Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/07/2024, 22:16

General

  • Target

    629be216e8fc635bf13be6b999c29b89c4827152397b7a0f300db8759f64724e.exe

  • Size

    126KB

  • MD5

    1a73de756775fa022c8c9251c4321f8e

  • SHA1

    7b0b30308e6aa293f932bdd960fa4d766a7ba89a

  • SHA256

    629be216e8fc635bf13be6b999c29b89c4827152397b7a0f300db8759f64724e

  • SHA512

    5552cf2565ec11c3416c735860665df75aeabaf4652c63d1ae9389b13197ca995a4cd7ebe654c9572be49f8a674e80900aca49f79b8bce07a0b4400e4e96891c

  • SSDEEP

    3072:jEboFVlGAvwsgbpvYfMTc72L10fPsout6S:gBzsgbpvnTcyOPsoS6S

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 4 IoCs
  • UPX packed file 33 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Program Files directory 23 IoCs
  • Drops file in Windows directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\629be216e8fc635bf13be6b999c29b89c4827152397b7a0f300db8759f64724e.exe
    "C:\Users\Admin\AppData\Local\Temp\629be216e8fc635bf13be6b999c29b89c4827152397b7a0f300db8759f64724e.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Suspicious use of SetThreadContext
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4604
    • C:\Windows\SysWOW64\svchost.exe
      C:\Windows\System32\svchost.exe -EMBEDDING 423B5D51736E6673606C2147686D64725D426E6C6C6E6F2147686D64725D4C6862736E726E6775215269607364655D4C52486F676E5D304530304230475D474A422F565840 0
      2⤵
      • Deletes itself
      • Loads dropped DLL
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      PID:3040
  • C:\Windows\system32\cmd.exe
    cmd.exe /c call "C:\Program Files\Common Files\Microsoft\1D11C1F\KVEIF.jpg" -3 423B5D51736E6673606C2147686D64725D426E6C6C6E6F2147686D64725D4C6862736E726E6775215269607364655D4C52486F676E5D304530304230475D474A422F565840
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2104
    • C:\Program Files\Common Files\Microsoft\1D11C1F\KVEIF.jpg
      "C:\Program Files\Common Files\Microsoft\1D11C1F\KVEIF.jpg" -3 423B5D51736E6673606C2147686D64725D426E6C6C6E6F2147686D64725D4C6862736E726E6775215269607364655D4C52486F676E5D304530304230475D474A422F565840
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1848
      • C:\Windows\SysWOW64\svchost.exe
        C:\Windows\System32\svchost.exe -sys 423B5D51736E6673606C2147686D64725D426E6C6C6E6F2147686D64725D4C6862736E726E6775215269607364655D4C52486F676E5D304530304230475D474A422F565840 0
        3⤵
          PID:2604
        • C:\Windows\SysWOW64\svchost.exe
          C:\Windows\System32\svchost.exe -sys 423B5D51736E6673606C2147686D64725D426E6C6C6E6F2147686D64725D4C6862736E726E6775215269607364655D4C52486F676E5D304530304230475D474A422F565840 0
          3⤵
            PID:2704
          • C:\Windows\SysWOW64\svchost.exe
            C:\Windows\System32\svchost.exe -sys 423B5D51736E6673606C2147686D64725D426E6C6C6E6F2147686D64725D4C6862736E726E6775215269607364655D4C52486F676E5D304530304230475D474A422F565840 0
            3⤵
              PID:1916
            • C:\Windows\SysWOW64\svchost.exe
              C:\Windows\System32\svchost.exe -sys 423B5D51736E6673606C2147686D64725D426E6C6C6E6F2147686D64725D4C6862736E726E6775215269607364655D4C52486F676E5D304530304230475D474A422F565840 0
              3⤵
              • Loads dropped DLL
              • Drops file in Program Files directory
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              PID:1180

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11C1F\1D11C1F123.IMD

          Filesize

          127KB

          MD5

          8fedf36c05618486ade86e49dfedc8ae

          SHA1

          9156f008389c012cc2f3bf14e277790c6092b95d

          SHA256

          b7a1ddb8d7f1d3d65d2663ee2758e1e1791c12c700bd2e86a4991d495f31e6ce

          SHA512

          32adbfe575433222c919c6fb79094377eca87026bc3a360eb8e512ad520f74a303ced69e8fe2f77758a10c496f2dab3f298f88693b2959548ff4b99a04c0d455

