Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
04/10/2022, 03:15
Static task
static1
Behavioral task
behavioral1
Sample
e80aa4d7b4ead644f3e9b9a17a0683ebcb72bc852c6c034fb0ea23a08fa61a44.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
e80aa4d7b4ead644f3e9b9a17a0683ebcb72bc852c6c034fb0ea23a08fa61a44.exe
Resource
win10v2004-20220901-en
General
-
Target
e80aa4d7b4ead644f3e9b9a17a0683ebcb72bc852c6c034fb0ea23a08fa61a44.exe
-
Size
224KB
-
MD5
062ca31f5d11475347946477852f9f23
-
SHA1
81970f88ddf11ee144ba368ec4e44f352e5139fe
-
SHA256
e80aa4d7b4ead644f3e9b9a17a0683ebcb72bc852c6c034fb0ea23a08fa61a44
-
SHA512
ec8011f16c5973d1352c8f6b302b3eb6af093a3ab67b9d953a7d4797f43dfcc4dbf89b26ba683e7fa3a349fb4d2b863a37218c9e7904d5e4915e57dc44726b9e
-
SSDEEP
6144:Io/3Nr7Zjsx8Is2EXbIh0HY2yp2IVVhc0Ru3MtyBb+:Io/9rxUJs2ELIeolc6uqma
Malware Config
Signatures
-
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion e80aa4d7b4ead644f3e9b9a17a0683ebcb72bc852c6c034fb0ea23a08fa61a44.exe -
Modifies WinLogon 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\e8264342 = "Kƒ±M&eÒk\fÈÑå£\x0e\x1c‰\x18yé)†\tMÄ?š\x0f´V)-µ¸…ˆJ‚!\x17i5÷7aдáû‰\x1dTÉ\u00a0¬øñ\x149GË@.\x0eK\x03×›ä…߸®Àõ”Æ0\x03ö\x16ŽÛk!8”ç½Ô\x05\rF\x1cƒA¼ñšn»• ˜•Hò\x15 ¢\x10Ê\x168ÖÖM\u009de\x1d.eHíuÝX-Тµh%¦¥¥p’=Ö\b\x1aõÈеÅP¥\u00ad\u009d5\"\u00adªØ\u009d\x1d\u00adžh\x105¾H `-ÚM\x05P\ne*\x05Àå\u008d™Ù\nnÀ:=%¦u]1¦n¨\nµn&rÕ`J¡µå\u00adjFa½N°à:•¦J0€uX\x06-%]EµM]m\x065¸\x10€˜ÉÅ-=a€ª\u009d^hh….zø©\x11¥¶Ðµ0\u0081¸ª" e80aa4d7b4ead644f3e9b9a17a0683ebcb72bc852c6c034fb0ea23a08fa61a44.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeSecurityPrivilege 4768 e80aa4d7b4ead644f3e9b9a17a0683ebcb72bc852c6c034fb0ea23a08fa61a44.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e80aa4d7b4ead644f3e9b9a17a0683ebcb72bc852c6c034fb0ea23a08fa61a44.exe"C:\Users\Admin\AppData\Local\Temp\e80aa4d7b4ead644f3e9b9a17a0683ebcb72bc852c6c034fb0ea23a08fa61a44.exe"1⤵
- Checks BIOS information in registry
- Modifies WinLogon
- Suspicious use of AdjustPrivilegeToken
PID:4768