Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

5ea75051c0...eN.exe

windows7-x64

10

5ea75051c0...eN.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    120s
  • max time network
    120s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/09/2024, 06:32

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    5ea75051c057b196ba4ef2a1802501f60f31304040461adc857940ae1cdc6eceN.exe

  • Size

    484KB

  • MD5

    e3bd7e104779c8f8f0dec980f01cb550

  • SHA1

    8ee65934adf781f3b120f353daa045633cdccde6

  • SHA256

    5ea75051c057b196ba4ef2a1802501f60f31304040461adc857940ae1cdc6ece

  • SHA512

    728f1460bac8d42a57236574d533265f718af74b1ce38712a29fa31b0b8219033c43255695f8cb97b42af176cc86ab6a0b9bbb0894efda96a4a79a44a53586ff

  • SSDEEP

    12288:AoUld/f2I9JECdYW4/e4Pii15XZSAmKjlafbdDNUQ:a92ILECd0R15XZS3QafpDNUQ

Score
10/10
discoveryevasionpersistenceupx

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
    evasion
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 7 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 51 IoCs
    persistence
  • Enumerates processes with tasklist 1 TTPs 3 IoCs
    discovery
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 50 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5ea75051c057b196ba4ef2a1802501f60f31304040461adc857940ae1cdc6eceN.exe
    "C:\Users\Admin\AppData\Local\Temp\5ea75051c057b196ba4ef2a1802501f60f31304040461adc857940ae1cdc6eceN.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2516
    • C:\Users\Admin\LB9c4j3K.exe
      C:\Users\Admin\LB9c4j3K.exe
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Checks computer location settings
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:408
      • C:\Users\Admin\xauyuov.exe
        "C:\Users\Admin\xauyuov.exe"
        3⤵
        • Modifies visiblity of hidden/system files in Explorer
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3296
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c tasklist&&del LB9c4j3K.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3508
        • C:\Windows\SysWOW64\tasklist.exe
          tasklist
          4⤵
          • Enumerates processes with tasklist
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:1384
    • C:\Users\Admin\aahost.exe
      C:\Users\Admin\aahost.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2312
      • C:\Users\Admin\aahost.exe
        "C:\Users\Admin\aahost.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        PID:2904
    • C:\Users\Admin\bshost.exe
      C:\Users\Admin\bshost.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2888
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe"
        3⤵
          PID:5100
      • C:\Users\Admin\dyhost.exe
        C:\Users\Admin\dyhost.exe
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:4908
      • C:\Users\Admin\ekhost.exe
        C:\Users\Admin\ekhost.exe
        2⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:916
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c tasklist&&del ekhost.exe
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3528
          • C:\Windows\SysWOW64\tasklist.exe
            tasklist
            4⤵
            • Enumerates processes with tasklist
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:4864
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c tasklist&&del 5ea75051c057b196ba4ef2a1802501f60f31304040461adc857940ae1cdc6eceN.exe
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3896
        • C:\Windows\SysWOW64\tasklist.exe
          tasklist
          3⤵
          • Enumerates processes with tasklist
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:4264
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4512,i,4174666705242427184,7333705955694532165,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:8
      1⤵
        PID:2240

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\LB9c4j3K.exe
        Filesize

        212KB

        MD5

        fa0eb2a8b561ea9afc6a51709ff0d7de

        SHA1

        4ef5265f5b5bb1a4857e7668f132405c799da155

        SHA256

        99ecfb1bb7cdb1e8dd609e60b10d5346b90284172c854b6234631212dd501c4f

        SHA512

        0e8b194cb0e65429b84ac32a0fa131d072f7f425804df192d7a90a7ec6eb7ce9991716ce5a9ca3bcd106181076832d5fa7d6f9cbe67fc80a427ef7980beb75c6

        Download Submit

      • C:\Users\Admin\aahost.exe
        Filesize

        140KB

        MD5

        93ea44e078cb0477614729636866a84b

        SHA1

        f9752413d48fd98a77cfce8fff04a7a0d72c26d8

        SHA256

        c16c3df8b6b4187e04a6abb49a15eb02ccefdce86068960ab3afeb088bf4ba27

        SHA512

        351bafb9dc5395a9cd1393b76cba405312a5d85a59e5b1c0e891c2de1343b2bc2765a40077e4155fbd9a5578db3be66ace35e27ff02cb32f813ba01db4fc1113

