Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

5

Timrex Per.../1.exe

windows10-2004-x64

7

Timrex Per.../2.exe

windows10-2004-x64

7

Timrex Per.../3.exe

windows10-2004-x64

7

Timrex Per...rm.exe

windows10-2004-x64

6

Timrex Per...ls.bat

windows10-2004-x64

1

Timrex Per...n].bat

windows10-2004-x64

1

Timrex Per...gs.vbs

windows10-2004-x64

1

Timrex Per...ol.exe

windows10-2004-x64

5

Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250129-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/02/2025, 11:35

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Timrex Perm/Timrex Perm/Download this first/1.exe

  • Size

    24.2MB

  • MD5

    101b0b9f74cdc6cdbd2570bfe92e302c

  • SHA1

    2e6bae42c2842b4f558bd68099479b929bb7d910

  • SHA256

    4dfe83c91124cd542f4222fe2c396cabeac617bb6f59bdcbdf89fd6f0df0a32f

  • SHA512

    ccf4fd7da2c3440f1bc7fcac67c8a12599eab8d5c015affdc2e439fa30f5c7868ef5f52ede058361faae37ccc4af2c17c0adf30b8e1f852bb7106d0ec7162506

  • SSDEEP

    786432:urp+Ty2SfUfnbu+zMFy/7zYgWXRLTArzttOaaFC:Sp+Ty2SfWnPzMFO7zYgWBLbFC

Score
7/10
discoverypersistence

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 51 IoCs
  • Drops file in Windows directory 15 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 9 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\Timrex Perm\Timrex Perm\Download this first\1.exe
    "C:\Users\Admin\AppData\Local\Temp\Timrex Perm\Timrex Perm\Download this first\1.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4868
    • C:\Windows\Temp\{8030A98F-6FC5-4AA7-B093-DF7876D12CD4}\.cr\1.exe
      "C:\Windows\Temp\{8030A98F-6FC5-4AA7-B093-DF7876D12CD4}\.cr\1.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\Timrex Perm\Timrex Perm\Download this first\1.exe" -burn.filehandle.attached=536 -burn.filehandle.self=552
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:2916
      • C:\Windows\Temp\{9841B81D-D4E8-43AC-87E7-DCEE9423F1E9}\.be\VC_redist.x64.exe
        "C:\Windows\Temp\{9841B81D-D4E8-43AC-87E7-DCEE9423F1E9}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{E220D101-4F00-4C55-B99B-9BFCFA66145A} {7CC899BC-AD74-40D9-8527-B7B3928E2DE4} 2916
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3276
        • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
          "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={1de5e707-82da-4db6-b810-5d140cc4cbb3} -burn.filehandle.self=928 -burn.embedded BurnPipe.{0765EEDD-51C4-46B7-8795-CD7422449DA8} {1CC63A91-9AE6-4679-B90B-370D53E8CDAC} 3276
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4352
          • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
            "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=516 -burn.filehandle.self=536 -uninstall -quiet -burn.related.upgrade -burn.ancestors={1de5e707-82da-4db6-b810-5d140cc4cbb3} -burn.filehandle.self=928 -burn.embedded BurnPipe.{0765EEDD-51C4-46B7-8795-CD7422449DA8} {1CC63A91-9AE6-4679-B90B-370D53E8CDAC} 3276
            5⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1556
            • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
              "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{98389E12-6D5D-4FA5-AFD6-ADEC04B539AB} {6DD7075A-A3A9-4ABE-9279-81170072AD2B} 1556
              6⤵
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              PID:1604
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    PID:2040
  • C:\Windows\system32\srtasks.exe
    C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
    1⤵
      PID:4232
    • C:\Windows\system32\msiexec.exe
      C:\Windows\system32\msiexec.exe /V
      1⤵
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4388

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Config.Msi\e58222e.rbs
      Filesize

