Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    286s
  • max time network
    287s
  • platform
    windows10-ltsc 2021_x64
  • resource
    win10ltsc2021-20250113-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20250113-enlocale:en-usos:windows10-ltsc 2021-x64system
  • submitted
    20/01/2025, 17:33

General

  • Target

    winrar-x64-701.exe

  • Size

    3.8MB

  • MD5

    46c17c999744470b689331f41eab7df1

  • SHA1

    b8a63127df6a87d333061c622220d6d70ed80f7c

  • SHA256

    c5b5def1c8882b702b6b25cbd94461c737bc151366d2d9eba5006c04886bfc9a

  • SHA512

    4b02a3e85b699f62df1b4fe752c4dee08cfabc9b8bb316bc39b854bd5187fc602943a95788ec680c7d3dc2c26ad882e69c0740294bd6cb3b32cdcd165a9441b6

  • SSDEEP

    98304:6NRBOBfKgQIm9EOTqw8vjh9Ac9nUNupK4hVvcF+yHrAr:sR/gmeOqv7Ac9F0kB

Score
6/10

Malware Config

Signatures

  • Downloads MZ/PE file
  • Executes dropped EXE 1 IoCs
  • Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

    When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 23 IoCs
  • Suspicious use of SendNotifyMessage 22 IoCs
  • Suspicious use of SetWindowsHookEx 9 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\winrar-x64-701.exe
    "C:\Users\Admin\AppData\Local\Temp\winrar-x64-701.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4452
  • C:\Windows\system32\werfault.exe
    werfault.exe /h /shared Global\3ce64afcace74813ad0a0a19680f3cd8 /t 3092 /p 4452
    1⤵
      PID:1360
    • C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe"
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:60
      • C:\Program Files\Mozilla Firefox\firefox.exe
        "C:\Program Files\Mozilla Firefox\firefox.exe"
        2⤵
        • Subvert Trust Controls: Mark-of-the-Web Bypass
        • Checks processor information in registry
        • Modifies registry class
        • NTFS ADS
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1792
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2004 -parentBuildID 20240401114208 -prefsHandle 1920 -prefMapHandle 1912 -prefsLen 27137 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {90c96dde-eaef-4576-822d-8a12531ea924} 1792 "\\.\pipe\gecko-crash-server-pipe.1792" gpu
          3⤵
            PID:3764
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2412 -parentBuildID 20240401114208 -prefsHandle 2404 -prefMapHandle 2400 -prefsLen 27015 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {05e647cb-3419-4ace-99ed-3d2cf80da54b} 1792 "\\.\pipe\gecko-crash-server-pipe.1792" socket
            3⤵
              PID:3008
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2952 -childID 1 -isForBrowser -prefsHandle 2912 -prefMapHandle 3208 -prefsLen 22698 -prefMapSize 244658 -jsInitHandle 1248 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f6455ed0-069c-4dfb-978b-ef58102de77d} 1792 "\\.\pipe\gecko-crash-server-pipe.1792" tab
              3⤵
                PID:3624
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3964 -childID 2 -isForBrowser -prefsHandle 3956 -prefMapHandle 3948 -prefsLen 32389 -prefMapSize 244658 -jsInitHandle 1248 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5fa00305-a856-49ef-8a5e-fda08a65820d} 1792 "\\.\pipe\gecko-crash-server-pipe.1792" tab
                3⤵
                  PID:764
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4740 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4716 -prefMapHandle 4632 -prefsLen 32389 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {85646163-a1c4-41fc-b0a2-9534bc359ce7} 1792 "\\.\pipe\gecko-crash-server-pipe.1792" utility
                  3⤵
                  • Checks processor information in registry
                  PID:3000
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5304 -childID 3 -isForBrowser -prefsHandle 5284 -prefMapHandle 5292 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 1248 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4a00ab18-2ecb-4c20-8a14-61374c3cdd09} 1792 "\\.\pipe\gecko-crash-server-pipe.1792" tab
                  3⤵
                    PID:3092
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5436 -childID 4 -isForBrowser -prefsHandle 5456 -prefMapHandle 5444 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 1248 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {765719d7-6f59-42a1-ad51-6ab2f8eda667} 1792 "\\.\pipe\gecko-crash-server-pipe.1792" tab
                    3⤵
                      PID:4240
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5248 -childID 5 -isForBrowser -prefsHandle 5620 -prefMapHandle 5516 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 1248 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f05797ce-bd98-4d36-b087-c5999ecc6888} 1792 "\\.\pipe\gecko-crash-server-pipe.1792" tab
                      3⤵
                        PID:4728
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6056 -childID 6 -isForBrowser -prefsHandle 6044 -prefMapHandle 6052 -prefsLen 27257 -prefMapSize 244658 -jsInitHandle 1248 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2cc14cbb-a30a-4b1d-866a-94f59689daae} 1792 "\\.\pipe\gecko-crash-server-pipe.1792" tab
                        3⤵
                          PID:2056
                        • C:\Users\Admin\Downloads\winrar-x64-701.exe
                          "C:\Users\Admin\Downloads\winrar-x64-701.exe"
                          3⤵
                          • Executes dropped EXE
                          • Suspicious use of SetWindowsHookEx
                          PID:664

