Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-fr -
resource tags
arch:x64arch:x86image:win10v2004-20240802-frlocale:fr-fros:windows10-2004-x64systemwindows -
submitted
11/08/2024, 08:42
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://github.com/pankoza2-pl/Ethylenediaminetetraacetate.exe-Malware
Resource
win10v2004-20240802-fr
11 signatures
150 seconds
General
-
Target
https://github.com/pankoza2-pl/Ethylenediaminetetraacetate.exe-Malware
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/5196-0-0x00007FF6D8540000-0x00007FF6D86AD000-memory.dmp upx behavioral1/memory/5196-1-0x00007FF6D8540000-0x00007FF6D86AD000-memory.dmp upx -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 8 IoCs
flow ioc 133 raw.githubusercontent.com 134 raw.githubusercontent.com 135 raw.githubusercontent.com 137 raw.githubusercontent.com 127 raw.githubusercontent.com 128 raw.githubusercontent.com 129 raw.githubusercontent.com 132 raw.githubusercontent.com -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 Ethylenediaminetetraacetatex64.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings Ethylenediaminetetraacetatex64.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 4512 vlc.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4512 vlc.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 5196 Ethylenediaminetetraacetatex64.exe Token: 33 5468 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 5468 AUDIODG.EXE Token: 33 4512 vlc.exe Token: SeIncBasePriorityPrivilege 4512 vlc.exe -
Suspicious use of FindShellTrayWindow 14 IoCs
pid Process 4512 vlc.exe 4512 vlc.exe 4512 vlc.exe 4512 vlc.exe 4512 vlc.exe 4512 vlc.exe 4512 vlc.exe 4512 vlc.exe 4512 vlc.exe 4512 vlc.exe 4512 vlc.exe 4512 vlc.exe 4512 vlc.exe 4512 vlc.exe -
Suspicious use of SendNotifyMessage 7 IoCs
pid Process 4512 vlc.exe 4512 vlc.exe 4512 vlc.exe 4512 vlc.exe 4512 vlc.exe 4512 vlc.exe 4512 vlc.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4512 vlc.exe 4512 vlc.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 5196 wrote to memory of 4512 5196 Ethylenediaminetetraacetatex64.exe 133 PID 5196 wrote to memory of 4512 5196 Ethylenediaminetetraacetatex64.exe 133
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/pankoza2-pl/Ethylenediaminetetraacetate.exe-Malware1⤵PID:1748
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --field-trial-handle=3932,i,8457343488571993338,13289450751020348124,262144 --variations-seed-version --mojo-platform-channel-handle=4064 /prefetch:11⤵PID:1244
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --field-trial-handle=3968,i,8457343488571993338,13289450751020348124,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:11⤵PID:1956
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --field-trial-handle=5412,i,8457343488571993338,13289450751020348124,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:11⤵PID:2684
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=fr --service-sandbox-type=asset_store_service --field-trial-handle=5576,i,8457343488571993338,13289450751020348124,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:81⤵PID:1092
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=fr --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --field-trial-handle=5612,i,8457343488571993338,13289450751020348124,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:81⤵PID:3156
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --field-trial-handle=5964,i,8457343488571993338,13289450751020348124,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:11⤵PID:3268
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=fr --service-sandbox-type=service --field-trial-handle=5976,i,8457343488571993338,13289450751020348124,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:81⤵PID:3220
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=fr --service-sandbox-type=collections --field-trial-handle=6688,i,8457343488571993338,13289450751020348124,262144 --variations-seed-version --mojo-platform-channel-handle=6708 /prefetch:81⤵PID:2256
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --field-trial-handle=6672,i,8457343488571993338,13289450751020348124,262144 --variations-seed-version --mojo-platform-channel-handle=6748 /prefetch:11⤵PID:2740
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --lang=fr --service-sandbox-type=service --field-trial-handle=7004,i,8457343488571993338,13289450751020348124,262144 --variations-seed-version --mojo-platform-channel-handle=7024 /prefetch:81⤵PID:3220
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=fr --service-sandbox-type=none --field-trial-handle=7292,i,8457343488571993338,13289450751020348124,262144 --variations-seed-version --mojo-platform-channel-handle=7396 /prefetch:81⤵PID:4060
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:3632
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=fr --service-sandbox-type=search_indexer --message-loop-type-ui --field-trial-handle=5924,i,8457343488571993338,13289450751020348124,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:81⤵PID:4488
-
C:\Users\Admin\Downloads\Ethylenediaminetetraacetate.exe\Ethylenediaminetetraacetatex64.exe"C:\Users\Admin\Downloads\Ethylenediaminetetraacetate.exe\Ethylenediaminetetraacetatex64.exe"1⤵
- Writes to the Master Boot Record (MBR)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5196 -
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Ethylenediaminetetraacetate\horse.wmv"2⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4512
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x418 0x4e81⤵
- Suspicious use of AdjustPrivilegeToken
PID:5468
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
763KB
MD58156051564f566676e3e020ae38d86ac
SHA1d664d3358bc6fb1d8356048da95d50bf64e3084c
SHA25692c577b50f523fcfe5ffdebba8d46fc20c42caa96d1c35a43f75ac00d2cb6d1a
SHA5128c19ff4a8ccc39a5480fa91e4ee2c07d59985be7180cd237876dd10570e10416253e2c5f5245fadf1d8606e3340d74d20c68849a0b47aaf71c1dab395770abc6