      19KB

      MD5

      44cb82bec62213bd8c511adcdb7eed38

      SHA1

      583dc02df1638b4e576596b786c724aab09a2735

      SHA256

      8d50bf7e64200611407dd7bbdbfdac2ae0729b7763e77e8c2ead17c39cb8dc59

      SHA512

      c88ad253af3484df0b832325f0962171ebbf5e3425c27e5663c58a3c1312ef51d5cf34faffd2b1328ed0285357908d79a15bf71461cf9e66025e019f086689e2

      Download Submit

    • C:\Config.Msi\e58223a.rbs
      Filesize

      19KB

      MD5

      342243e89f356a52e939be2d2d6a1427

      SHA1

      b44283a93d281de9ada054e29d342d31a75c5d48

      SHA256

      426da6c0513753c8736d019cfc76f802ce4aee5302d873db8369e29b0546816c

      SHA512

      d621084576a07a2b0f75da3c7336d906ab3e4afc104cc5f6aeae3fb1fc1c121bcdbe6a028b6f130bb13dc0cc2a370878d208af8bd588129bfb6aaf3b66a40c81

      Download Submit

    • C:\Config.Msi\e582241.rbs
      Filesize

      21KB

      MD5

      e5bd5ed5c96dc9724d51cb693690b474

      SHA1

      055c6064dc1e44cade4a677b67e843924f19f5cd

      SHA256

      bd832354ff2c6fa2461c8b0da4e1c794ba1d7178c852caac1c4b43b6c564dcbb

      SHA512

      caa58a19b5f90e2c1bda9eb25c5cfbce543459a602c6671a771f29c6c19fab14da7e6380052d088a718c7e10697b0788e94268645d933deef551b921ac2261d8

      Download Submit

    • C:\Config.Msi\e582250.rbs
      Filesize

      21KB

      MD5

      58e568d834a1a74c367cc4901ffa34aa

      SHA1

      c6dc3a3c7ce209508a97951c3774444f6cbb4adf

      SHA256

      77d8929734817a372c931f3830e867347484343085e7d98218ed29fc7b12efad

      SHA512

      018370812defb67c96b632c0d168bec80c6a685a30def7ce5d2138be981f6b07052daccf3000bf804fa39172d80ae9be86f52f79d6449199ffe0b9b5f464e33a

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20250201113636_000_vcRuntimeMinimum_x64.log
      Filesize

      2KB

      MD5

      8a0989284b29ea3e6f367c0ff76e60e7

      SHA1

      767a21e78333c4687d1d60d6a0b41f508c39be4a

      SHA256

      13eb87f03c575e63b8f44f84a6b56f8e7e767adc4ee0d8e9de1b215db24265ad

      SHA512

      646d4d3b785e2c5a571736482176a1302e2ef6a5d555d826c906f2eafd69f0e85f34b77d6129ed5777576284adbbc88bde1f29cb2c63042f1c8d4c54059a0a29

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20250201113636_001_vcRuntimeAdditional_x64.log
      Filesize

      2KB

      MD5

      c3c99c15ae2cbdb5cd17860e7dc142a9

      SHA1

      2063d930b594a7cd093440906712cece87d9becd

      SHA256

      e68898a54226b99e743dbbdc3f76b6c2c99fec85e9070e3ea87039bd70e1fecd

      SHA512

      9a847685a31d2b3ae067e9da2b0c42eef43b4628d7f37f8ff3e5fa57d7600b290987d1307bb4e5b4900dd500339199ffa2f079623b128abad07fc899ebcc8ac8

      Download Submit

    • C:\Windows\Temp\{8030A98F-6FC5-4AA7-B093-DF7876D12CD4}\.cr\1.exe
      Filesize

      635KB

      MD5

      53e9222bc438cbd8b7320f800bef2e78

      SHA1

      c4f295d8855b4b16c7450a4a9150eb95046f6390

      SHA256

      0e49026767420229afd23b1352cf9f97f24e0768c3d527000d449ffdb4ca6888

      SHA512

      7533f9791e1807072a4dbb6ca03c696b12dfa5337678fab53aceea0e4b7e5ffefb90c9b450ac80878e1e9a4bce549f619da4cd2d06eb2554c9add5b4ec838b4a