                    Network

                    MITRE ATT&CK Enterprise v15

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\vwhe4aqp.default-release\activity-stream.discovery_stream.json

                      Filesize

                      25KB

                      MD5

                      b65036408430b685283cd425fbba191f

                      SHA1

                      4da137ba0890a04a4aef30d8f42590d438880641

                      SHA256

                      ed4ab04c1b245eb5c43a262f9b262010f3f77c0cbf07cb663ff8a2f918cf3dde

                      SHA512

                      ded4e1f9b93533c3e80ac53211f902c4b8a06a3d4bb5334fb5827af559b8987f304e8258809bace2671381062f4f699802e68adbaf094ba97bbc63364ff9f1a0

                    • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                      Filesize

                      479KB

                      MD5

                      09372174e83dbbf696ee732fd2e875bb

                      SHA1

                      ba360186ba650a769f9303f48b7200fb5eaccee1

                      SHA256

                      c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                      SHA512

                      b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                    • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                      Filesize

                      13.8MB

                      MD5

                      0a8747a2ac9ac08ae9508f36c6d75692

                      SHA1

                      b287a96fd6cc12433adb42193dfe06111c38eaf0

                      SHA256

                      32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                      SHA512

                      59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vwhe4aqp.default-release\AlternateServices.bin

                      Filesize

                      8KB

                      MD5

                      6e790ffb8178bb54cceede8b95ee526a

                      SHA1

                      c0845f848dc87b9406fd052848893196981745f1

                      SHA256

                      2ce842fd288d6fb58ba122cc48f662c93962d3658836e970f3fdf445786bdaae

                      SHA512

                      c22d0cdcfea45fa636b0dd044e989686c6e41942ccce823dfd328fdb188e19d320917a75ca7a41f1074f4464a9cc173ad3190ac7bda162e6f6a7b05e8cbb7fcd

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vwhe4aqp.default-release\datareporting\glean\db\data.safe.tmp

                      Filesize

                      5KB

                      MD5

                      de5788bab9e23303b435eb7c84ec5c09

                      SHA1

                      080fdd1fea2c54fbb4b2a3d07070fb0d7216afba

                      SHA256

                      c15a44936d909d2aa7c700a466ddedde6ffc1bf3afe14f1c61fa88bb57cf197e

                      SHA512

                      7839adf4d9b8e68c292b87fb88d57b49a2e3f03b13ec2e0ae872923e96f4fc1aa3e7e4eee7dd681160cc8954cb7dab9111ed9de7c0111c2acd49730e3262d612

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vwhe4aqp.default-release\datareporting\glean\db\data.safe.tmp

