Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    94s
  • max time network
    129s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/09/2024, 21:57

General

  • Target

    Internet Explorer/iediagcmd.exe

  • Size

    528KB

  • MD5

    e7276e0f11dc763ee18dedfc7ee31b7c

  • SHA1

    da3e7ccf857aa0a19921b2f45d33269d41d7e513

  • SHA256

    0ec05d16b1ae0b2362e521902796c32ac9cd3cbbb05e56b564902229a32297a0

  • SHA512

    a028275679b84c886144640b7e6e35e3a0ec0d747995a002d3859938d2b37f16f86a36b621894be1376e77a6bf176828e0795c8f9e90d571866a868906bf74c7

  • SSDEEP

    6144:kkZIE1d78DBfKJcfh2mq1Zi2H2vAwP5gZpOZ1INeWe9Rlvm/JTIbvzKJcfh2m213:kk7ADBfpq1Zi2HOKOXIwgT8p21ZZ

Malware Config

Signatures

  • Modifies Windows Firewall 2 TTPs 1 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

  • Drops file in System32 directory 16 IoCs
  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Modifies registry class 35 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Internet Explorer\iediagcmd.exe
    "C:\Users\Admin\AppData\Local\Temp\Internet Explorer\iediagcmd.exe"
    1⤵
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:948
    • C:\Windows\system32\dxdiag.exe
      "C:\Windows\system32\dxdiag.exe" /x C:\Users\Admin\AppData\Local\Temp\dxdiag.xml
      2⤵
      • Drops file in System32 directory
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:2352
    • C:\Windows\SYSTEM32\ipconfig.exe
      "ipconfig" /all
      2⤵
      • Gathers network information
      PID:648
    • C:\Windows\SYSTEM32\route.exe
      "route" print
      2⤵
        PID:3180
      • C:\Windows\system32\netsh.exe
        "C:\Windows\system32\netsh.exe" in tcp show global
        2⤵
        • Event Triggered Execution: Netsh Helper DLL
        PID:4020
      • C:\Windows\system32\netsh.exe
        "C:\Windows\system32\netsh.exe" advfirewall firewall show rule name=all verbose
        2⤵
        • Modifies Windows Firewall
        • Event Triggered Execution: Netsh Helper DLL
        PID:2380
      • C:\Windows\system32\netsh.exe
        "C:\Windows\system32\netsh.exe" winsock show catalog
        2⤵
        • Event Triggered Execution: Netsh Helper DLL
        PID:4908
      • C:\Windows\SYSTEM32\makecab.exe
        "makecab.exe" /F "C:\Users\Admin\AppData\Local\Temp\iediag_makecab_directives.txt"
        2⤵
          PID:2784

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\IEDiag.json

        Filesize

        26KB

        MD5

        25c5e888f2739f7a22835f4115152a59

        SHA1

        073c5c117230dff53b80e50e7a088b242d87e277

        SHA256

        d6e9979dc4fa5b17902a15999e17bfd9792304f0642629245d654874cd646719

        SHA512

        43c9d46083304ea536cf36281754c5030fa450b6f02966c21856cf317823630856b3699c5e510f1f31a2b94efb538b0a7eadf4c3f170770d09961e40e0eefbbe

      • C:\Users\Admin\AppData\Local\Temp\IEDiag.xml

        Filesize

        2.2MB

        MD5

        619676df66d1e2930389dae2e1f0aa3b

        SHA1

        e7f8b89792ce585fd1e30a018c8f2ea34b98685c

        SHA256

        04de6dbb93e64f1450a5469dfaa6830dcfffc60eee21f26ed61b83ee4dc7f920

        SHA512

        6ca6bd33b6939e4bb53cb171b081fc7ee40e60a7d5f9e13cbea2f66bbe50bdff09e1a17a098bf983283910fb6505522df220123e8826b0ba9eb8956003e8dea7

      • C:\Users\Admin\AppData\Local\Temp\dxdiag.xml

        Filesize

        172KB

        MD5

        4cc5b5a08d76602b2c878bdbb5a91f3a

        SHA1

        4d2e3d539aa321077939724ece1fee2337ced3c9

        SHA256

        4eca901e03993c298beed88dbc95be88a715e0bbcfd840ab7b5dc82e5263f552

        SHA512

        bfad4ba4fc635ad5c0b444f0d62dc15ca9279ffa9bebcb81e69db7ba3bf2d5b8b40bc5cd55b391f576be2dd60d369f78c8f3d84ad2aac2dd813e3a139bae4d27

