Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    119s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/08/2024, 09:19

General

  • Target

    422cb26a147b61b4c0c35b605cfdeb70N.exe

  • Size

    211KB

  • MD5

    422cb26a147b61b4c0c35b605cfdeb70

  • SHA1

    c3e2bb8274bab51c49a90f997151d1678a8fe1c9

  • SHA256

    b9761fe14ffb685403f490608933c0a1d0756b31f21821f50f09d10b76cf161e

  • SHA512

    075cb8271428a4b58038102c50d67e2b286b24c5af6fa3b4997cb3c8448e17ba17d053aac382e602ace4555af6ae04d407c489b3f0cec065c959eab6626fbc57

  • SSDEEP

    6144:EmKVGe1XIpQiU/ma3MB8hH2Tkp6bYnWcZVol0N5TzQ3:+71YpQiU/RcO1VQInVob

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Modifies WinLogon 2 TTPs 1 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\422cb26a147b61b4c0c35b605cfdeb70N.exe
    "C:\Users\Admin\AppData\Local\Temp\422cb26a147b61b4c0c35b605cfdeb70N.exe"
    1⤵
    • Modifies WinLogon
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: RenamesItself
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2192
    • C:\Windows\apppatch\svchost.exe
      "C:\Windows\apppatch\svchost.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:912

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Low\IE\2F1FNRFI\login[1].htm

    Filesize

    168B

    MD5

    d57e3a550060f85d44a175139ea23021

    SHA1

    2c5cb3428a322c9709a34d04dd86fe7628f8f0a6

    SHA256

    43edf068d34276e8ade4113d4d7207de19fc98a2ae1c07298e593edae2a8774c

    SHA512

    0364fe6a010fce7a3f4a6344c84468c64b20fd131f3160fc649db78f1075ba52d8a1c4496e50dbe27c357e01ee52e94cdcda8f7927cba28d5f2f45b9da690063

  • C:\Windows\apppatch\svchost.exe

    Filesize

    211KB

    MD5

    2804450954f848a62870ba780cf35611

    SHA1

    55af05cc9e58cb2fd5bb8e6be066b3858b9399d0

    SHA256

    65ed7b766519a034022826331dd2cb138f5a38307146f76f530a030cf407c3fd

    SHA512

    a1d0f60d023a22685b18b57c203376a917c9b866028563cc59c36c55d35805121de508f4c4c792c069c5944e4f95e9ba208b5e060f21e3673095a8f1d8258396

