Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    125s
  • max time network
    128s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/09/2024, 13:59

General

  • Target

    file.exe

  • Size

    732KB

  • MD5

    7fbb332b55f872e61c8307e0b5242287

  • SHA1

    b499466240ef01da4a2cf380d709752b2e44232a

  • SHA256

    9845acc424512cc5b0c67de96ce917624b5e80ee95ea4ea6a7cbc37b7c03ef63

  • SHA512

    e813f006263b87a5078bca9c58b94567ac8df627b27d44411774b797bdd7095f9bebaff8a1d2f0329b8fc63016199ef7e04ec17d68ce28b250cd3da37c2e8d04

  • SSDEEP

    12288:TfLdembnSidi8rrdTT4aQUh9IHUM1mPCeBxHnymwsXFDsiJjWlWVB0mPHp:TfLNnSsi8dTTCjmqePSrsXF4i7XPPJ

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2972
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -windowstyle minimized "$Sprag=Get-Content 'C:\Users\Admin\AppData\Local\acneform\Camomiles.Bev';$Depurge=$Sprag.SubString(30781,3);.$Depurge($Sprag)"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3668
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3988,i,5469445176230119590,7931734017267321834,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:8
    1⤵
      PID:3372

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ubkhj42f.k20.ps1

      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • C:\Users\Admin\AppData\Local\Temp\nswF2D7.tmp\nsExec.dll

      Filesize

      7KB

      MD5

      b4579bc396ace8cafd9e825ff63fe244

      SHA1

      32a87ed28a510e3b3c06a451d1f3d0ba9faf8d9c

      SHA256

      01e72332362345c415a7edcb366d6a1b52be9ac6e946fb9da49785c140ba1a4b

      SHA512

      3a76e0e259a0ca12275fed922ce6e01bdfd9e33ba85973e80101b8025ef9243f5e32461a113bbcc6aa75e40894bb5d3a42d6b21045517b6b3cf12d76b4cfa36a

    • C:\Users\Admin\AppData\Local\acneform\Camomiles.Bev

      Filesize

      71KB

      MD5

      99eba9ecc95f62898e4df3aa12cb4624

      SHA1

      c21a35b90111b01c32c9e963b20aaa01b35658a6

      SHA256

      b8408fc8df3cd3c0938d8314568b278d72cb102b8d128a11608cab75a2046b21

      SHA512

      42b40c55dc01197d21b6dbb5c4d0ca77be2ca890a70fab1e0022defbde7204a8b19387915fe144b540333bdb72fde557e8f1673131830faf455aa0fb25e6a347

    • memory/3668-27-0x0000000005C30000-0x0000000005F84000-memory.dmp

      Filesize

      3.3MB

    • memory/3668-29-0x00000000062A0000-0x00000000062EC000-memory.dmp

      Filesize

      304KB

    • memory/3668-14-0x0000000073590000-0x0000000073D40000-memory.dmp

      Filesize

      7.7MB

    • memory/3668-15-0x0000000005280000-0x00000000052A2000-memory.dmp

      Filesize

      136KB

    • memory/3668-17-0x0000000005BC0000-0x0000000005C26000-memory.dmp

      Filesize

      408KB

    • memory/3668-16-0x00000000053A0000-0x0000000005406000-memory.dmp

      Filesize

      408KB

    • memory/3668-13-0x0000000073590000-0x0000000073D40000-memory.dmp

      Filesize

      7.7MB

    • memory/3668-11-0x0000000002C90000-0x0000000002CC6000-memory.dmp

      Filesize

      216KB

    • memory/3668-28-0x0000000006250000-0x000000000626E000-memory.dmp

      Filesize

      120KB

    • memory/3668-12-0x0000000005450000-0x0000000005A78000-memory.dmp

      Filesize

      6.2MB

    • memory/3668-30-0x00000000067E0000-0x0000000006876000-memory.dmp

      Filesize

      600KB

    • memory/3668-31-0x0000000006770000-0x000000000678A000-memory.dmp

      Filesize

      104KB

    • memory/3668-32-0x0000000007250000-0x0000000007272000-memory.dmp

      Filesize

      136KB

    • memory/3668-33-0x00000000078B0000-0x0000000007E54000-memory.dmp

      Filesize

      5.6MB

    • memory/3668-10-0x000000007359E000-0x000000007359F000-memory.dmp

      Filesize

      4KB

    • memory/3668-35-0x00000000084E0000-0x0000000008B5A000-memory.dmp

      Filesize

      6.5MB

    • memory/3668-37-0x000000007359E000-0x000000007359F000-memory.dmp

      Filesize

      4KB

    • memory/3668-38-0x0000000073590000-0x0000000073D40000-memory.dmp

      Filesize

      7.7MB