Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
03/10/2022, 13:37
Static task
static1
Behavioral task
behavioral1
Sample
c2c12f037eaed386f44de67d0aa4a6c9ebce4cf884f51711f5774d630f59b639.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
c2c12f037eaed386f44de67d0aa4a6c9ebce4cf884f51711f5774d630f59b639.exe
Resource
win10v2004-20220901-en
General
-
Target
c2c12f037eaed386f44de67d0aa4a6c9ebce4cf884f51711f5774d630f59b639.exe
-
Size
909KB
-
MD5
49d7aa485f5bc619fab70018135fe746
-
SHA1
35d6bc56d95159fa0b2052d3476433c4eb44915b
-
SHA256
c2c12f037eaed386f44de67d0aa4a6c9ebce4cf884f51711f5774d630f59b639
-
SHA512
30c7d79ff9000b55f300a0cef99433f11cdd2468903ae9892f482c0224891a9eca8cf0cec03b23889488c95e0ef74d686d65622c71f6a89321d50c925b22f8a8
-
SSDEEP
3072:ngv9bqpaMausTDYBh7SYmdULiiLnEKhf0TTE5jk/RtRlHAkAtzfKtLy8YFqhctm5:KZu5Zh7ydGnEIjagkAtzuNcdtxEUvLIT
Malware Config
Signatures
-
Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run c2c12f037eaed386f44de67d0aa4a6c9ebce4cf884f51711f5774d630f59b639.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\onviwmi = "C:\\Windows\\SysWOW64\\eudceditg.exe" c2c12f037eaed386f44de67d0aa4a6c9ebce4cf884f51711f5774d630f59b639.exe -
Executes dropped EXE 1 IoCs
pid Process 3496 eudceditg.exe -
resource yara_rule behavioral2/memory/4324-134-0x00000000021F0000-0x00000000022A1000-memory.dmp upx behavioral2/memory/4324-137-0x00000000021F0000-0x00000000022A1000-memory.dmp upx behavioral2/memory/4324-138-0x00000000021F0000-0x00000000022A1000-memory.dmp upx -
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion c2c12f037eaed386f44de67d0aa4a6c9ebce4cf884f51711f5774d630f59b639.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA c2c12f037eaed386f44de67d0aa4a6c9ebce4cf884f51711f5774d630f59b639.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\eudceditg.exe c2c12f037eaed386f44de67d0aa4a6c9ebce4cf884f51711f5774d630f59b639.exe File opened for modification C:\Windows\SysWOW64\eudceditg.exe c2c12f037eaed386f44de67d0aa4a6c9ebce4cf884f51711f5774d630f59b639.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4324 c2c12f037eaed386f44de67d0aa4a6c9ebce4cf884f51711f5774d630f59b639.exe 4324 c2c12f037eaed386f44de67d0aa4a6c9ebce4cf884f51711f5774d630f59b639.exe 4324 c2c12f037eaed386f44de67d0aa4a6c9ebce4cf884f51711f5774d630f59b639.exe 4324 c2c12f037eaed386f44de67d0aa4a6c9ebce4cf884f51711f5774d630f59b639.exe 3496 eudceditg.exe 3496 eudceditg.exe 3496 eudceditg.exe 3496 eudceditg.exe 3496 eudceditg.exe 3496 eudceditg.exe 3496 eudceditg.exe 3496 eudceditg.exe 3496 eudceditg.exe 3496 eudceditg.exe 3496 eudceditg.exe 3496 eudceditg.exe 3496 eudceditg.exe 3496 eudceditg.exe 3496 eudceditg.exe 3496 eudceditg.exe 3496 eudceditg.exe 3496 eudceditg.exe 3496 eudceditg.exe 3496 eudceditg.exe 3496 eudceditg.exe 3496 eudceditg.exe 3496 eudceditg.exe 3496 eudceditg.exe 3496 eudceditg.exe 3496 eudceditg.exe 3496 eudceditg.exe 3496 eudceditg.exe 3496 eudceditg.exe 3496 eudceditg.exe 3496 eudceditg.exe 3496 eudceditg.exe 3496 