Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/09/2024, 01:29

General

  • Target

    4ef702a13b87f44dcdc149ba50fc0a334192c57018ccc1d846d19d8c4646fc93.exe

  • Size

    239KB

  • MD5

    58a5c8b03f4f14c3fdfeb1e73cf72ac8

  • SHA1

    fd35c9c55012cc6871812cc985dbdb436ccb0fac

  • SHA256

    4ef702a13b87f44dcdc149ba50fc0a334192c57018ccc1d846d19d8c4646fc93

  • SHA512

    3e18a44e6c113d8f7c975bae6b57137524c15ebe802462c8be8da94b917341fdb4654aa51d9f5846978e827ace1ed521b1da6a33f1200c203e4ac1f9e4cec639

  • SSDEEP

    3072:hsXRmUIMitiMQose27vc+Eld+xZp2vPRL1tT06zJoxAWBcKpSP//dwR1l9B4hT5:GR5IuMQoseGk7RZBGxAycKpSPX2pU3

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 3 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Delays execution with timeout.exe 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\4ef702a13b87f44dcdc149ba50fc0a334192c57018ccc1d846d19d8c4646fc93.exe
    "C:\Users\Admin\AppData\Local\Temp\4ef702a13b87f44dcdc149ba50fc0a334192c57018ccc1d846d19d8c4646fc93.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1636
    • C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\tar32.exe
      "C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\tar32.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visiblity of hidden/system files in Explorer
      • Checks computer location settings
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3792
      • C:\Windows\System32\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /create /tn Admin /tr "\"C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\tar32.exe\" arguments" /sc MINUTE /mo 1
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:2688
      • \??\c:\windows\microsoft.net\framework\v2.0.50727\InstallUtil.exe
        "c:\windows\microsoft.net\framework\v2.0.50727\\InstallUtil.exe" C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\tar32.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:4456
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      2⤵
        PID:2648
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /c timeout /t 5 && del "C:\Users\Admin\AppData\Local\Temp\4ef702a13b87f44dcdc149ba50fc0a334192c57018ccc1d846d19d8c4646fc93.exe" && del "C:\Users\Admin\AppData\Local\Temp\4ef702a13b87f44dcdc149ba50fc0a334192c57018ccc1d846d19d8c4646fc93.exe.config"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2104
        • C:\Windows\system32\timeout.exe
          timeout /t 5
          3⤵
          • Delays execution with timeout.exe
          PID:4940
    • C:\Windows\system32\wbem\WmiApSrv.exe
      C:\Windows\system32\wbem\WmiApSrv.exe
      1⤵
        PID:4732
      • C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\tar32.exe
        C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\tar32.exe arguments
        1⤵
        • Executes dropped EXE
        PID:3692
      • C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\tar32.exe
        C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\tar32.exe arguments
        1⤵
        • Executes dropped EXE
        PID:2412

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0\UsageLogs\tar32.exe.log

        Filesize

        595B

        MD5

        5446caf843683ea0aab610c729c40ab1

        SHA1

        6df96e9c6c90843766b0fde8cec5e3a955291e74

        SHA256

        f7dbd089564c22c13483b867392a7bd1f9b49f8e0b089e2cc7bd7bfbf62c6329

        SHA512

        488e2b8750ff820e3fbdcbb9201abddfc6c8ccc3e7cc29962a05c2313ea862eddbf4e0a49ab6a5029aa4d9c137daf2623f1b34e4dcb896269e6edae8276148ff

      • C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\tar32.exe

        Filesize

        239KB

        MD5

        10860ad27272f544285317b0500f02e9

        SHA1

        994fea72955f8d4e0f1b02b81869a548da01365d

        SHA256

        89df658f9bde6db339dfc184d52835de5684f429813a6802c3988e6fd3990ca5

        SHA512

        ded5d65e528743c209e5f94b04abef5998192883f485957fdf12925eb8e3dfe51acdeeed2b22bf5f17aacf27d16675634c7360364deea9ea15b30a7086635d0d

      • C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\tar32.exe.config

        Filesize

        1KB

        MD5

        dd3d04c365984b4ec57a80503f81fddf

        SHA1

        c55fbcb61818e47dac9aae465faff91f0805bd7c

        SHA256

        40a59ca9744dc3d4647f246b2dc553f37f8095418c1b48a9bd94cdb5c03dbc5c

        SHA512

        0dd459def2abe9e3f0d1251049a0755c63f7dd3d85e91dba272c3f479f2578e3f3f2379e1cd6913190f7f596af721201eb5d9423ab28aed72bde5cd3cac7f785

      • memory/1636-5-0x00007FFA852E0000-0x00007FFA85C81000-memory.dmp

        Filesize

        9.6MB

      • memory/1636-11-0x000000001F4E0000-0x000000001F586000-memory.dmp

        Filesize

        664KB

      • memory/1636-6-0x000000001CA90000-0x000000001CAF6000-memory.dmp

        Filesize

        408KB

      • memory/1636-0-0x00007FFA85595000-0x00007FFA85596000-memory.dmp

        Filesize

        4KB

      • memory/1636-7-0x00007FFA852E0000-0x00007FFA85C81000-memory.dmp

        Filesize

        9.6MB

      • memory/1636-8-0x00007FFA852E0000-0x00007FFA85C81000-memory.dmp

        Filesize

        9.6MB

      • memory/1636-9-0x00007FFA852E0000-0x00007FFA85C81000-memory.dmp

        Filesize

        9.6MB

      • memory/1636-30-0x00007FFA852E0000-0x00007FFA85C81000-memory.dmp

        Filesize

        9.6MB

      • memory/1636-10-0x000000001CFC0000-0x000000001CFE2000-memory.dmp

        Filesize

        136KB

      • memory/1636-3-0x000000001C8C0000-0x000000001C95C000-memory.dmp

        Filesize

        624KB

      • memory/1636-1-0x00007FFA852E0000-0x00007FFA85C81000-memory.dmp

        Filesize

        9.6MB

      • memory/1636-4-0x0000000001930000-0x0000000001938000-memory.dmp

        Filesize

        32KB

      • memory/1636-2-0x000000001C350000-0x000000001C81E000-memory.dmp

        Filesize

        4.8MB

      • memory/2412-41-0x0000000000B60000-0x0000000000B82000-memory.dmp

        Filesize

        136KB

      • memory/3692-36-0x000000001E570000-0x000000001E592000-memory.dmp

        Filesize

        136KB

      • memory/3792-26-0x00007FFA852E0000-0x00007FFA85C81000-memory.dmp

        Filesize

        9.6MB

      • memory/3792-33-0x000000001D7C0000-0x000000001D822000-memory.dmp

        Filesize

        392KB

      • memory/3792-34-0x00007FFA852E0000-0x00007FFA85C81000-memory.dmp

        Filesize

        9.6MB

      • memory/3792-31-0x000000001CC20000-0x000000001CC42000-memory.dmp

        Filesize

        136KB

      • memory/3792-28-0x00007FFA852E0000-0x00007FFA85C81000-memory.dmp

        Filesize

        9.6MB

      • memory/3792-27-0x00007FFA852E0000-0x00007FFA85C81000-memory.dmp

        Filesize

        9.6MB

      • memory/4456-32-0x0000000000400000-0x0000000000408000-memory.dmp

        Filesize

        32KB