Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    96s
  • max time network
    102s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/09/2024, 19:03

General

  • Target

    RFQ 1287668565645647645647674456475467567657465476.scr

  • Size

    1.6MB

  • MD5

    25627c53238e2289a29f0c7d5d0553c5

  • SHA1

    94d9ca78e77d31f5ccd514e2b58a5af31dfe67e7

  • SHA256

    54a791a6660fd49d6e2378527b448fc71708360b46c9928fe6c53cb2d03f7791

  • SHA512

    33b03efa11f5a758047842f5957d920c5a431ab0693c43c437c19aba1da829da12c94dfa2b9241c3851ef36ae3ba85757a18e55833a1ce3b3a363a647fa220e1

  • SSDEEP

    24576:w9PT36SNwoOjFhirCf/KyJJqKBDEytmAYCOO5Jg8pQyk5qSGEl65OYaBNvyg:U+SNqTiO3h35TAYJg8GySNwg

Malware Config

Signatures

  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Accesses Microsoft Outlook profiles 1 TTPs 42 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3396
      • C:\Users\Admin\AppData\Local\Temp\RFQ 1287668565645647645647674456475467567657465476.scr
        "C:\Users\Admin\AppData\Local\Temp\RFQ 1287668565645647645647674456475467567657465476.scr" /S
        2⤵
        • Suspicious use of NtCreateUserProcessOtherParentProcess
        • Adds Run key to start application
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3088
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
        2⤵
        • Loads dropped DLL
        • Accesses Microsoft Outlook profiles
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • outlook_office_path
        • outlook_win_path
        PID:3084

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\Costura\AF7011DB9BA75DE3E4434379E8037F31\32\sqlite.interop.dll

      Filesize

      1.3MB

      MD5

      e962a1987ddf83d7050ad3752bb56cb6

      SHA1

      378cd57c7afeeb030f7a93cec7af50526123886e

      SHA256

      77b3eadbc24d7bafdb5ffbea389fad9722db7b563e849388510002cb759e2c00

      SHA512

      cf58268c3cdeb4ad98892e46a8615c690b2c66d15c13cd815c8c1f98386eceecc120769936e87ace212fd0fc0716dc497691f4b7c123890823473ff328bfd68e

    • C:\Users\Admin\AppData\Local\Temp\Ddelxvpc.tmp

      Filesize

      160KB

      MD5

      f310cf1ff562ae14449e0167a3e1fe46

      SHA1

      85c58afa9049467031c6c2b17f5c12ca73bb2788

      SHA256

      e187946249cd390a3c1cf5d4e3b0d8f554f9acdc416bf4e7111fff217bb08855

      SHA512

      1196371de08c964268c44103ccaed530bda6a145df98e0f480d8ee5ad58cb6fb33ca4c9195a52181fe864726dcf52e6a7a466d693af0cda43400a3a7ef125fad

    • C:\Users\Admin\AppData\Local\Temp\Emjmgquybul.tmp

      Filesize

      124KB

      MD5

      9618e15b04a4ddb39ed6c496575f6f95

      SHA1

      1c28f8750e5555776b3c80b187c5d15a443a7412

      SHA256

      a4cd72e529e60b5f74c50e4e5b159efaf80625f23534dd15a28203760b8b28ab

      SHA512

      f802582aa7510f6b950e3343b0560ffa9037c6d22373a6a33513637ab0f8e60ed23294a13ad8890935b02c64830b5232ba9f60d0c0fe90df02b5da30ecd7fa26

    • C:\Users\Admin\AppData\Local\Temp\Nuklzqrjs.tmp

      Filesize

      116KB

      MD5

      f70aa3fa04f0536280f872ad17973c3d

      SHA1

      50a7b889329a92de1b272d0ecf5fce87395d3123

      SHA256

      8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8

      SHA512

      30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

    • C:\Users\Admin\AppData\Local\Temp\Sewznutxgvd.tmp

      Filesize

      114KB

      MD5

      3cfabadfcb05a77b204fe1a6b09a5c90

      SHA1

      f106b5ed22265e64bc61dc5cf1e2d33ed12ec18d

      SHA256

      693617c470d7472e751d872341061cfb663f22ee95bdb42f9db01f02cb90df9c

      SHA512

      d5502023a17213919e2e991f5ba2d0d2c08223fd489d876a47a37239b637d03ace9cb9b92deb71460ae4030194ca49ce9e9752e0bf2ccbcd297dc5afe62a4e7b