eudceditg.exe 3496 eudceditg.exe 3496 eudceditg.exe 3496 eudceditg.exe 3496 eudceditg.exe 3496 eudceditg.exe 3496 eudceditg.exe 3496 eudceditg.exe 3496 eudceditg.exe 3496 eudceditg.exe 3496 eudceditg.exe 3496 eudceditg.exe 3496 eudceditg.exe 3496 eudceditg.exe 3496 eudceditg.exe 3496 eudceditg.exe 3496 eudceditg.exe 3496 eudceditg.exe 3496 eudceditg.exe 3496 eudceditg.exe 3496 eudceditg.exe 3496 eudceditg.exe 3496 eudceditg.exe 3496 eudceditg.exe 3496 eudceditg.exe 3496 eudceditg.exe 3496 eudceditg.exe 3496 eudceditg.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4324 c2c12f037eaed386f44de67d0aa4a6c9ebce4cf884f51711f5774d630f59b639.exe Token: SeDebugPrivilege 3496 eudceditg.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4324 wrote to memory of 3496 4324 c2c12f037eaed386f44de67d0aa4a6c9ebce4cf884f51711f5774d630f59b639.exe 92 PID 4324 wrote to memory of 3496 4324 c2c12f037eaed386f44de67d0aa4a6c9ebce4cf884f51711f5774d630f59b639.exe 92 PID 4324 wrote to memory of 3496 4324 c2c12f037eaed386f44de67d0aa4a6c9ebce4cf884f51711f5774d630f59b639.exe 92 PID 4324 wrote to memory of 4596 4324 c2c12f037eaed386f44de67d0aa4a6c9ebce4cf884f51711f5774d630f59b639.exe 94 PID 4324 wrote to memory of 4596 4324 c2c12f037eaed386f44de67d0aa4a6c9ebce4cf884f51711f5774d630f59b639.exe 94 PID 4324 wrote to memory of 4596 4324 c2c12f037eaed386f44de67d0aa4a6c9ebce4cf884f51711f5774d630f59b639.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\c2c12f037eaed386f44de67d0aa4a6c9ebce4cf884f51711f5774d630f59b639.exe"C:\Users\Admin\AppData\Local\Temp\c2c12f037eaed386f44de67d0aa4a6c9ebce4cf884f51711f5774d630f59b639.exe"1⤵
- Adds policy Run key to start application
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Windows\SysWOW64\eudceditg.exeC:\Windows\SysWOW64\eudceditg.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3496
-
-
C:\Windows\SysWOW64\cmd.exe/c C:\Users\Admin\AppData\Local\Temp\~unins1189.bat "C:\Users\Admin\AppData\Local\Temp\c2c12f037eaed386f44de67d0aa4a6c9ebce4cf884f51711f5774d630f59b639.exe"2⤵PID:4596
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
49B
MD59e0a2f5ab30517809b95a1ff1dd98c53
SHA15c1eefdf10e67d1e9216e2e3f5e92352d583c9ce
SHA25697ac9fee75a1f7b63b3115e9c4fb9dda80b1caba26d2fb51325670dee261fe32
SHA512e959cc1fd48fb1cccf135a697924c775a3812bab211fc7f9b00c5a9d617261d84c5d6f7cb548774c1e8f46811b06ca39c5603d0e10cbcb7b805f9abbe49b9b42
-
Filesize
206KB
MD5104b2719ab3feffe10e606063f77bc08
SHA15f80d2a57c2faa0b36cffe8a0f39e285faf1644a
SHA256c0a9fb84c2216200d999316217404849d58328d2af30b9e7f41793f71c6ced44
SHA512f17944ed0133fdb7d268c45818166c59186ee13c93013147bd2fa367cc3620ea01884c25e1f3dea9aa63e89e87d2176b0961ec403f1b107c6ed4fbd2b7355b2c
-
Filesize
206KB
MD5104b2719ab3feffe10e606063f77bc08
SHA15f80d2a57c2faa0b36cffe8a0f39e285faf1644a
SHA256c0a9fb84c2216200d999316217404849d58328d2af30b9e7f41793f71c6ced44
SHA512f17944ed0133fdb7d268c45818166c59186ee13c93013147bd2fa367cc3620ea01884c25e1f3dea9aa63e89e87d2176b0961ec403f1b107c6ed4fbd2b7355b2c