                      Filesize

                      7KB

                      MD5

                      4923a969a2151ca61c90da9a185979bc

                      SHA1

                      4225cb9cce72bf20f6ee7fafc011942c6624de63

                      SHA256

                      f2d45e228ccbd66595c260523c42ba5c3be959f388b2489dd907f49fbaf9c4b7

                      SHA512

                      efefece4485bc7b498cc69968805112b8a1bee584c44f0a55fd34a0af7320e77b84da58b589d2c864f2e82f52406646dde355ffc90ae8604b4f9b4ef7507c782

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vwhe4aqp.default-release\datareporting\glean\pending_pings\c6980b37-2457-4c5d-9768-d18d7d520f4a

                      Filesize

                      671B

                      MD5

                      a7f8f5af08ed67a9ea077dbc08f307bf

                      SHA1

                      4093dcb61857604282434b855f71b5ccc33bdf2d

                      SHA256

                      6093ebe180214ee62cb18c4eb888cd5a951ca8be8d0f23448e9c0518fbc21f55

                      SHA512

                      6fbe8ab75cdae4384e3b95b80db37bd4e9bc90326056f7131edb03151ef5438314bb933932e3228fbb0eb38fea275af45685f42f665378f79b7e06df87abca62

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vwhe4aqp.default-release\datareporting\glean\pending_pings\ce30c861-f2c4-4368-bcaf-44eaaacfcac4

                      Filesize

                      982B

                      MD5

                      9083a480757297be53ccbfbfc8bdf368

                      SHA1

                      4d102ae4139138abafb74f18172ebe38c2aa35ea

                      SHA256

                      b314d11266932943d53dd040a1e8d7d795f191b7c7fb9c2354e2e22947664a72

                      SHA512

                      bdf024ff2afc62e0792a11acf89b1156d3a83233fd4ea8af008b20d017aed35f6340fba3b089e0753703795019814a7a285d69beac218a6c9528afe9960f9cbe

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vwhe4aqp.default-release\datareporting\glean\pending_pings\fd148d3a-023e-432a-acf3-e9f694d0bc06

                      Filesize

                      26KB

                      MD5

                      f3c5b20559efd57bc1f93f9ed6e8b197

                      SHA1

                      4e9ac059c4edce10bde7fe5ace7bc9bcef8373dc

                      SHA256

                      d797688e2326a770acc387ca95861a800718f4b29b878815dc141edf60b6226a

                      SHA512

                      7b447751cfe5c803a194cb11d99cae9959e693803d56ea49b7fda1baa63db8d0bc07601c56e62aae0284e143abfbe5ceaf8beaec8ebc717fcd2035a249f43d1f

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vwhe4aqp.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

                      Filesize

                      1.1MB

                      MD5

                      842039753bf41fa5e11b3a1383061a87

                      SHA1

                      3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                      SHA256

                      d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                      SHA512

                      d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vwhe4aqp.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

                      Filesize

                      116B

                      MD5

                      2a461e9eb87fd1955cea740a3444ee7a

                      SHA1

                      b10755914c713f5a4677494dbe8a686ed458c3c5

                      SHA256

                      4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                      SHA512

                      34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vwhe4aqp.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

                      Filesize

                      372B

                      MD5

                      bf957ad58b55f64219ab3f793e374316

                      SHA1

                      a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                      SHA256

                      bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                      SHA512

                      79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vwhe4aqp.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

                      Filesize

                      17.8MB

                      MD5

                      daf7ef3acccab478aaa7d6dc1c60f865

                      SHA1

                      f8246162b97ce4a945feced27b6ea114366ff2ad

                      SHA256

                      bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                      SHA512

                      5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vwhe4aqp.default-release\prefs-1.js

                      Filesize

                      9KB

                      MD5

                      e4513018ee803ebb70af7c93f536fa04

                      SHA1

                      4dd84d1ee093dbd83b946b5ab2adb5d6f46af9ff

                      SHA256

                      10164a4b2c0d9278d800f8dd6108c4a46561c6d0c29c3f3c9ce4e81b50499148

                      SHA512

                      6d0aa8b33e3a5896a4ee63b74a113faaab390f66b84b6bb823ca701f0e7a913b854f3f78945043ad2c2fc94c3ff7bfa152008075691cd254fc8226466c5f88bf