  • memory/912-59-0x0000000002FA0000-0x0000000003057000-memory.dmp

    Filesize

    732KB

  • memory/912-56-0x0000000002FA0000-0x0000000003057000-memory.dmp

    Filesize

    732KB

  • memory/912-20-0x0000000002DB0000-0x0000000002E5A000-memory.dmp

    Filesize

    680KB

  • memory/912-17-0x0000000000400000-0x000000000049B000-memory.dmp

    Filesize

    620KB

  • memory/912-27-0x0000000002FA0000-0x0000000003057000-memory.dmp

    Filesize

    732KB

  • memory/912-33-0x0000000002FA0000-0x0000000003057000-memory.dmp

    Filesize

    732KB

  • memory/912-21-0x0000000000400000-0x000000000049B000-memory.dmp

    Filesize

    620KB

  • memory/912-22-0x0000000002FA0000-0x0000000003057000-memory.dmp

    Filesize

    732KB

  • memory/912-24-0x0000000002FA0000-0x0000000003057000-memory.dmp

    Filesize

    732KB

  • memory/912-26-0x0000000002FA0000-0x0000000003057000-memory.dmp

    Filesize

    732KB

  • memory/912-43-0x0000000002FA0000-0x0000000003057000-memory.dmp

    Filesize

    732KB

  • memory/912-45-0x0000000002FA0000-0x0000000003057000-memory.dmp

    Filesize

    732KB

  • memory/912-81-0x0000000002FA0000-0x0000000003057000-memory.dmp

    Filesize

    732KB

  • memory/912-80-0x0000000002FA0000-0x0000000003057000-memory.dmp

    Filesize

    732KB

  • memory/912-79-0x0000000002FA0000-0x0000000003057000-memory.dmp

    Filesize

    732KB

  • memory/912-78-0x0000000002FA0000-0x0000000003057000-memory.dmp

    Filesize

    732KB

  • memory/912-77-0x0000000002FA0000-0x0000000003057000-memory.dmp

    Filesize

    732KB

  • memory/912-76-0x0000000002FA0000-0x0000000003057000-memory.dmp

    Filesize

    732KB

  • memory/912-75-0x0000000002FA0000-0x0000000003057000-memory.dmp

    Filesize

    732KB

  • memory/912-74-0x0000000002FA0000-0x0000000003057000-memory.dmp

    Filesize

    732KB

  • memory/912-72-0x0000000002FA0000-0x0000000003057000-memory.dmp

    Filesize

    732KB

  • memory/912-71-0x0000000002FA0000-0x0000000003057000-memory.dmp

    Filesize

    732KB

  • memory/912-70-0x0000000002FA0000-0x0000000003057000-memory.dmp

    Filesize

    732KB

  • memory/912-69-0x0000000002FA0000-0x0000000003057000-memory.dmp

    Filesize

    732KB

  • memory/912-68-0x0000000002FA0000-0x0000000003057000-memory.dmp

    Filesize

    732KB

  • memory/912-67-0x0000000002FA0000-0x0000000003057000-memory.dmp

    Filesize

    732KB

  • memory/912-66-0x0000000002FA0000-0x0000000003057000-memory.dmp

    Filesize

    732KB

  • memory/912-65-0x0000000002FA0000-0x0000000003057000-memory.dmp

    Filesize

    732KB

  • memory/912-64-0x0000000002FA0000-0x0000000003057000-memory.dmp

    Filesize

    732KB

  • memory/912-62-0x0000000002FA0000-0x0000000003057000-memory.dmp

    Filesize

    732KB

  • memory/912-61-0x0000000002FA0000-0x0000000003057000-memory.dmp

    Filesize

    732KB

  • memory/912-60-0x0000000002FA0000-0x0000000003057000-memory.dmp

    Filesize

    732KB

  • memory/912-18-0x0000000000400000-0x000000000049B000-memory.dmp

    Filesize

    620KB

  • memory/912-55-0x0000000002FA0000-0x0000000003057000-memory.dmp

    Filesize

    732KB

  • memory/912-19-0x0000000000400000-0x000000000049B000-memory.dmp

    Filesize

    620KB

  • memory/912-57-0x0000000002FA0000-0x0000000003057000-memory.dmp

    Filesize

    732KB

  • memory/912-58-0x0000000002FA0000-0x0000000003057000-memory.dmp

    Filesize

    732KB

  • memory/912-54-0x0000000002FA0000-0x0000000003057000-memory.dmp

    Filesize

    732KB

  • memory/912-52-0x0000000002FA0000-0x0000000003057000-memory.dmp

    Filesize

    732KB

  • memory/912-51-0x0000000002FA0000-0x0000000003057000-memory.dmp

    Filesize

    732KB

  • memory/912-50-0x0000000002FA0000-0x0000000003057000-memory.dmp

    Filesize

    732KB

  • memory/912-49-0x0000000002FA0000-0x0000000003057000-memory.dmp

    Filesize

    732KB

  • memory/912-48-0x0000000002FA0000-0x0000000003057000-memory.dmp

    Filesize

    732KB

  • memory/912-47-0x0000000002FA0000-0x0000000003057000-memory.dmp

    Filesize

    732KB

  • memory/912-46-0x0000000002FA0000-0x0000000003057000-memory.dmp

    Filesize

    732KB

  • memory/912-44-0x0000000002FA0000-0x0000000003057000-memory.dmp

    Filesize

    732KB

  • memory/912-42-0x0000000002FA0000-0x0000000003057000-memory.dmp

    Filesize

    732KB

  • memory/912-41-0x0000000002FA0000-0x0000000003057000-memory.dmp

    Filesize

    732KB

  • memory/912-40-0x0000000002FA0000-0x0000000003057000-memory.dmp

    Filesize

    732KB

  • memory/912-39-0x0000000002FA0000-0x0000000003057000-memory.dmp

    Filesize

    732KB

  • memory/912-38-0x0000000002FA0000-0x0000000003057000-memory.dmp

    Filesize

    732KB

  • memory/912-37-0x0000000002FA0000-0x0000000003057000-memory.dmp

    Filesize

    732KB

  • memory/912-36-0x0000000002FA0000-0x0000000003057000-memory.dmp

    Filesize

    732KB

  • memory/912-35-0x0000000002FA0000-0x0000000003057000-memory.dmp

    Filesize

    732KB

  • memory/912-34-0x0000000002FA0000-0x0000000003057000-memory.dmp

    Filesize

    732KB

  • memory/912-32-0x0000000002FA0000-0x0000000003057000-memory.dmp

    Filesize

    732KB

  • memory/912-31-0x0000000002FA0000-0x0000000003057000-memory.dmp

    Filesize

    732KB

  • memory/912-30-0x0000000002FA0000-0x0000000003057000-memory.dmp

    Filesize

    732KB

  • memory/912-29-0x0000000002FA0000-0x0000000003057000-memory.dmp

    Filesize

    732KB

  • memory/912-28-0x0000000002FA0000-0x0000000003057000-memory.dmp

    Filesize

    732KB

  • memory/912-73-0x0000000002FA0000-0x0000000003057000-memory.dmp

    Filesize

    732KB

  • memory/912-63-0x0000000002FA0000-0x0000000003057000-memory.dmp

    Filesize

    732KB

  • memory/912-53-0x0000000002FA0000-0x0000000003057000-memory.dmp

    Filesize

    732KB

  • memory/2192-2-0x0000000000400000-0x000000000045F000-memory.dmp

    Filesize

    380KB

  • memory/2192-1-0x0000000002620000-0x0000000002672000-memory.dmp

    Filesize

    328KB

  • memory/2192-0-0x0000000000400000-0x000000000049B000-memory.dmp

    Filesize

    620KB

  • memory/2192-16-0x0000000000400000-0x000000000045F000-memory.dmp

    Filesize

    380KB

  • memory/2192-15-0x0000000002620000-0x0000000002672000-memory.dmp

    Filesize

    328KB

  • memory/2192-13-0x0000000000400000-0x000000000049B000-memory.dmp

    Filesize

    620KB