        • C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11C1F\KVEIF.jpg

          Filesize

          126KB

          MD5

          d824c6b6c569a1996edd5217c3ce9172

          SHA1

          afdfc36fc6c3063e53dc7e61f6325d23a88b88cf

          SHA256

          ac7552524d962bd62952378207250319f7874fe2e59781f7e5a00a0e79afc6bd

          SHA512

          76561e6e5cddcf327360529a4d6aa02b52a4d0e74fe20cd692f41bb00ca585ad67f7861a7f350368242179017633084ea2157a2e85f9e5fc0417cf024767c016

        • C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11C1F\KVEIFss1.ini

          Filesize

          22B

          MD5

          2056c975629bc764596c2ba68ab3c6da

          SHA1

          35e3da93ce68d24c687e8c972f8fa2b903be75b8

          SHA256

          8485a6ec9ad79a1ed2331a428944711c4064f0c607017dae51c7e7f65fe70ff7

          SHA512

          c4d4932e81956578e505ac454d964ccd1d7d123e8393d532db15ba42e456ceff8394baba021e8ae7ae2f9aef0e51840aecef12252cf9c6766e8b247eb08e86ae

        • C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11C1F\ok.txt

          Filesize

          104B

          MD5

          88e40d783f03a9e855d9d20eb269f6ad

          SHA1

          771c3e4a6355cfba3bb51a1af953b3273e9cf05f

          SHA256

          e1dcbd08aad543693a18973e233ad53a9f2eab2e15413d5110b64e0bed49a9bd

          SHA512

          480a9885d21fa7957ff89171965b6b7f35fd720d2d65aecb37d1a8eae1e21735867f7cebb867c8d7bad427c16f3cf15cbd1f6892c4bab0226919588849cf27b3

        • C:\Program Files\Common Files\Microsoft\1D11C1F\KVEIF.jpg

          Filesize

          126KB

          MD5

          cb5a025ca9bcc7d289dec6a53756685b

          SHA1

          93be712f39b1c3c3f9a6b4ddaa436945aa8e9b42

          SHA256

          005558761fb9332cce523017ac0fef0f38570af59888c16494e40e71a56eab92

          SHA512

          5eeb544523e19229b1704df06b37d45ec57e242ec9847c007e372c78c98600fc49d8127fb190c2fa39a94043f71f44fc96b4f8fe010096400ce11339a6650cd0

        • C:\Program Files\Common Files\microsoft shared\MSInfo\1D11C1F\KVEIFmain.ini

          Filesize

          1KB

          MD5

          b4fefb479801fa4550b3eedb4d75b805

          SHA1

          c616eee1f75f8de18dd992bbbbd9515399ac9ae9

          SHA256

          fcf908df5131f8903dfdedd57be4adc3142cf412a5a0d27d347c2116a4690ea8

          SHA512

          77ed6dde4e634a6fa61a268622fcd1b01f647ef7fe584102bfeddc804ef1adc62884f4ab0efa0d121918968bb5cf5f2359dac1cac0303f415177b5e3538a6672

        • C:\Windows\SysWOW64\kernel64.dll

          Filesize

          625KB

          MD5

          eccf28d7e5ccec24119b88edd160f8f4

          SHA1

          98509587a3d37a20b56b50fd57f823a1691a034c

          SHA256

          820c83c0533cfce2928e29edeaf6c255bc19ac9718b25a5656d99ffac30a03d6

          SHA512

          c1c94bbb781625b2317f0a8178d3a10d891fb71bca8f82cd831c484e8ab125301b82a14fe2ff070dc99a496cc00234300fa5536401018c40d49d44ae89409670

        • C:\Windows\Web\606C646364636479.tmp

          Filesize

          108KB

          MD5

          f697e0c5c1d34f00d1700d6d549d4811

          SHA1

          f50a99377a7419185fc269bb4d12954ca42b8589

          SHA256

          1eacebb614305a9806113545be7b23cf14ce7e761ccf634510a7f1c0cfb6cd16

          SHA512

          d5f35672f208ebbe306beeb55dadde96aa330780e2ea84b45d3fa6af41369e357412d82978df74038f2d27dff4d06905fd0b4d852b0beef1bcfdd6a0849bc202