        Download Submit

      • C:\Users\Admin\bshost.exe
        Filesize

        260KB

        MD5

        bbc0a2fe1284778896b57ffc5701aefa

        SHA1

        6b9a0106b82c63265936ce728a858d258c8f6b14

        SHA256

        92fad55bc5c7438d0f36501581b4b958efba2fbe5db02b97093a79b8a19645a0

        SHA512

        8a17a1ed99a99a270191684b0337836531934b8717e78481815fd18767a172e6d7cf89488926dd2ea1b9e9ccaf53afd29c6925beaeb2fa7fa918be0e416be930

        Download Submit

      • C:\Users\Admin\calc.exe
        Filesize

        764KB

        MD5

        e381b04abf596ed1573154cd41f418dc

        SHA1

        2ad1df7bebf1e4c0715adbf76c8c14b9162edf2e

        SHA256

        02b08664fcc196f15ff0e33e7ed43e9e78af7b564e3f7c5388dd7d0267905fe6

        SHA512

        44307e60bdc804b3abe710a21e2268960dcc9d29671cf8ce723e40721b6b38ae338c49cd1b9cfd4fa8fa4f644cc80414baeb70f136f39f73833f8373f8180858

        Download Submit

      • C:\Users\Admin\dyhost.exe
        Filesize

        48KB

        MD5

        d46eb4bf816ed9978636de7955245323

        SHA1

        c474df60a83302e0d010d11dcebd7cdb3cc22866

        SHA256

        2ae9b936feeade89c9074c379efedd21d15a1cf247207afe5381f437e41ca4bd

        SHA512

        e46a604a96345b1b6800cb22c8c870dfa62dbdd8bd5b6ff43ddce9b080d1af180db498dad23561c0116b4dadbc44617b26840e67bc0afde01439e4c70632d7ef

        Download Submit

      • C:\Users\Admin\ekhost.exe
        Filesize

        24KB

        MD5

        9fe0e5252dc24fc1788b0d8b26026807

        SHA1

        21e3063a0fac1157b9707861048c5f7fbd070ceb

        SHA256

        9c99c968d969c2d5c1570c6066957d726bc19ffe9e0562242ce1bf79514c1b40

        SHA512

        613f5c821dfcef8124ecb7c9b118cda14be4d72a26f1a21ffde81c4d8aae4f315740d66c298e5963b0647f0ecd9e2d63d9bbb8df4e0c731019896e7ac0391d5c

        Download Submit

      • C:\Users\Admin\xauyuov.exe
        Filesize

        212KB

        MD5

        143d488a05ff3153798af906fd9d75b7

        SHA1

        6fb7d040531c81bb6d3d7632d602cda7fba63e9b

        SHA256

        07bd8bbacbc13b49b0b8b63ae59ca834305890634c88805d6a0dc5c9973b7116

        SHA512

        7ac2261ad50b01b6fe1aa4105401345911be805b078e064c47304052fb973136268dc57b50f2785a4b8e27768f8c09d3531650fbaeed5e05ba3019f4d7a7f694

        Download Submit

      • memory/2888-62-0x0000000000400000-0x0000000000444000-memory.dmp

        Filesize

        272KB

        Download

      • memory/2888-58-0x0000000000400000-0x0000000000444000-memory.dmp

        Filesize

        272KB

        Download

      • memory/2904-42-0x0000000000400000-0x000000000040E000-memory.dmp

        Filesize

        56KB

        Download

      • memory/2904-46-0x0000000000400000-0x000000000040E000-memory.dmp

        Filesize

        56KB

        Download

      • memory/2904-48-0x0000000000400000-0x000000000040E000-memory.dmp

        Filesize

        56KB

        Download

      • memory/2904-45-0x0000000000400000-0x000000000040E000-memory.dmp

        Filesize

        56KB

        Download