Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/07/2024, 02:18

General

  • Target

    b4041377281a95568381363ec6c3826d11948d1449bda36d6a0d6bb50e8c9a74.exe

  • Size

    1.4MB

  • MD5

    f2af0cf68dfd2a651cc66ad92ea4524a

  • SHA1

    95ccb921e2f012b426ee89b1901b28ef661d93eb

  • SHA256

    b4041377281a95568381363ec6c3826d11948d1449bda36d6a0d6bb50e8c9a74

  • SHA512

    4cade9d6e64030d5bfb1dffe451efbba70c8c1a7d77b945fdd364870773504c634efc3a662b1ae2b2ceb1c39939a47efbb545ba65a1c634330df181119fac198

  • SSDEEP

    24576:T9cdOqX1uuMliQzd4mNy9Sh5hJgpiwVQLJaOSZ4LehoZza9gNWmAO5ehlM+:T9UX1uBx4mYo83vOSeyeaKrE

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 8 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Executes dropped EXE 4 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 36 IoCs
  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of SetWindowsHookEx 17 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b4041377281a95568381363ec6c3826d11948d1449bda36d6a0d6bb50e8c9a74.exe
    "C:\Users\Admin\AppData\Local\Temp\b4041377281a95568381363ec6c3826d11948d1449bda36d6a0d6bb50e8c9a74.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2972
    • \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visiblity of hidden/system files in Explorer
      • Boot or Logon Autostart Execution: Active Setup
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4024
      • \??\c:\windows\system\spoolsv.exe
        c:\windows\system\spoolsv.exe SE
        3⤵
        • Executes dropped EXE
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4624
        • \??\c:\windows\system\svchost.exe
          c:\windows\system\svchost.exe
          4⤵
          • Modifies WinLogon for persistence
          • Modifies visiblity of hidden/system files in Explorer
          • Boot or Logon Autostart Execution: Active Setup
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1684
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe PR
            5⤵
            • Executes dropped EXE
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:1080
          • C:\Windows\SysWOW64\at.exe
            at 02:21 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
            5⤵
            • System Location Discovery: System Language Discovery
            PID:1872
          • C:\Windows\SysWOW64\at.exe
            at 02:22 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
            5⤵
            • System Location Discovery: System Language Discovery
            PID:2304
          • C:\Windows\SysWOW64\at.exe
            at 02:23 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
            5⤵
            • System Location Discovery: System Language Discovery
            PID:3504

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\mrsys.exe

    Filesize

    1.4MB

    MD5

    f238b82aa092bb0f353c23234515092b

    SHA1

    0294931f380669353c7af3b6385a82be9e4cb321

    SHA256

    80229ba49bddc9392880d925d6428c5eaf5c4fd3d296d9674d96c7651b95ac59

    SHA512

    b686bad6751f13b53d4ab70b63891a087b5d76d80d4eed9298e7dc13beb8d290ece83023d9a1a65479d592318ec3fb4924bd1e572379b293c63f04ca3af61a4f

  • C:\Windows\System\explorer.exe

    Filesize

    1.4MB

    MD5

    77e003785e8e4745af380880aa10fcd5

    SHA1

    1edc9d29f296b58fbed042ac59f67d65a1b643e3

    SHA256

    02e5ee986a18d224d3cefa93573c67154d4ab91570adfc721b4efed57d505b4b

    SHA512

    2843b6a1d825a5d3f4c5b496f213421b62cd67069600772b7812409c2f299e6f37db8ee036352ac210a611f8e8a55dfe72ebfc8b98a8d94854a775a61b1c2acb

  • C:\Windows\System\spoolsv.exe

    Filesize

    1.4MB

    MD5

    fb86ca49d2003753b28e30ff7635e79f

    SHA1

    714b7380a6cddca58d26c763795a1638faef3ebc

    SHA256

    8b579f66d2214a0f2072456793885f7a2177f9330326b3469bd5d852a7d5fde4

    SHA512

    0fb7181648c112b8e230b74592a85c2bedfb268e1f69e057e71aa8f2f0c9e7feac514be7ebb5035c21547525a16df612aeffda2c939ee7db76a94d3643a41997

  • C:\Windows\System\svchost.exe

    Filesize

    1.4MB

    MD5

    aa8aa97a1f076c4fe8f11fd39809c0e5

    SHA1

    bdaf4939b1cd42c3e1e9342059b4bb1113111d49

    SHA256

    478aebc3b17c6a2ab1aafcf8d252b686c361fea3680a22913456b50c74c04b5c

    SHA512

    6ce3d1e7903c2652914a7aab95db1e045890298672d8d0256a3b0caa07c07d7a989e9fec34d61a217c7e3f5c37633734338846e8fa34c3d999adb99cce47e7f3

  • memory/1080-40-0x0000000000400000-0x00000000009A0000-memory.dmp

    Filesize

    5.6MB

  • memory/1080-33-0x0000000000400000-0x00000000009A0000-memory.dmp

    Filesize

    5.6MB

  • memory/1684-69-0x0000000000400000-0x00000000009A0000-memory.dmp

    Filesize

    5.6MB

  • memory/1684-59-0x0000000000400000-0x00000000009A0000-memory.dmp

    Filesize

    5.6MB

  • memory/1684-30-0x0000000000400000-0x00000000009A0000-memory.dmp

    Filesize

    5.6MB

  • memory/1684-53-0x0000000000400000-0x00000000009A0000-memory.dmp

    Filesize

    5.6MB

  • memory/1684-47-0x0000000000400000-0x00000000009A0000-memory.dmp

    Filesize

    5.6MB

  • memory/2972-44-0x0000000000400000-0x00000000009A0000-memory.dmp

    Filesize

    5.6MB

  • memory/2972-2-0x0000000077723000-0x0000000077724000-memory.dmp

    Filesize

    4KB

  • memory/2972-0-0x0000000000400000-0x00000000009A0000-memory.dmp

    Filesize

    5.6MB

  • memory/2972-1-0x0000000077722000-0x0000000077723000-memory.dmp

    Filesize

    4KB

  • memory/4024-46-0x0000000000400000-0x00000000009A0000-memory.dmp

    Filesize

    5.6MB

  • memory/4024-11-0x0000000000400000-0x00000000009A0000-memory.dmp

    Filesize

    5.6MB

  • memory/4024-54-0x0000000000400000-0x00000000009A0000-memory.dmp

    Filesize

    5.6MB

  • memory/4024-56-0x0000000000400000-0x00000000009A0000-memory.dmp

    Filesize

    5.6MB

  • memory/4024-60-0x0000000000400000-0x00000000009A0000-memory.dmp

    Filesize

    5.6MB

  • memory/4024-64-0x0000000000400000-0x00000000009A0000-memory.dmp

    Filesize

    5.6MB

  • memory/4024-68-0x0000000000400000-0x00000000009A0000-memory.dmp

    Filesize

    5.6MB

  • memory/4024-70-0x0000000000400000-0x00000000009A0000-memory.dmp

    Filesize

    5.6MB

  • memory/4624-43-0x0000000000400000-0x00000000009A0000-memory.dmp

    Filesize

    5.6MB