Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    137s
  • max time network
    95s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/09/2024, 21:13

General

  • Target

    39a6f19fe835ddba6e650e13d2579f102574a984796094fab0d9ab7e12f031d8.exe

  • Size

    1.0MB

  • MD5

    56cb4177698cacbaf3f194fbc133f3d5

  • SHA1

    6b52cec6871d408f7e71584eea5ea08b103130ad

  • SHA256

    39a6f19fe835ddba6e650e13d2579f102574a984796094fab0d9ab7e12f031d8

  • SHA512

    c47813abaa38f4fd758e6d277311a3fcdac317cacee7a852461a10b2e2f90697f9eddfa325a257acc1d086b401770794f38af93ebd7327b006d46e647a171a4a

  • SSDEEP

    12288:Mmhjxw7dUlzn3DSudvsh8Awf3XFaZmBITVJPtSrE37yG2LmxL5BwcyQVaE:Lhe7alj3DSudvGM3MXTVhtSQWGtxkPQF

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in System32 directory 8 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 26 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\39a6f19fe835ddba6e650e13d2579f102574a984796094fab0d9ab7e12f031d8.exe
    "C:\Users\Admin\AppData\Local\Temp\39a6f19fe835ddba6e650e13d2579f102574a984796094fab0d9ab7e12f031d8.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4028
    • C:\Users\Admin\AppData\Local\Temp\viqdhzdkrg.exe
      "C:\Users\Admin\AppData\Local\Temp\viqdhzdkrg.exe" "C:\Users\Admin\AppData\Local\Temp\exmbkuavuc.exe" "C:\Users\Admin\AppData\Local\Temp\39a6f19fe835ddba6e650e13d2579f102574a984796094fab0d9ab7e12f031d8.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2344
      • C:\Users\Admin\AppData\Local\Temp\39a6f19fe835ddba6e650e13d2579f102574a984796094fab0d9ab7e12f031d8.exe
        "C:\Users\Admin\AppData\Local\Temp\39a6f19fe835ddba6e650e13d2579f102574a984796094fab0d9ab7e12f031d8.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:3152
    • C:\Users\Admin\AppData\Local\Temp\gyznnbxlsj.exe
      C:\Users\Admin\AppData\Local\Temp\gyznnbxlsj.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2544
      • C:\Windows\System32\cmd.exe
        /c sc config msdtc obj= LocalSystem
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4728
        • C:\Windows\system32\sc.exe
          sc config msdtc obj= LocalSystem
          4⤵
          • Launches sc.exe
          PID:4384
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Q7xm88zW.bat"
        3⤵
          PID:816
        • C:\Windows\System32\bindsvc.exe
          "C:\Windows\System32\bindsvc.exe"
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3328
    • C:\Windows\system32\SearchIndexer.exe
      C:\Windows\system32\SearchIndexer.exe /Embedding
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2256
      • C:\Windows\system32\SearchProtocolHost.exe
        "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
        2⤵
        • Modifies data under HKEY_USERS
        PID:2476
      • C:\Windows\system32\SearchFilterHost.exe
        "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
        2⤵
        • Modifies data under HKEY_USERS
        PID:3676

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\Q7xm88zW.bat

      Filesize

      196B

      MD5

      762236efa938f5bba17503da5850b196

      SHA1

      f943415a336eac937a4f3665af471a6cd04ecc90

      SHA256

      d3afa5e8e603756b8a3f4e75d8a877feac001aeef1db2461ee2bcbeae72f76be

      SHA512

      25000d74a89cc652a4158aa6da91476aaeff3746f79f7d56f07ba2a634d31aab8c609dff2447b3248450b01ef4afc6c55bda4935141dae8dba967e1ac787b329

    • C:\Users\Admin\AppData\Local\Temp\exmbkuavuc.exe

      Filesize

      209KB

      MD5

      8d98511924d571c2b0e11d765b857a8a

      SHA1

      b9ce4bacd3e7e644626fae63f746d4466dba737e

      SHA256

      666902c802f71eafbbb130664af70cea1d0cae2798b5be979b29ae9fc43feb7e

      SHA512

      925d53bb92ae82b83456d5728e58f608576ba633ce08ef440b4bd4fb04f4db5cf6a171548ff37feca3dc3f89838b9852d4ed74e05f4e07179751f3630ca9ad04

    • C:\Users\Admin\AppData\Local\Temp\gyznnbxlsj.exe

      Filesize

      580KB

      MD5

      2c2029588ad8b86759c17b7ae885ee03

      SHA1

      91653b5344d4c210201218e2f215dd5228d76799

      SHA256

      3ab288c47914e33cc61985e46502158400faa9d7187b55c19039b8795504a290

      SHA512

      88531fe6b0f2d66ada368a431f912868f74f9ed8ade9dc88887807b761490fe2cc317e1b6b40e7070411924c80971f237dca68ad2faafa7b4b1ecd2ec90c860f

    • C:\Users\Admin\AppData\Local\Temp\viqdhzdkrg.exe

      Filesize

      51KB

      MD5

      e48b89715bf5e4c55eb5a1fed67865d9

      SHA1

      89a287da39e14b02cdc284eb287549462346d724

      SHA256

      c25d90168fc2026d8ed2a69c066bd5a7e11004c3899928a7db24cb7636fc4d9e

      SHA512

      4bd77d2fa5da646009ebeeedb5610048c58598ee7e5aeb5660b0c01042f0f34a88f89181e13e86c06cae9984155d0299128a2aee1c2c16f18e284db4745d850c