      Download Submit

    • C:\Windows\Temp\{9841B81D-D4E8-43AC-87E7-DCEE9423F1E9}\.ba\logo.png
      Filesize

      1KB

      MD5

      d6bd210f227442b3362493d046cea233

      SHA1

      ff286ac8370fc655aea0ef35e9cf0bfcb6d698de

      SHA256

      335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef

      SHA512

      464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b

      Download Submit

    • C:\Windows\Temp\{9841B81D-D4E8-43AC-87E7-DCEE9423F1E9}\.ba\wixstdba.dll
      Filesize

      191KB

      MD5

      eab9caf4277829abdf6223ec1efa0edd

      SHA1

      74862ecf349a9bedd32699f2a7a4e00b4727543d

      SHA256

      a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041

      SHA512

      45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2

      Download Submit

    • C:\Windows\Temp\{9841B81D-D4E8-43AC-87E7-DCEE9423F1E9}\cab2C04DDC374BD96EB5C8EB8208F2C7C92
      Filesize

      5.4MB

      MD5

      e181a4fd7fc6a5a35d355efccb2c02d2

      SHA1

      762ded20d790e9342119f7578a4453ac512a0285

      SHA256

      e792f561821e193991fcc0c98038f0b0b905b0b0c67b55aaa1040d18652c6225

      SHA512

      8a8f04f5a044cfd126da9fafbdc86e74c7dc1624b241ed527e11bcdc389b8d9756c9fa6217b220e9aa49fb604285d8fb8c0dead91a7e456937e8b474000e32fe

      Download Submit

    • C:\Windows\Temp\{9841B81D-D4E8-43AC-87E7-DCEE9423F1E9}\cab5046A8AB272BF37297BB7928664C9503
      Filesize

      958KB

      MD5

      b9c44fa1b63f24db5f63e4d5992428bc

      SHA1

      4b6b0db14c7444009b71a20cba406b27a03edaac

      SHA256

      dc862c89bccaeeb3b7ae04895377a6156dd81e0e1ff460b692f6cec51b865f4f

      SHA512

      0ce0612d528a237691d860c11a6f37555185871e80667a99ef23229496c87ddfeba13ef492eb330f3a75206e645e683617ff9d3b2a756d544af4d34ee8e3cd46

      Download Submit

    • C:\Windows\Temp\{9841B81D-D4E8-43AC-87E7-DCEE9423F1E9}\vcRuntimeAdditional_x64
      Filesize

      188KB

      MD5

      ea980cf567e11691d1e4476eb46cf0b9

      SHA1

      a0520000ad102411c041fc44e333fa298e72b38f

      SHA256

      98c9604efcba36d02387a570ddf9697951fb8f625c5ce2471a2d4a573e962d23

      SHA512

      b07184932de406cc1df8ae3599d0418211f3b3f40711f743aa7534d06757794aa9f1b61f6b7fa85cd604f5e6eca7d08a04ec2d2c78c80fff5bdec2b772f5656d

      Download Submit

    • C:\Windows\Temp\{9841B81D-D4E8-43AC-87E7-DCEE9423F1E9}\vcRuntimeMinimum_x64
      Filesize

      188KB

      MD5

      cde169db3e6657e49a923413bec65774

      SHA1

      6c57b389c08a0a3bd3c8919c2b546fb9e1ea7003

      SHA256

      6cf659c5d73f2ce102b60a64f820f57d598efbfb1e1a0f393a5df7f11bbc35c3

      SHA512

      d32b32ec275ea7befe7c63977cd300887bc88460d56c4fb848447c87006ead29fdb41c60688186d18bfac6ff6f0c8a441d1fb91765a4fda93824d4b61a4ae627

      Download Submit

    • memory/1556-236-0x0000000000F40000-0x0000000000FB7000-memory.dmp

      Filesize

      476KB

      Download

    • memory/1604-199-0x0000000000F40000-0x0000000000FB7000-memory.dmp

      Filesize

      476KB

      Download

    • memory/4352-237-0x0000000000F40000-0x0000000000FB7000-memory.dmp

      Filesize

      476KB

      Download