Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    97s
  • max time network
    104s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/09/2024, 13:44

General

  • Target

    c72839924b296de9d93bf0d0f0b0ae90N.exe

  • Size

    68KB

  • MD5

    c72839924b296de9d93bf0d0f0b0ae90

  • SHA1

    4d89a886b6edd2d6d8cf0f3c9252d40fda5d4f11

  • SHA256

    79a0c053eb1b1ebbf36faf5a6464a3e20ad9dd36c317212a9ff7c4ae8de08224

  • SHA512

    ffab585da975174372dd537a03436b4a01abef81b1a16a5dbfc04383694859c05a75658e6cd61c734b1ad4751a744f645af5d21a76989dcdc9fc60886d23e003

  • SSDEEP

    1536:Htq94hUwA6CTC7ckEtCJTmHH5jXHdQ/JoUJsV44cpU:xS6CGAkESQ5jHdQBJs

Malware Config

Signatures

  • Adds policy Run key to start application 2 TTPs 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c72839924b296de9d93bf0d0f0b0ae90N.exe
    "C:\Users\Admin\AppData\Local\Temp\c72839924b296de9d93bf0d0f0b0ae90N.exe"
    1⤵
    • Adds policy Run key to start application
    • Checks computer location settings
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies Internet Explorer settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4932
    • C:\program files\internet explorer\iexplore.exe
      "C:\program files\internet explorer\iexplore.exe"
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:5104
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5104 CREDAT:17410 /prefetch:2
        3⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:1660
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\dfDelmlljy.bat" "
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1260
      • C:\Windows\SysWOW64\PING.EXE
        ping 127.0.0.1
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:1192

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\lljyndf16.ini

    Filesize

    85B

    MD5

    9fce7039e13215513a7fa2bf693bd6f3

    SHA1

    1188012bf423dc1730f1dfe8fa7c613967a14305

    SHA256

    929674867dff75548664ef62a39d27d38522ecb1bae8d4fc2b3c2ea9333e2d85

    SHA512

    cfeb816ebdb625f30a14147cc2aacc8e43a2f429e61fd7600b2ffba508d43a6578f6e83479df179c5bdfea636f6dc944a13433f6a23538783274449c4b23a9ca

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

    Filesize

    471B

    MD5

    1c7226fea3dc2059287a4a2ae7519102

    SHA1

    ddf68a29afc928251f9743341d5fe0be207479ad

    SHA256

    ccaab5444ee41ed3c94268a55693fe4157f72e980d2dc3687ac98bab1a265396

    SHA512

    b646d2a7d9d8fbc5846f8ecc8a69e7913c603cbad1a488f24b75a0e371e3e367c596dc3fbae2ebbfb486e17b5f248ee4c47d34c6b5e7cdd7cc387d184e8366e1

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

    Filesize

    404B

    MD5

    47f5c1ba0327c834e872e2ff91e63811

    SHA1

    bbf707c4528fd6fbb420243c9d4aedd61ecd90e4

    SHA256

    96a0a23f7b7c1155d3d41a320c353a1fb0c9a2463cd58f3042a0a5372ea7225b

    SHA512

    464b3d07bf6250b19daf9da9178c85c937ef3ebf49510e4c3713581dd2e169ab6a67c2ea7341e1c88874060bd7babafa7fd98938856f40fb77a6b8b12f8b32ee

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\68XY2BI1\suggestions[1].en-US

    Filesize

    17KB

    MD5

    5a34cb996293fde2cb7a4ac89587393a

    SHA1

    3c96c993500690d1a77873cd62bc639b3a10653f

    SHA256

    c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

    SHA512

    e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

  • C:\dfDelmlljy.bat

    Filesize

    207B

    MD5

    22187c81105b43ae78940848cea05cb4

    SHA1

    ac62d6e506a7353881bc9cf827895d93ac987d38

    SHA256

    73b0158ee44a774981a7fe2d30f89adb0d590126dadb95c0e6bbad9a1cb02a04

    SHA512

    b00d1d924314b49e1c3d3d37f28cc3f82583afebc55d546d549b58486bf9ec9ffd15d0f0fc970643989215a069a0965bb8702c04468e8991015c11dbb6a12377

  • memory/4932-0-0x0000000000400000-0x000000000044A000-memory.dmp

    Filesize

    296KB

  • memory/4932-12-0x0000000000400000-0x000000000044A000-memory.dmp

    Filesize

    296KB

  • memory/4932-16-0x0000000000400000-0x000000000044A000-memory.dmp

    Filesize

    296KB