    • C:\Windows\System32\bindsvc.exe

      Filesize

      291KB

      MD5

      7c5b397fb54d5aa06bd2a6fb99c62fee

      SHA1

      a9e0bf7bbabf6ab9e294156985537ae972ebd743

      SHA256

      d032bdc64c9451bbb653b346c5bd6ac9f83a91edeb0155497f098c8d6182ddee

      SHA512

      daa4702eff625b5dd1edca358c653338cff4eeca4e43d12dfd39bbc52acf8dfde3b963d190cf4426e405d9db8bcc9817cd50868055aa0d4a9efe4d1042beaf0c

    • memory/2256-21-0x000001B9B4430000-0x000001B9B4440000-memory.dmp

      Filesize

      64KB

    • memory/2256-37-0x000001B9B4530000-0x000001B9B4540000-memory.dmp

      Filesize

      64KB

    • memory/2256-53-0x000001B9B8A20000-0x000001B9B8A28000-memory.dmp

      Filesize

      32KB

    • memory/2256-67-0x000001B9B9C90000-0x000001B9B9C98000-memory.dmp

      Filesize

      32KB

    • memory/2544-15-0x0000000000320000-0x000000000049A000-memory.dmp

      Filesize

      1.5MB

    • memory/2544-241-0x0000000000320000-0x000000000049A000-memory.dmp

      Filesize

      1.5MB

    • memory/2544-232-0x0000000000320000-0x000000000049A000-memory.dmp

      Filesize

      1.5MB

    • memory/3676-83-0x000001A1AE490000-0x000001A1AE4A0000-memory.dmp

      Filesize

      64KB

    • memory/3676-88-0x000001A1AE490000-0x000001A1AE4A0000-memory.dmp

      Filesize

      64KB

    • memory/3676-75-0x000001A1AE490000-0x000001A1AE4A0000-memory.dmp

      Filesize

      64KB

    • memory/3676-76-0x000001A1AE490000-0x000001A1AE4A0000-memory.dmp

      Filesize

      64KB

    • memory/3676-79-0x000001A1AE490000-0x000001A1AE4A0000-memory.dmp

      Filesize

      64KB

    • memory/3676-80-0x000001A1AE490000-0x000001A1AE4A0000-memory.dmp

      Filesize

      64KB

    • memory/3676-81-0x000001A1AE490000-0x000001A1AE4A0000-memory.dmp

      Filesize

      64KB

    • memory/3676-84-0x000001A1AE490000-0x000001A1AE4A0000-memory.dmp

      Filesize

      64KB

    • memory/3676-73-0x000001A1AE490000-0x000001A1AE4A0000-memory.dmp

      Filesize

      64KB

    • memory/3676-82-0x000001A1AE490000-0x000001A1AE4A0000-memory.dmp

      Filesize

      64KB

    • memory/3676-78-0x000001A1AE490000-0x000001A1AE4A0000-memory.dmp

      Filesize

      64KB

    • memory/3676-77-0x000001A1AE490000-0x000001A1AE4A0000-memory.dmp

      Filesize

      64KB

    • memory/3676-85-0x000001A1AE490000-0x000001A1AE4A0000-memory.dmp

      Filesize

      64KB

    • memory/3676-86-0x000001A1AE490000-0x000001A1AE4A0000-memory.dmp

      Filesize

      64KB

    • memory/3676-87-0x000001A1AE490000-0x000001A1AE4A0000-memory.dmp

      Filesize

      64KB

    • memory/3676-72-0x000001A1AE490000-0x000001A1AE4A0000-memory.dmp

      Filesize

      64KB

    • memory/3676-90-0x000001A1AE490000-0x000001A1AE4A0000-memory.dmp

      Filesize

      64KB

    • memory/3676-89-0x000001A1AE490000-0x000001A1AE4A0000-memory.dmp

      Filesize

      64KB

    • memory/3676-91-0x000001A1AE490000-0x000001A1AE4A0000-memory.dmp

      Filesize

      64KB

    • memory/3676-93-0x000001A1AE490000-0x000001A1AE4A0000-memory.dmp

      Filesize

      64KB

    • memory/3676-94-0x000001A1AE490000-0x000001A1AE4A0000-memory.dmp

      Filesize

      64KB

    • memory/3676-92-0x000001A1AE490000-0x000001A1AE4A0000-memory.dmp

      Filesize

      64KB

    • memory/3676-96-0x000001A1AE490000-0x000001A1AE4A0000-memory.dmp

      Filesize

      64KB

    • memory/3676-98-0x000001A1AE490000-0x000001A1AE4A0000-memory.dmp

      Filesize

      64KB

    • memory/3676-97-0x000001A1AE490000-0x000001A1AE4A0000-memory.dmp

      Filesize

      64KB

    • memory/3676-95-0x000001A1AE490000-0x000001A1AE4A0000-memory.dmp

      Filesize

      64KB

    • memory/3676-74-0x000001A1AE490000-0x000001A1AE4A0000-memory.dmp

      Filesize

      64KB

    • memory/3676-71-0x000001A1AE490000-0x000001A1AE4A0000-memory.dmp

      Filesize

      64KB

    • memory/3676-70-0x000001A1AE490000-0x000001A1AE4A0000-memory.dmp

      Filesize

      64KB

    • memory/3676-69-0x000001A1AE490000-0x000001A1AE4A0000-memory.dmp

      Filesize

      64KB