Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    130s
  • max time network
    160s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/08/2024, 20:54

General

  • Target

    HMC.exe

  • Size

    2.6MB

  • MD5

    0bd541037d1794d63bb58654f1e897c5

  • SHA1

    a901fc2bc1fcc672b6dfee0d3e93b4ca8f11c710

  • SHA256

    2e8931e43c5674bc641651868ef311e2d3407e0132325c0795bdf4f5404fb30f

  • SHA512

    85412b5357e65ceebdd1f460e4764e3b5b11c242250500f9f55fdbaa0d2c6aa15cf0f68f7e1d88369a013a2d16c95e235db68dd48590e306de59cf01fb7128c9

  • SSDEEP

    24576:rVsQ6BKfC+CWDU2fy6Uuri8MmOmbCYUz7PH8Zeaj0HM3ow5Xt:rVeBB2kMOnYUvPb

Score
6/10

Malware Config

Signatures

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\HMC.exe
    "C:\Users\Admin\AppData\Local\Temp\HMC.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1220
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/z5vMmkQ8pj
      2⤵
        PID:1480
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --field-trial-handle=4576,i,4174666705242427184,7333705955694532165,262144 --variations-seed-version --mojo-platform-channel-handle=4060 /prefetch:1
      1⤵
        PID:3964
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --field-trial-handle=4672,i,4174666705242427184,7333705955694532165,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:1
        1⤵
          PID:1800
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --field-trial-handle=5580,i,4174666705242427184,7333705955694532165,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:8
          1⤵
            PID:2528
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --field-trial-handle=5848,i,4174666705242427184,7333705955694532165,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:1
            1⤵
              PID:3216
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --field-trial-handle=5348,i,4174666705242427184,7333705955694532165,262144 --variations-seed-version --mojo-platform-channel-handle=2556 /prefetch:8
              1⤵
                PID:2908
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --field-trial-handle=5376,i,4174666705242427184,7333705955694532165,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:8
                1⤵
                • Modifies registry class
                PID:3828
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --field-trial-handle=6352,i,4174666705242427184,7333705955694532165,262144 --variations-seed-version --mojo-platform-channel-handle=6468 /prefetch:8
                1⤵
                  PID:3772
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --field-trial-handle=5628,i,4174666705242427184,7333705955694532165,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:8
                  1⤵
                    PID:1180
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4968,i,4174666705242427184,7333705955694532165,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:8
                    1⤵
                      PID:3496

                    Network

                    MITRE ATT&CK Enterprise v15

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • memory/1220-1-0x00000177CFC70000-0x00000177CFF14000-memory.dmp

                      Filesize

                      2.6MB

                    • memory/1220-0-0x00007FF967163000-0x00007FF967165000-memory.dmp

                      Filesize

                      8KB

                    • memory/1220-2-0x00000177EBD70000-0x00000177EBF2C000-memory.dmp

                      Filesize

                      1.7MB

                    • memory/1220-3-0x00007FF967160000-0x00007FF967C21000-memory.dmp

                      Filesize

                      10.8MB

                    • memory/1220-5-0x00000177EC0F0000-0x00000177EC1AA000-memory.dmp

                      Filesize

                      744KB

                    • memory/1220-6-0x00007FF967160000-0x00007FF967C21000-memory.dmp

                      Filesize

                      10.8MB

                    • memory/1220-8-0x00007FF967160000-0x00007FF967C21000-memory.dmp

                      Filesize

                      10.8MB

                    • memory/1220-7-0x00000177EF760000-0x00000177EF768000-memory.dmp

                      Filesize

                      32KB

                    • memory/1220-9-0x00007FF967160000-0x00007FF967C21000-memory.dmp

                      Filesize

                      10.8MB

                    • memory/1220-10-0x00000177EF7F0000-0x00000177EF828000-memory.dmp

                      Filesize

                      224KB

                    • memory/1220-11-0x00000177EF7B0000-0x00000177EF7BE000-memory.dmp

                      Filesize

                      56KB

                    • memory/1220-12-0x00007FF967163000-0x00007FF967165000-memory.dmp

                      Filesize

                      8KB

                    • memory/1220-13-0x00007FF967160000-0x00007FF967C21000-memory.dmp

                      Filesize

                      10.8MB

                    • memory/1220-14-0x00007FF967160000-0x00007FF967C21000-memory.dmp

                      Filesize

                      10.8MB

                    • memory/1220-15-0x00007FF967160000-0x00007FF967C21000-memory.dmp

                      Filesize

                      10.8MB

                    • memory/1220-16-0x00007FF967160000-0x00007FF967C21000-memory.dmp

                      Filesize

                      10.8MB

                    • memory/1220-17-0x00007FF967160000-0x00007FF967C21000-memory.dmp

                      Filesize

                      10.8MB