Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    136s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/08/2024, 05:57

General

  • Target

    d4b1b804fa6cc4a9d7cfb8da478dc71e09b64749fafd4158d82e3220cafecc82.exe

  • Size

    15.8MB

  • MD5

    0c671833a8f3f562d8c64e2b04d590f0

  • SHA1

    144b519e73f92907c1f698fca2cd9f3d033ed508

  • SHA256

    d4b1b804fa6cc4a9d7cfb8da478dc71e09b64749fafd4158d82e3220cafecc82

  • SHA512

    9f0a98ab98e806b870f86afac08514e06015ed171d19ea863155ecf28a0db0ea9ee0108d943ceb087c1d2fe8a11679b46734e5bdae87266b55501ebc293dfb0c

  • SSDEEP

    196608:ZnvF0e9FIjy3ZUQrXCl8YSPay/S8yb3hN3ahA3SLphB4rk1AIGvp5Ey/:ZndauZrXCl8NPay3yVELmrXp5

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • VMProtect packed file 5 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d4b1b804fa6cc4a9d7cfb8da478dc71e09b64749fafd4158d82e3220cafecc82.exe
    "C:\Users\Admin\AppData\Local\Temp\d4b1b804fa6cc4a9d7cfb8da478dc71e09b64749fafd4158d82e3220cafecc82.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:4196
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=1040,i,3210801877307184477,8078594481454001567,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:8
    1⤵
      PID:4852

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Windows\HPSocket4C.dll

      Filesize

      2.1MB

      MD5

      110d24f5f45e93a20d7528a18bd563f5

      SHA1

      b230dc7a455df6c2f07af1bda2c2059e4bc39b10

      SHA256

      6909730b2380d582c7df285e754d27aa6960be61cf98558900d327da0df46ac0

      SHA512

      b427e448fd1d59830c7f6297136eb3aaae3e3745846e08cfa11272436df44268e567e734dc6e7e5c0962616657c6a6a020156592f9f182d4be272d81543fa66f

    • memory/4196-7-0x0000000002DB0000-0x0000000002DB1000-memory.dmp

      Filesize

      4KB

    • memory/4196-14-0x0000000000400000-0x000000000266D000-memory.dmp

      Filesize

      34.4MB

    • memory/4196-8-0x0000000004570000-0x0000000004571000-memory.dmp

      Filesize

      4KB

    • memory/4196-0-0x0000000001142000-0x00000000016A5000-memory.dmp

      Filesize

      5.4MB

    • memory/4196-6-0x0000000002DA0000-0x0000000002DA1000-memory.dmp

      Filesize

      4KB

    • memory/4196-5-0x0000000002D90000-0x0000000002D91000-memory.dmp

      Filesize

      4KB

    • memory/4196-2-0x0000000002D40000-0x0000000002D41000-memory.dmp

      Filesize

      4KB

    • memory/4196-12-0x0000000000400000-0x000000000266D000-memory.dmp

      Filesize

      34.4MB

    • memory/4196-4-0x0000000002D80000-0x0000000002D81000-memory.dmp

      Filesize

      4KB

    • memory/4196-9-0x0000000000400000-0x000000000266D000-memory.dmp

      Filesize

      34.4MB

    • memory/4196-1-0x00000000027E0000-0x00000000027E1000-memory.dmp

      Filesize

      4KB

    • memory/4196-3-0x0000000002D50000-0x0000000002D51000-memory.dmp

      Filesize

      4KB

    • memory/4196-19-0x0000000001142000-0x00000000016A5000-memory.dmp

      Filesize

      5.4MB

    • memory/4196-20-0x0000000000400000-0x000000000266D000-memory.dmp

      Filesize

      34.4MB

    • memory/4196-21-0x0000000000400000-0x000000000266D000-memory.dmp

      Filesize

      34.4MB