Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

11/08/2024, 15:05

240811-sgd6xsvcjl 8

11/08/2024, 15:01

240811-sd1kravbkm 8

Analysis

  • max time kernel
    140s
  • max time network
    133s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/08/2024, 15:05

General

  • Target

    HorrorRNGInst.exe

  • Size

    89KB

  • MD5

    958be1157871fd8c546e4992cf55713b

  • SHA1

    dcc2fc1dc846cfa87ec29e8fe5c92603e4a895aa

  • SHA256

    f67f239010aabb32ecb3fc0e578b1faf105072feee6e352f0b385e8d405038de

  • SHA512

    d046a68472108430ee5c8f69d5ed9c3474d2f09881f3c8f344b551b3899c44bbf63d6632783354f9370e4dbefb81a597fcd1fb9baf7c1d2487bbfdea132aaba6

  • SSDEEP

    1536:H7fbN3eEDhDPA/pICdUkbBtW7upvaLU0bI5taxKo0IOlnToIfCw6Op:b7DhdC6kzWypvaQ0FxyNTBfCa

Score
8/10

Malware Config

Signatures

  • Blocklisted process makes network request 1 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Delays execution with timeout.exe 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\HorrorRNGInst.exe
    "C:\Users\Admin\AppData\Local\Temp\HorrorRNGInst.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1200
    • C:\Windows\system32\cmd.exe
      "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\7F4D.tmp\7F4E.tmp\7F4F.bat C:\Users\Admin\AppData\Local\Temp\HorrorRNGInst.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1796
      • C:\Windows\system32\timeout.exe
        timeout /t 1 /nobreak
        3⤵
        • Delays execution with timeout.exe
        PID:2388
      • C:\Windows\system32\timeout.exe
        timeout /t 1 /nobreak
        3⤵
        • Delays execution with timeout.exe
        PID:5164
      • C:\Windows\system32\timeout.exe
        timeout /t 1 /nobreak
        3⤵
        • Delays execution with timeout.exe
        PID:4628
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -Command "Invoke-RestMethod -Uri 'https://api.ipgeolocation.io/ipgeo?apiKey=c6eb3eeb4cbd47a1b3394c2f842b8a1a' | Out-File -FilePath 'ip_info.txt'"
        3⤵
        • Blocklisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:5988
      • C:\Windows\system32\timeout.exe
        timeout /t 1 /nobreak
        3⤵
        • Delays execution with timeout.exe
        PID:1008
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4300,i,2904906934812054273,11716976550456127484,262144 --variations-seed-version --mojo-platform-channel-handle=1420 /prefetch:8
    1⤵
      PID:5196

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\7F4D.tmp\7F4E.tmp\7F4F.bat

      Filesize

      748B

      MD5

      aa21ff611de58cd776878ae721f9dba6

      SHA1

      e4d3e10fb81f2878c882bdec5ddfb0b2944670e8

      SHA256

      de947581c04fd3bb85d040e80f100114b0e3456f4f0024f097185e12343ff576

      SHA512

      5aff17cdecbaa2d12aacc14e712f75df5855620bf73a7accb523179118e978b5c7ba45d07d52f4ff6e4444371541f29be1fc0c2f8b67ce3a6dfeaef3380797eb

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bq4otfba.2yi.ps1

      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • memory/5988-2-0x00007FF9CC993000-0x00007FF9CC995000-memory.dmp

      Filesize

      8KB

    • memory/5988-3-0x000001BC254A0000-0x000001BC254C2000-memory.dmp

      Filesize

      136KB

    • memory/5988-13-0x00007FF9CC990000-0x00007FF9CD451000-memory.dmp

      Filesize

      10.8MB

    • memory/5988-14-0x00007FF9CC990000-0x00007FF9CD451000-memory.dmp

      Filesize

      10.8MB

    • memory/5988-15-0x000001BC26500000-0x000001BC266C2000-memory.dmp

      Filesize

      1.8MB

    • memory/5988-16-0x000001BC26C00000-0x000001BC27128000-memory.dmp

      Filesize

      5.2MB

    • memory/5988-20-0x00007FF9CC990000-0x00007FF9CD451000-memory.dmp

      Filesize

      10.8MB