Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    144s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    04/09/2024, 12:43

General

  • Target

    bc4156ed6a3c7abf320866976da3f6229d3f30d3d59695e24b522c51b856a90d.exe

  • Size

    1.6MB

  • MD5

    6859839bca334b519de5bf66776171cb

  • SHA1

    2d1428485997bb5e9f89735fe57ba8e83bde1df8

  • SHA256

    bc4156ed6a3c7abf320866976da3f6229d3f30d3d59695e24b522c51b856a90d

  • SHA512

    0a0c94371dc237dc2ff025ff72e91dd5e48aa440c5936c4798ed99c0dbcce08f784a71661c269bdffdc898fd89e25866be47a66e91c213ba5b743292aa865e3c

  • SSDEEP

    24576:x1wQ2xJz6Mn2qMeqm3m+mBa+EGgwZc5W7qTBNiT8L+X+phmgJ7i:Lw1Jz6efR3m+MEGgSCBNiT86XKhmI

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • VMProtect packed file 7 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Suspicious use of SetThreadContext 3 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:832
    • C:\Windows\system32\taskeng.exe
      taskeng.exe {4FFF4EE4-4F95-46FD-89CD-33B656C77016} S-1-5-18:NT AUTHORITY\System:Service:
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2188
      • C:\Windows\system32\WinDefScan\obs-browser-page.exe
        C:\Windows\system32\WinDefScan\obs-browser-page.exe -svc
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2168
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k netsvcs
      2⤵
      • Suspicious use of SetThreadContext
      • Checks processor information in registry
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2288
      • C:\Windows\system32\dllhost.exe
        C:\Windows\system32\dllhost.exe /Processid:{F8284233-48F4-4680-ADDD-F8284233}
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:2924
  • C:\Users\Admin\AppData\Local\Temp\bc4156ed6a3c7abf320866976da3f6229d3f30d3d59695e24b522c51b856a90d.exe
    "C:\Users\Admin\AppData\Local\Temp\bc4156ed6a3c7abf320866976da3f6229d3f30d3d59695e24b522c51b856a90d.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    PID:3056
  • C:\Windows\system32\cmd.exe
    cmd /c copy C:\Windows\temp\259458772 C:\obs-browser-page.exe
    1⤵
      PID:2768
    • C:\Windows\system32\cmd.exe
      cmd /c copy C:\Windows\temp\259458881 C:\libcef.dll
      1⤵
        PID:2828
      • C:\Windows\system32\cmd.exe
        cmd /c copy C:\Windows\temp\259458990 C:\libcef.dat
        1⤵
          PID:2680
        • C:\obs-browser-page.exe
          C:\obs-browser-page.exe
          1⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2760
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -Install
            2⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2908

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Windows\temp\259458772

          Filesize

          514KB

          MD5

          c89b9fb97d02ac079a45725b3dfb54d4

          SHA1

          773d823a3304dad9a9e39e2227fba116370f4af7

          SHA256

          ec605cc14c60e30682e84ec87d19034f7bd1399025ca11fbf3c4adeed85fadf0

          SHA512

          495381374990c8613f4d97efb30f561e4b4d3a54794e93ea373695df70556e70ac7883f77dc2c7cee2a681d71f07a90b092e1394bc15f8329eda9923bb5dfb5e

        • C:\Windows\temp\259458881

          Filesize

          579KB

          MD5

          e40e24cbe6cface80087910c49344ab9

          SHA1

          60e4fff4073030d0fa7eadf5ce718e4272545043

          SHA256

          1be1771b0c93e1a4c7c97e95dc18aad5842c9046bd75f4794f2439ffd07545b6

          SHA512

          0ef03f1d6a226d5fb1ca026fefb50c04ef510f8fdec2743b5490ee55905bb318f47efd1d8b53614ec907c6b60150fe23d840bd62519abcfb81f94895c74e5763

        • C:\Windows\temp\259458990

          Filesize

          190KB

          MD5

          85ed07c782f6eef1c9ee20bdf1b48dfd

          SHA1

          d47758ab5d1d832703ed95e366b2662865457808

          SHA256

          04750a2e16673314deb356d2c0209356eff1711c7eb3e69f764528a4ab742318

          SHA512

          fb36eb0d903d63fed04029675eee8cb0c41946e72ee4272ccf127801bb36d72a909997909856f385afacbc42c4cfe745f9597f0e1b92496943dfb58c45a0824f

        • memory/832-71-0x0000000000C50000-0x0000000000C51000-memory.dmp

          Filesize

          4KB

        • memory/2168-57-0x000007FEF77F0000-0x000007FEF78C9000-memory.dmp

          Filesize

          868KB

        • memory/2168-75-0x000007FEF77F0000-0x000007FEF78C9000-memory.dmp

          Filesize

          868KB

        • memory/2168-65-0x0000000077360000-0x0000000077509000-memory.dmp

          Filesize

          1.7MB

        • memory/2168-58-0x000007FEF77F0000-0x000007FEF78C9000-memory.dmp

          Filesize

          868KB

        • memory/2760-51-0x000007FEF7660000-0x000007FEF7739000-memory.dmp

          Filesize

          868KB

        • memory/2760-40-0x0000000077361000-0x0000000077462000-memory.dmp

          Filesize

          1.0MB

        • memory/2760-39-0x0000000180000000-0x0000000180066000-memory.dmp

          Filesize

          408KB

        • memory/2760-24-0x000007FEF7660000-0x000007FEF7739000-memory.dmp

          Filesize

          868KB

        • memory/2760-25-0x000007FEF7660000-0x000007FEF7739000-memory.dmp

          Filesize

          868KB

        • memory/2760-33-0x0000000077360000-0x0000000077509000-memory.dmp

          Filesize

          1.7MB

        • memory/2760-32-0x0000000180000000-0x0000000180066000-memory.dmp

          Filesize

          408KB

        • memory/2760-31-0x0000000180000000-0x0000000180066000-memory.dmp

          Filesize

          408KB

        • memory/2760-28-0x0000000180000000-0x0000000180066000-memory.dmp

          Filesize

          408KB

        • memory/2908-48-0x0000000077360000-0x0000000077509000-memory.dmp

          Filesize

          1.7MB

        • memory/2908-46-0x0000000077360000-0x0000000077509000-memory.dmp

          Filesize

          1.7MB

        • memory/2908-55-0x0000000077360000-0x0000000077509000-memory.dmp

          Filesize

          1.7MB

        • memory/2908-37-0x0000000000060000-0x0000000000061000-memory.dmp

          Filesize

          4KB

        • memory/2908-47-0x0000000077360000-0x0000000077509000-memory.dmp

          Filesize

          1.7MB

        • memory/2908-34-0x0000000000070000-0x00000000000A0000-memory.dmp

          Filesize

          192KB

        • memory/2908-35-0x00000000000A0000-0x00000000000A1000-memory.dmp

          Filesize

          4KB

        • memory/3056-0-0x00000000002E0000-0x00000000002E1000-memory.dmp

          Filesize

          4KB

        • memory/3056-1-0x0000000180000000-0x0000000180036000-memory.dmp

          Filesize

          216KB