    • memory/3084-1091-0x0000000000400000-0x00000000004D0000-memory.dmp

      Filesize

      832KB

    • memory/3084-1093-0x0000000003200000-0x0000000003208000-memory.dmp

      Filesize

      32KB

    • memory/3084-3977-0x0000000008FA0000-0x0000000008FC1000-memory.dmp

      Filesize

      132KB

    • memory/3084-3976-0x0000000009C20000-0x0000000009C5C000-memory.dmp

      Filesize

      240KB

    • memory/3084-3975-0x0000000009BD0000-0x0000000009C20000-memory.dmp

      Filesize

      320KB

    • memory/3084-3973-0x0000000007DC0000-0x0000000007E0C000-memory.dmp

      Filesize

      304KB

    • memory/3084-3972-0x0000000008480000-0x00000000087D4000-memory.dmp

      Filesize

      3.3MB

    • memory/3084-3971-0x0000000007D30000-0x0000000007D94000-memory.dmp

      Filesize

      400KB

    • memory/3084-4029-0x0000000074870000-0x0000000075020000-memory.dmp

      Filesize

      7.7MB

    • memory/3084-3968-0x00000000079C0000-0x0000000007A52000-memory.dmp

      Filesize

      584KB

    • memory/3084-3970-0x0000000007CA0000-0x0000000007D1A000-memory.dmp

      Filesize

      488KB

    • memory/3084-3967-0x0000000074870000-0x0000000075020000-memory.dmp

      Filesize

      7.7MB

    • memory/3084-3966-0x0000000007270000-0x00000000072D6000-memory.dmp

      Filesize

      408KB

    • memory/3084-4031-0x0000000074870000-0x0000000075020000-memory.dmp

      Filesize

      7.7MB

    • memory/3084-3961-0x00000000072F0000-0x000000000761C000-memory.dmp

      Filesize

      3.2MB

    • memory/3084-3960-0x0000000006DA0000-0x0000000006FFE000-memory.dmp

      Filesize

      2.4MB

    • memory/3084-3959-0x0000000005A00000-0x0000000005A72000-memory.dmp

      Filesize

      456KB

    • memory/3084-3969-0x0000000074870000-0x0000000075020000-memory.dmp

      Filesize

      7.7MB

    • memory/3084-1096-0x0000000005660000-0x0000000005742000-memory.dmp

      Filesize

      904KB

    • memory/3084-1094-0x0000000074870000-0x0000000075020000-memory.dmp

      Filesize

      7.7MB

    • memory/3084-1095-0x0000000074870000-0x0000000075020000-memory.dmp

      Filesize

      7.7MB

    • memory/3088-41-0x0000000005010000-0x000000000519C000-memory.dmp

      Filesize

      1.5MB

    • memory/3088-1092-0x0000000074870000-0x0000000075020000-memory.dmp

      Filesize

      7.7MB

    • memory/3088-17-0x0000000005010000-0x000000000519C000-memory.dmp

      Filesize

      1.5MB

    • memory/3088-15-0x0000000005010000-0x000000000519C000-memory.dmp

      Filesize

      1.5MB

    • memory/3088-13-0x0000000005010000-0x000000000519C000-memory.dmp

      Filesize

      1.5MB

    • memory/3088-11-0x0000000005010000-0x000000000519C000-memory.dmp

      Filesize

      1.5MB

    • memory/3088-9-0x0000000005010000-0x000000000519C000-memory.dmp

      Filesize

      1.5MB

    • memory/3088-8-0x0000000005010000-0x000000000519C000-memory.dmp

      Filesize

      1.5MB

    • memory/3088-5-0x0000000005010000-0x000000000519C000-memory.dmp

      Filesize

      1.5MB

    • memory/3088-4-0x0000000005010000-0x000000000519C000-memory.dmp

      Filesize

      1.5MB

    • memory/3088-37-0x0000000005010000-0x000000000519C000-memory.dmp

      Filesize

      1.5MB

    • memory/3088-1078-0x0000000074870000-0x0000000075020000-memory.dmp

      Filesize

      7.7MB