        • memory/1180-240-0x0000000000400000-0x000000000042D000-memory.dmp

          Filesize

          180KB

        • memory/1180-199-0x0000000000400000-0x000000000042D000-memory.dmp

          Filesize

          180KB

        • memory/3040-114-0x0000000003200000-0x0000000003255000-memory.dmp

          Filesize

          340KB

        • memory/3040-108-0x0000000003200000-0x0000000003255000-memory.dmp

          Filesize

          340KB

        • memory/3040-236-0x0000000000400000-0x000000000042D000-memory.dmp

          Filesize

          180KB

        • memory/3040-193-0x00000000033B0000-0x00000000033B1000-memory.dmp

          Filesize

          4KB

        • memory/3040-103-0x0000000003200000-0x0000000003255000-memory.dmp

          Filesize

          340KB

        • memory/3040-104-0x0000000003200000-0x0000000003255000-memory.dmp

          Filesize

          340KB

        • memory/3040-106-0x0000000003200000-0x0000000003255000-memory.dmp

          Filesize

          340KB

        • memory/3040-110-0x0000000003200000-0x0000000003255000-memory.dmp

          Filesize

          340KB

        • memory/3040-116-0x0000000003200000-0x0000000003255000-memory.dmp

          Filesize

          340KB

        • memory/3040-118-0x0000000003200000-0x0000000003255000-memory.dmp

          Filesize

          340KB

        • memory/3040-120-0x0000000003200000-0x0000000003255000-memory.dmp

          Filesize

          340KB

        • memory/3040-96-0x0000000000400000-0x000000000042D000-memory.dmp

          Filesize

          180KB

        • memory/3040-99-0x0000000000400000-0x000000000042D000-memory.dmp

          Filesize

          180KB

        • memory/3040-100-0x0000000000400000-0x000000000042D000-memory.dmp

          Filesize

          180KB

        • memory/3040-101-0x0000000000400000-0x000000000042D000-memory.dmp

          Filesize

          180KB

        • memory/3040-112-0x0000000003200000-0x0000000003255000-memory.dmp

          Filesize

          340KB

        • memory/3040-130-0x0000000003200000-0x0000000003255000-memory.dmp

          Filesize

          340KB

        • memory/3040-122-0x0000000003200000-0x0000000003255000-memory.dmp

          Filesize

          340KB

        • memory/3040-124-0x0000000003200000-0x0000000003255000-memory.dmp

          Filesize

          340KB

        • memory/3040-128-0x0000000003200000-0x0000000003255000-memory.dmp

          Filesize

          340KB

        • memory/3040-126-0x0000000003200000-0x0000000003255000-memory.dmp

          Filesize

          340KB

        • memory/4604-19-0x00000000006D0000-0x0000000000725000-memory.dmp

          Filesize

          340KB

        • memory/4604-17-0x00000000006D0000-0x0000000000725000-memory.dmp

          Filesize

          340KB

        • memory/4604-21-0x00000000006D0000-0x0000000000725000-memory.dmp

          Filesize

          340KB

        • memory/4604-25-0x00000000006D0000-0x0000000000725000-memory.dmp

          Filesize

          340KB

        • memory/4604-29-0x00000000006D0000-0x0000000000725000-memory.dmp

          Filesize

          340KB

        • memory/4604-7-0x00000000006D0000-0x0000000000725000-memory.dmp

          Filesize

          340KB

        • memory/4604-15-0x00000000006D0000-0x0000000000725000-memory.dmp

          Filesize

          340KB

        • memory/4604-33-0x00000000006D0000-0x0000000000725000-memory.dmp

          Filesize

          340KB

        • memory/4604-24-0x00000000006D0000-0x0000000000725000-memory.dmp

          Filesize

          340KB

        • memory/4604-2-0x00000000006D0000-0x0000000000725000-memory.dmp

          Filesize

          340KB

        • memory/4604-27-0x00000000006D0000-0x0000000000725000-memory.dmp

          Filesize

          340KB

        • memory/4604-3-0x00000000006D0000-0x0000000000725000-memory.dmp

          Filesize

          340KB

        • memory/4604-9-0x00000000006D0000-0x0000000000725000-memory.dmp

          Filesize

          340KB

        • memory/4604-11-0x00000000006D0000-0x0000000000725000-memory.dmp

          Filesize

          340KB

        • memory/4604-31-0x00000000006D0000-0x0000000000725000-memory.dmp

          Filesize

          340KB

        • memory/4604-13-0x00000000006D0000-0x0000000000725000-memory.dmp

          Filesize

          340KB

        • memory/4604-32-0x00000000006D0000-0x0000000000725000-memory.dmp

          Filesize

          340KB

        • memory/4604-5-0x00000000006D0000-0x0000000000725000-memory.dmp

          Filesize

          340KB