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vwhe4aqp.default-release\prefs.js

                      Filesize

                      9KB

                      MD5

                      25e281e6c768888b86f262eb34023808

                      SHA1

                      70e0e8c3462a687e430b8d4f865557a0015e56ea

                      SHA256

                      f5da8045ed9eea7379be3f762a25ff2665e67150b2f482e9654ebcae46469aac

                      SHA512

                      7120fe1191fc39554c8852a246f6b900138cfba181f17dfb7abf4ffb62fc6e9dff0739cc901e60fdd50d5a7183df5ffc2a4ea0f67a3ca17dcbda58834994a01a

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vwhe4aqp.default-release\prefs.js

                      Filesize

                      9KB

                      MD5

                      c0535bb5d9247d7925a924eb7a03346b

                      SHA1

                      8407cc26d4adc4401c68bc67f4f2edfe69754369

                      SHA256

                      331ade0be9bef7af5daa0ab36f88ca543b9c3a590775b1ffccf7925076b7a335

                      SHA512

                      808e24bc111cd8674bf87b464ad928dd0282e0cfadb5050972f01353eb1ac352c559033567244e5a1608c81bd3e48001f1482f7c40ad7c8505c5d11ce8e852e3

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vwhe4aqp.default-release\prefs.js

                      Filesize

                      10KB

                      MD5

                      e21cff65affe10330ef7b2a757046b62

                      SHA1

                      5c7c37656ab4bf2a836f9e3a53566aee7d2f003e

                      SHA256

                      da782aeb6ec3d2030ca93dd90ce46499b51c607b54160432a613bd1e62832d17

                      SHA512

                      fc179fe7dab8c4cad339d53279ab2f569258579b8f24ca1920cebd138f320b27e54730386e083c20bc94e7d87031a8b48747f3aaf98b0dde1411bebd1caa8a6f

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vwhe4aqp.default-release\sessionstore-backups\recovery.baklz4

                      Filesize

                      17KB

                      MD5

                      5f75634d3e71eef1c674bdae61b78e01

                      SHA1

                      dff15decb5f8424b9f5535590d63e2a3b73d25bf

                      SHA256

                      bcfbc75c20b467391c6d270bd1b8f6ab0e74701dc2e4ee3adcbc63a96535748e

                      SHA512

                      92ba8ab926b0dbc815d5e3c2b7b1aa2629a3abaebac90cbaae24780536e1f27969fe39d969301433017caf30ea8ee5ce79e8421e8895c167d6fd5a04279b09ef

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vwhe4aqp.default-release\sessionstore-backups\recovery.baklz4

                      Filesize

                      14KB

                      MD5

                      04975f919e9505f4c905c07e2bd077c5

                      SHA1

                      b4a2488ac80f09f31934d0fb8c06e860ca8af998

                      SHA256

                      3eb5c0e809f2970912de0fb79d14e7697630db7a7653a8c30635dc8c591f6f0d

                      SHA512

                      dfded735404fb46691071f7e3c52da77b61b21d1693f23d44d01414f4bbb541b83648d367015c61cb6a1b0cbb169fd3688809eccede413f9682ec96ea2acf3f2

                    • C:\Users\Admin\Downloads\winrar-x64-701.OVrus-Xx.exe.part

                      Filesize

                      3.8MB

                      MD5

                      46c17c999744470b689331f41eab7df1

                      SHA1

                      b8a63127df6a87d333061c622220d6d70ed80f7c

                      SHA256

                      c5b5def1c8882b702b6b25cbd94461c737bc151366d2d9eba5006c04886bfc9a

                      SHA512

                      4b02a3e85b699f62df1b4fe752c4dee08cfabc9b8bb316bc39b854bd5187fc602943a95788ec680c7d3dc2c26ad882e69c0740294bd6cb3b32cdcd165a9441b6