    • memory/3088-1079-0x0000000005240000-0x000000000534C000-memory.dmp

      Filesize

      1.0MB

    • memory/3088-1080-0x0000000005350000-0x000000000539C000-memory.dmp

      Filesize

      304KB

    • memory/3088-1084-0x0000000074870000-0x0000000075020000-memory.dmp

      Filesize

      7.7MB

    • memory/3088-1085-0x0000000074870000-0x0000000075020000-memory.dmp

      Filesize

      7.7MB

    • memory/3088-1086-0x0000000074870000-0x0000000075020000-memory.dmp

      Filesize

      7.7MB

    • memory/3088-1088-0x0000000005570000-0x00000000055C4000-memory.dmp

      Filesize

      336KB

    • memory/3088-1087-0x0000000005C10000-0x00000000061B4000-memory.dmp

      Filesize

      5.6MB

    • memory/3088-21-0x0000000005010000-0x000000000519C000-memory.dmp

      Filesize

      1.5MB

    • memory/3088-23-0x0000000005010000-0x000000000519C000-memory.dmp

      Filesize

      1.5MB

    • memory/3088-27-0x0000000005010000-0x000000000519C000-memory.dmp

      Filesize

      1.5MB

    • memory/3088-29-0x0000000005010000-0x000000000519C000-memory.dmp

      Filesize

      1.5MB

    • memory/3088-19-0x0000000005010000-0x000000000519C000-memory.dmp

      Filesize

      1.5MB

    • memory/3088-31-0x0000000005010000-0x000000000519C000-memory.dmp

      Filesize

      1.5MB

    • memory/3088-33-0x0000000005010000-0x000000000519C000-memory.dmp

      Filesize

      1.5MB

    • memory/3088-35-0x0000000005010000-0x000000000519C000-memory.dmp

      Filesize

      1.5MB

    • memory/3088-47-0x0000000005010000-0x000000000519C000-memory.dmp

      Filesize

      1.5MB

    • memory/3088-0-0x000000007487E000-0x000000007487F000-memory.dmp

      Filesize

      4KB

    • memory/3088-43-0x0000000005010000-0x000000000519C000-memory.dmp

      Filesize

      1.5MB

    • memory/3088-45-0x0000000005010000-0x000000000519C000-memory.dmp

      Filesize

      1.5MB

    • memory/3088-49-0x0000000005010000-0x000000000519C000-memory.dmp

      Filesize

      1.5MB

    • memory/3088-51-0x0000000005010000-0x000000000519C000-memory.dmp

      Filesize

      1.5MB

    • memory/3088-53-0x0000000005010000-0x000000000519C000-memory.dmp

      Filesize

      1.5MB

    • memory/3088-55-0x0000000005010000-0x000000000519C000-memory.dmp

      Filesize

      1.5MB

    • memory/3088-57-0x0000000005010000-0x000000000519C000-memory.dmp

      Filesize

      1.5MB

    • memory/3088-61-0x0000000005010000-0x000000000519C000-memory.dmp

      Filesize

      1.5MB

    • memory/3088-63-0x0000000005010000-0x000000000519C000-memory.dmp

      Filesize

      1.5MB

    • memory/3088-65-0x0000000005010000-0x000000000519C000-memory.dmp

      Filesize

      1.5MB

    • memory/3088-67-0x0000000005010000-0x000000000519C000-memory.dmp

      Filesize

      1.5MB

    • memory/3088-59-0x0000000005010000-0x000000000519C000-memory.dmp

      Filesize

      1.5MB

    • memory/3088-39-0x0000000005010000-0x000000000519C000-memory.dmp

      Filesize

      1.5MB

    • memory/3088-25-0x0000000005010000-0x000000000519C000-memory.dmp

      Filesize

      1.5MB

    • memory/3088-3-0x0000000074870000-0x0000000075020000-memory.dmp

      Filesize

      7.7MB

    • memory/3088-2-0x0000000005010000-0x00000000051A2000-memory.dmp

      Filesize

      1.6MB

    • memory/3088-1-0x0000000000490000-0x0000000000638000-memory.dmp

      Filesize

      1.7MB