Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
21/09/2024, 15:57
240921-td12yszhrd 721/09/2024, 15:56
240921-tdehys1cml 321/09/2024, 12:37
240921-ptr2rssglq 321/09/2024, 12:36
240921-ptcl3ssgkm 3Analysis
-
max time kernel
599s -
max time network
440s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
21/09/2024, 15:57
Static task
static1
Behavioral task
behavioral1
Sample
dhm6hb.zip
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
dhm6hb.zip
Resource
win10v2004-20240802-en
General
-
Target
dhm6hb.zip
-
Size
1.4MB
-
MD5
c9dc50ae9c21b0b9c197cd8ed3933ce9
-
SHA1
e31a23ad267bb07f7e350152f7c238a0eae8f378
-
SHA256
ff63748d7e23e908dc77ef2ee99de79ea60d2d1e31df71f01bfda0f4d802ca65
-
SHA512
e184dd258cf4982eefbc48a6f0922ee4de1a844e00913cf7a0cfe17a29840fd3c038c0ec5432c9e223dc617b4baa6a9cefcaed48aabbf4cc77b5069255e212b9
-
SSDEEP
24576:ZJWZ7iMmQECwzEDSdiaKECn+6g+b4EDfpvC/ePXO36m7KJf4G6x:GiLpCwwDrEC+6g+bTNCSoel4Jx
Malware Config
Signatures
-
Executes dropped EXE 12 IoCs
pid Process 4456 Artemis.exe 1536 Artemis.exe 532 Artemis.exe 8 Artemis.exe 3520 Artemis.exe 3240 Artemis.exe 3064 Artemis.exe 2480 Artemis.exe 4040 Artemis.exe 3556 Artemis.exe 1476 Artemis.exe 2432 Artemis.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4456 Artemis.exe 4456 Artemis.exe 1536 Artemis.exe 1536 Artemis.exe 532 Artemis.exe 532 Artemis.exe 8 Artemis.exe 8 Artemis.exe 3520 Artemis.exe 3520 Artemis.exe 3240 Artemis.exe 3240 Artemis.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3064 Artemis.exe 3064 Artemis.exe 3208 taskmgr.exe 3208 taskmgr.exe 2480 Artemis.exe 2480 Artemis.exe 4040 Artemis.exe 4040 Artemis.exe 3208 taskmgr.exe 3208 taskmgr.exe 3556 Artemis.exe 3556 Artemis.exe 1476 Artemis.exe 1476 Artemis.exe 3208 taskmgr.exe 3208 taskmgr.exe 2432 Artemis.exe 2432 Artemis.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3208 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeRestorePrivilege 4988 7zG.exe Token: 35 4988 7zG.exe Token: SeSecurityPrivilege 4988 7zG.exe Token: SeSecurityPrivilege 4988 7zG.exe Token: SeDebugPrivilege 3208 taskmgr.exe Token: SeSystemProfilePrivilege 3208 taskmgr.exe Token: SeCreateGlobalPrivilege 3208 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4988 7zG.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\dhm6hb.zip1⤵PID:1140
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:3164
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\AppData\Local\Temp\dhm6hb\" -ad -an -ai#7zMap24521:92:7zEvent5151⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4988
-
C:\Users\Admin\AppData\Local\Temp\dhm6hb\Artemis.exe"C:\Users\Admin\AppData\Local\Temp\dhm6hb\Artemis.exe"1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4456
-
C:\Users\Admin\AppData\Local\Temp\dhm6hb\Artemis.exe"C:\Users\Admin\AppData\Local\Temp\dhm6hb\Artemis.exe" C:\Users\Admin\AppData\Local\Temp\dhm6hb\Artemis.dll1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1536
-
C:\Users\Admin\AppData\Local\Temp\dhm6hb\Artemis.exe"C:\Users\Admin\AppData\Local\Temp\dhm6hb\Artemis.exe" C:\Users\Admin\AppData\Local\Temp\dhm6hb\Artemis.dll1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:532
-
C:\Users\Admin\AppData\Local\Temp\dhm6hb\Artemis.exe"C:\Users\Admin\AppData\Local\Temp\dhm6hb\Artemis.exe"1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:8
-
C:\Users\Admin\AppData\Local\Temp\dhm6hb\Artemis.exe"C:\Users\Admin\AppData\Local\Temp\dhm6hb\Artemis.exe"1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3520
-
C:\Users\Admin\AppData\Local\Temp\dhm6hb\Artemis.exe"C:\Users\Admin\AppData\Local\Temp\dhm6hb\Artemis.exe"1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3240
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3208
-
C:\Users\Admin\AppData\Local\Temp\dhm6hb\Artemis.exe"C:\Users\Admin\AppData\Local\Temp\dhm6hb\Artemis.exe" C:\Users\Admin\AppData\Local\Temp\dhm6hb\Artemis.dll1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3064
-
C:\Users\Admin\AppData\Local\Temp\dhm6hb\Artemis.exe"C:\Users\Admin\AppData\Local\Temp\dhm6hb\Artemis.exe" C:\Users\Admin\AppData\Local\Temp\dhm6hb\Artemis.dll1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2480
-
C:\Users\Admin\AppData\Local\Temp\dhm6hb\Artemis.exe"C:\Users\Admin\AppData\Local\Temp\dhm6hb\Artemis.exe"1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4040
-
C:\Users\Admin\AppData\Local\Temp\dhm6hb\Artemis.exe"C:\Users\Admin\AppData\Local\Temp\dhm6hb\Artemis.exe"1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3556
-
C:\Users\Admin\AppData\Local\Temp\dhm6hb\Artemis.exe"C:\Users\Admin\AppData\Local\Temp\dhm6hb\Artemis.exe"1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1476
-
C:\Users\Admin\AppData\Local\Temp\dhm6hb\Artemis.exe"C:\Users\Admin\AppData\Local\Temp\dhm6hb\Artemis.exe"1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2432
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD537268daa715f7756bee72c2a3479d4a0
SHA1f5ba072f9a8e3a73489b30febfb2fcf2073442b7
SHA2568092ce66892f6218283ef2acc11117b35782620ef347fa4d86629d38e2872fe4
SHA512998b87874eec11c6ad167ddca63e3f5678896eb5a192ae9296be1447a4bfbffc24022e8ca2b9b82758cacf0748019871e9f9f15f0762dbb73ef5385bf3fc4236