Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

729dc7530d...c3.exe

windows7-x64

9

729dc7530d...c3.exe

windows10-2004-x64

Analysis

  • max time kernel
    15s
  • max time network
    18s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/08/2024, 03:26

Sharing

Copy URL
Twitter E-mail

Errors

Reason
Machine shutdown
Report Analysis Logs

General

  • Target

    729dc7530d64899b1b98e4029a0901c3.exe

  • Size

    56.5MB

  • MD5

    729dc7530d64899b1b98e4029a0901c3

  • SHA1

    a913ac448bc46b4d12a1e1fc1dbbb7215ddda29a

  • SHA256

    7c7956bf7741138d599fa191f5f7d6245e04c6695e4a7847407f666e2a641ffc

  • SHA512

    716c9b9dbd5f4c93efaf6de1deeaf17c497a10cca5d861e61e18f87a8e9af2bc42b0ea36f82d4e9b80766229ca9f2925f5912b194615ff8eb39ec1b3e76431bc

  • SSDEEP

    1572864:amKm5eNXA90p2N+iUgK1EEZBplhSwPTMSnhXQYoeQBPB:t5ec6C+imvrM0QYoeuZ

Score
10/10
evasionexecutionpersistencetrojan

Malware Config

Signatures

  • UAC bypass 3 TTPs 1 IoCs
    evasiontrojan
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
    evasion
  • Creates new service(s) 2 TTPs
    persistenceexecution
  • Drops file in Drivers directory 1 IoCs
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    evasiontrojan
  • Power Settings 1 TTPs 2 IoCs

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    persistence
  • Drops file in System32 directory 9 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Drops file in Windows directory 4 IoCs
  • Launches sc.exe 2 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry key 1 TTPs 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 38 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\729dc7530d64899b1b98e4029a0901c3.exe
    "C:\Users\Admin\AppData\Local\Temp\729dc7530d64899b1b98e4029a0901c3.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4860
    • C:\Users\Admin\AppData\Local\Temp\Loader.exe
      "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Drops file in Drivers directory
      • Checks BIOS information in registry
      • Checks computer location settings
      • Deletes itself
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Drops file in System32 directory
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Drops file in Windows directory
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4300
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /C Powercfg -h off
        3⤵
        • Power Settings
        • Suspicious use of WriteProcessMemory
        PID:2612
        • C:\Windows\system32\powercfg.exe
          Powercfg -h off
          4⤵
          • Power Settings
          • Suspicious use of AdjustPrivilegeToken
          PID:3172
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c powershell "Confirm-SecureBootUEFI" > C:\secureboot_status.txt
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:468
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell "Confirm-SecureBootUEFI"
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4308
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3316
        • C:\Windows\System32\reg.exe
          C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
          4⤵
          • UAC bypass
          • Modifies registry key
          PID:4928
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /C sc create windowsproc type=kernel binpath=C:\Windows\System32\drivers\winhb.sys
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3444
        • C:\Windows\system32\sc.exe
          sc create windowsproc type=kernel binpath=C:\Windows\System32\drivers\winhb.sys
          4⤵
          • Launches sc.exe
          PID:2292
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /C sc start windowsproc
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:216
        • C:\Windows\system32\sc.exe
          sc start windowsproc
          4⤵
          • Launches sc.exe
          PID:3224

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jialqydc.xwy.ps1
    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    Download Submit

  • C:\Windows\System32\config\RegBack\{69CD1F2D-DF68-4E23-9108-1B70783F2899}\favicon1.ico
    Filesize

    244KB

    MD5

    894384c5a192fe45e6d2e29b60a10a11

    SHA1

    56f43d42367b86e439bb640df007649386c5be91

    SHA256

    f0dcfacc6d28747a0ff8c3a9001fe4c7c4c387bd150a82895f8ea21ce201eec8

    SHA512

    95776900db01834bf0652cda1e96cb108c062cf5a71d9d6423b8f601fb116620293738e7ed31dff9886612be099683a9ee1078d5d0c81ec457c629d54960cf14

    Download Submit

  • C:\secureboot_status.txt
    Filesize

    420B

    MD5

    de582b589ac295c03fcf52ca102a28c0

    SHA1

    10cc2b1adb41e11abb33383ab102ff204379afa4

    SHA256

    86aea26372f98f717f138713881a44bdb3b9ac666f70328398ceea2ae15d3c1f

    SHA512

    af023664d90c322d6d2c4cd2988e6a5eb23e4506bec588b9247a4e9f11baf0f21c9941e6dde5e3440719ceb2d2c154c6f853d5082a0f2b7c22c8a50fed0cc81d

    Download Submit

  • memory/4308-22-0x0000019FA0890000-0x0000019FA08B2000-memory.dmp

    Filesize

    136KB

    Download

  • memory/4860-0-0x0000000140000000-0x0000000141000000-memory.dmp

    Filesize

    16.0MB

    Download

  • memory/4860-15-0x0000000140000000-0x0000000141000000-memory.dmp

    Filesize

    16.0MB

    Download