      • C:\Users\Admin\AppData\Local\Temp\iediag_makecab_directives.txt

        Filesize

        515B

        MD5

        14c148857af11ebcee263a2fb2b359ee

        SHA1

        710cb526ed69db7fdcc5da6b49241f70101e12fb

        SHA256

        810a37010bd4e6eed276310610dc4ebc7cc91535edf65e6ba6d9ed6edbe793ac

        SHA512

        d47ff7bdb40d518cf8daed410f29fea0f990457ed2da25ff2840a3bdcda77abe0b1b9948198a105a217fadbd4e4eed80fd0eb4338db7202892b9b4b910189e12

      • memory/948-5-0x00007FF8FA5E0000-0x00007FF8FB0A1000-memory.dmp

        Filesize

        10.8MB

      • memory/948-4-0x00007FF8FA5E0000-0x00007FF8FB0A1000-memory.dmp

        Filesize

        10.8MB

      • memory/948-6-0x00007FF8FA5E0000-0x00007FF8FB0A1000-memory.dmp

        Filesize

        10.8MB

      • memory/948-0-0x00007FF8FA5E3000-0x00007FF8FA5E5000-memory.dmp

        Filesize

        8KB

      • memory/948-92-0x000002271FF00000-0x0000022720657000-memory.dmp

        Filesize

        7.3MB

      • memory/948-93-0x00007FF8FA5E0000-0x00007FF8FB0A1000-memory.dmp

        Filesize

        10.8MB

      • memory/948-3-0x0000022720B70000-0x0000022720D32000-memory.dmp

        Filesize

        1.8MB

      • memory/948-37-0x00007FF8FA5E0000-0x00007FF8FB0A1000-memory.dmp

        Filesize

        10.8MB

      • memory/948-2-0x00007FF8FA5E0000-0x00007FF8FB0A1000-memory.dmp

        Filesize

        10.8MB

      • memory/948-41-0x00007FF8FA5E0000-0x00007FF8FB0A1000-memory.dmp

        Filesize

        10.8MB

      • memory/948-40-0x00007FF8FA5E0000-0x00007FF8FB0A1000-memory.dmp

        Filesize

        10.8MB

      • memory/948-39-0x000002271FF00000-0x0000022720657000-memory.dmp

        Filesize

        7.3MB

      • memory/948-38-0x00007FF8FA5E0000-0x00007FF8FB0A1000-memory.dmp

        Filesize

        10.8MB

      • memory/948-1-0x00007FF63A3D0000-0x00007FF63A454000-memory.dmp

        Filesize

        528KB

      • memory/948-35-0x0000022721270000-0x0000022721798000-memory.dmp

        Filesize

        5.2MB

      • memory/948-36-0x00007FF8FA5E3000-0x00007FF8FA5E5000-memory.dmp

        Filesize

        8KB

      • memory/2352-7-0x0000028749D20000-0x0000028749D21000-memory.dmp

        Filesize

        4KB

      • memory/2352-13-0x0000028749D20000-0x0000028749D21000-memory.dmp

        Filesize

        4KB

      • memory/2352-14-0x0000028749D20000-0x0000028749D21000-memory.dmp

        Filesize

        4KB

      • memory/2352-15-0x0000028749D20000-0x0000028749D21000-memory.dmp

        Filesize

        4KB

      • memory/2352-16-0x0000028749D20000-0x0000028749D21000-memory.dmp

        Filesize

        4KB

      • memory/2352-17-0x0000028749D20000-0x0000028749D21000-memory.dmp

        Filesize

        4KB

      • memory/2352-18-0x0000028749D20000-0x0000028749D21000-memory.dmp

        Filesize

        4KB

      • memory/2352-19-0x0000028749D20000-0x0000028749D21000-memory.dmp

        Filesize

        4KB

      • memory/2352-9-0x0000028749D20000-0x0000028749D21000-memory.dmp

        Filesize

        4KB

      • memory/2352-8-0x0000028749D20000-0x0000028749D21000-memory.dmp

        Filesize

        4KB