff7713e933683cbd654a124c0e564530bb9

            SHA512

            42a2753f717a4984967907fa69200e8a464068a6d4a226803cf9503ffb7fee540ffc611b4c905cc84f3623639a6aa93003b390f9c38e601b59f171a9e90bd9b6

          • C:\Users\Admin\AppData\Local\Temp\hoamfssd.lcw.exe

            Filesize

            574KB

            MD5

            dfce865a3bc516c59e31e794fa2ddaec

            SHA1

            0d60b4a07ec20277203425ad39415c652e16a80a

            SHA256

            44afe9f430fe26bcf070880af5ed7685d79eeee8dd84b6aa637a0211f3f855a7

            SHA512

            985ad4b2841ac605c53a98163c4a2005224f003fe6c4b5d853164c2896a79d7adcc6b4bb2d3c578c5bfc6cc3832308bccad741d5b78ae527e068f5f46e69f91c

          • memory/1164-0-0x0000000074FBE000-0x0000000074FBF000-memory.dmp

            Filesize

            4KB

          • memory/1164-1-0x00000000004B0000-0x000000000059A000-memory.dmp

            Filesize

            936KB

          • memory/1164-2-0x0000000007420000-0x000000000752A000-memory.dmp

            Filesize

            1.0MB

          • memory/1164-3-0x0000000074FB0000-0x0000000075760000-memory.dmp

            Filesize

            7.7MB

          • memory/1164-5-0x000000000B520000-0x000000000BAC4000-memory.dmp

            Filesize

            5.6MB

          • memory/1164-6-0x000000000B050000-0x000000000B0E2000-memory.dmp

            Filesize

            584KB

          • memory/1164-14-0x0000000074FB0000-0x0000000075760000-memory.dmp

            Filesize

            7.7MB

          • memory/3052-34-0x00000000081C0000-0x00000000081D2000-memory.dmp

            Filesize

            72KB

          • memory/3052-38-0x0000000009580000-0x00000000095F6000-memory.dmp

            Filesize

            472KB

          • memory/3052-18-0x0000000005560000-0x000000000556A000-memory.dmp

            Filesize

            40KB

          • memory/3052-15-0x0000000000400000-0x000000000045A000-memory.dmp

            Filesize

            360KB

          • memory/3052-43-0x0000000074C70000-0x0000000075420000-memory.dmp

            Filesize

            7.7MB

          • memory/3052-41-0x000000000AD50000-0x000000000B27C000-memory.dmp

            Filesize

            5.2MB

          • memory/3052-40-0x000000000A650000-0x000000000A812000-memory.dmp

            Filesize

            1.8MB

          • memory/3052-39-0x0000000007F80000-0x0000000007F9E000-memory.dmp

            Filesize

            120KB

          • memory/3052-17-0x0000000074C70000-0x0000000075420000-memory.dmp

            Filesize

            7.7MB

          • memory/3052-37-0x0000000008FA0000-0x0000000009006000-memory.dmp

            Filesize

            408KB

          • memory/3052-36-0x0000000008380000-0x00000000083CC000-memory.dmp

            Filesize

            304KB

          • memory/3052-35-0x0000000008220000-0x000000000825C000-memory.dmp

            Filesize

            240KB

          • memory/3052-16-0x0000000074C70000-0x0000000075420000-memory.dmp

            Filesize

            7.7MB

          • memory/3052-32-0x0000000008700000-0x0000000008D18000-memory.dmp

            Filesize

            6.1MB

          • memory/3052-33-0x0000000008270000-0x000000000837A000-memory.dmp

            Filesize

            1.0MB

          • memory/4480-27-0x000001AA23790000-0x000001AA23791000-memory.dmp

            Filesize

            4KB

          • memory/4480-28-0x000001AA23790000-0x000001AA23791000-memory.dmp

            Filesize

            4KB

          • memory/4480-29-0x000001AA23790000-0x000001AA23791000-memory.dmp

            Filesize

            4KB

          • memory/4480-30-0x000001AA23790000-0x000001AA23791000-memory.dmp

            Filesize

            4KB

          • memory/4480-31-0x000001AA23790000-0x000001AA23791000-memory.dmp

            Filesize

            4KB

          • memory/4480-25-0x000001AA23790000-0x000001AA23791000-memory.dmp

            Filesize

            4KB

          • memory/4480-26-0x000001AA23790000-0x000001AA23791000-memory.dmp

            Filesize

            4KB

          • memory/4480-21-0x000001AA23790000-0x000001AA23791000-memory.dmp

            Filesize

            4KB

          • memory/4480-20-0x000001AA23790000-0x000001AA23791000-memory.dmp

            Filesize

            4KB

          • memory/4480-19-0x000001AA23790000-0x000001AA23791000-memory.dmp

            Filesize

            4KB