Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

3

PqHR.exe

windows7-x64

8

PqHR.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    117s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    28/08/2024, 19:45

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    PqHR.exe

  • Size

    703KB

  • MD5

    7f0bde5df6ebbdceeda83413fc738320

  • SHA1

    0b56f2596dc7a7a98d0658fa713c390fc13e3b58

  • SHA256

    3220d05370089858afc641382a81dd7e36ee4ad2061addfaf9d70b966e20b718

  • SHA512

    65b54ebaeeb4738043de99d0b0426a734f1b5aef4b1060824f9483c61a68d71f3d7386e2673c8b6578f1decbd0d18ca31df3026101304b200e91770a2b3794d1

  • SSDEEP

    12288:6mdn4uUeOJon2ftsknVYzi9FCqW+mizBu0LbDcrnsCQYF9eNQvnoj/TY9VNh6T+6:6gTOJCciUPFCqTmiVt/crnbF9eKnM0V/

Score
8/10
discoveryexecution

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 11 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\PqHR.exe
    "C:\Users\Admin\AppData\Local\Temp\PqHR.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3000
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\PqHR.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2660
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\itoAKzfc.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2820
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\itoAKzfc" /XML "C:\Users\Admin\AppData\Local\Temp\tmp87A7.tmp"
      2⤵
      • System Location Discovery: System Language Discovery
      • Scheduled Task/Job: Scheduled Task
      PID:2716
    • C:\Users\Admin\AppData\Local\Temp\PqHR.exe
      "C:\Users\Admin\AppData\Local\Temp\PqHR.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:2628

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmp87A7.tmp
    Filesize

    1KB

    MD5

    191642f0ffa78d9a7bd859fc0d4715ab

    SHA1

    1e5c7318ef795ea5a282ce922767c05334edcf4a

    SHA256

    9be726645a035b07a023f4db5977642bbf8439d9da3c076dca144d1695b60aba

    SHA512

    49ecef5c0de30809c8eaea99aca7bceff83c34ec8c9b6d5e813902b70b43e8ac60c634c5ab6e20756071f3e3a3ea9461ac91c3c723648953a3e5c9e2c10ac7da

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
    Filesize

    7KB

    MD5

    adbbc63138a0f8cf09b1b6ad68ed9fe2

    SHA1

    659d6534599ef935c5d119718e3ec9f7793a455c

    SHA256

    4f1d27d17d4f022a3e009e88365193d5ee6a9766c3bc40f28d83472c3b40c310

    SHA512

    e55b21d580ce248a85486a5db6ccc4169a08b73133ff3dfb12af2ffcb606f1e2b4c69b0c78509496330de7fb34515712b9bc0da33ced042a9a77299367ae8519

    Download Submit

  • memory/2628-22-0x0000000000400000-0x0000000000447000-memory.dmp

    Filesize

    284KB

    Download

  • memory/2628-24-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2628-25-0x0000000000400000-0x0000000000447000-memory.dmp

    Filesize

    284KB

    Download

  • memory/2628-20-0x0000000000400000-0x0000000000447000-memory.dmp

    Filesize

    284KB

    Download

  • memory/3000-1-0x00000000013C0000-0x0000000001476000-memory.dmp

    Filesize

    728KB

    Download

  • memory/3000-7-0x00000000051B0000-0x000000000523E000-memory.dmp

    Filesize

    568KB

    Download

  • memory/3000-6-0x00000000743E0000-0x0000000074ACE000-memory.dmp

    Filesize

    6.9MB

    Download

  • memory/3000-5-0x00000000743EE000-0x00000000743EF000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3000-0-0x00000000743EE000-0x00000000743EF000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3000-4-0x0000000000420000-0x0000000000438000-memory.dmp

    Filesize

    96KB

    Download

  • memory/3000-2-0x00000000743E0000-0x0000000074ACE000-memory.dmp

    Filesize

    6.9MB

    Download

  • memory/3000-3-0x0000000004A60000-0x0000000004B14000-memory.dmp

    Filesize

    720KB

    Download

  • memory/3000-26-0x00000000743E0000-0x0000000074ACE000-memory.dmp

    Filesize

    6.9MB

    Download