Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
152s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
06/11/2022, 09:09
Static task
static1
Behavioral task
behavioral1
Sample
3ed14e41859c151c8db0c9b6653d0c1e35f90cfc68ec1333f5a569292814b6a6.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
3ed14e41859c151c8db0c9b6653d0c1e35f90cfc68ec1333f5a569292814b6a6.exe
Resource
win10v2004-20220901-en
General
-
Target
3ed14e41859c151c8db0c9b6653d0c1e35f90cfc68ec1333f5a569292814b6a6.exe
-
Size
1015KB
-
MD5
211aa37fead0732dc4cae273cd3a7131
-
SHA1
3b0ba1d60f6f373d247b24ae95b86afa1b0407e0
-
SHA256
3ed14e41859c151c8db0c9b6653d0c1e35f90cfc68ec1333f5a569292814b6a6
-
SHA512
753859095e660b7cf5509b3b67966deddfe621e655c5b544ef22bc13407ec1cae8ab3884f9bc138747182cf0443c3d01c12cee36da0dee2bf7adab1bf755dbf9
-
SSDEEP
12288:We788oVf9pKHaLZj/RVLjC/+p/ekLjw4p0V8hu:j87Vb0aNjfLNptjpE
Malware Config
Signatures
-
Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 3ed14e41859c151c8db0c9b6653d0c1e35f90cfc68ec1333f5a569292814b6a6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\jrzbp = "C:\\Windows\\SysWOW64\\srchadmini.exe" 3ed14e41859c151c8db0c9b6653d0c1e35f90cfc68ec1333f5a569292814b6a6.exe -
Executes dropped EXE 1 IoCs
pid Process 2248 srchadmini.exe -
resource yara_rule behavioral2/memory/3068-133-0x00000000021A0000-0x000000000225D000-memory.dmp upx behavioral2/memory/3068-137-0x00000000021A0000-0x000000000225D000-memory.dmp upx behavioral2/memory/3068-138-0x00000000021A0000-0x000000000225D000-memory.dmp upx -
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 3ed14e41859c151c8db0c9b6653d0c1e35f90cfc68ec1333f5a569292814b6a6.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 3ed14e41859c151c8db0c9b6653d0c1e35f90cfc68ec1333f5a569292814b6a6.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\srchadmini.exe 3ed14e41859c151c8db0c9b6653d0c1e35f90cfc68ec1333f5a569292814b6a6.exe File opened for modification C:\Windows\SysWOW64\srchadmini.exe 3ed14e41859c151c8db0c9b6653d0c1e35f90cfc68ec1333f5a569292814b6a6.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3068 3ed14e41859c151c8db0c9b6653d0c1e35f90cfc68ec1333f5a569292814b6a6.exe 3068 3ed14e41859c151c8db0c9b6653d0c1e35f90cfc68ec1333f5a569292814b6a6.exe 3068 3ed14e41859c151c8db0c9b6653d0c1e35f90cfc68ec1333f5a569292814b6a6.exe 3068 3ed14e41859c151c8db0c9b6653d0c1e35f90cfc68ec1333f5a569292814b6a6.exe 2248 srchadmini.exe 2248 srchadmini.exe 2248 srchadmini.exe 2248 srchadmini.exe 2248 srchadmini.exe 2248 srchadmini.exe 2248 srchadmini.exe 2248 srchadmini.exe 2248 srchadmini.exe 2248 srchadmini.exe 2248 srchadmini.exe 2248 srchadmini.exe 2248 srchadmini.exe 2248 srchadmini.exe 2248 srchadmini.exe 2248 srchadmini.exe 2248 srchadmini.exe 2248 srchadmini.exe 2248 srchadmini.exe 2248 srchadmini.exe 2248 srchadmini.exe 2248 srchadmini.exe 2248 srchadmini.exe 2248 srchadmini.exe 2248 srchadmini.exe 2248 srchadmini.exe 2248 srchadmini.exe 2248 srchadmini.exe 2248 srchadmini.exe 2248 srchadmini.exe 2248 srchadmini.exe 2248 srchadmini.exe 2248 srchadmini.exe 2248 srchadmini.exe 2248 srchadmini.exe 2248 srchadmini.exe 2248 srchadmini.exe 2248 srchadmini.exe 2248 srchadmini.exe 2248 srchadmini.exe 2248 srchadmini.exe 2248 srchadmini.exe 2248 srchadmini.exe 2248 srchadmini.exe 2248 srchadmini.exe 2248 srchadmini.exe 2248 srchadmini.exe 2248 srchadmini.exe 2248 srchadmini.exe 2248 srchadmini.exe 2248 srchadmini.exe 2248 srchadmini.exe 2248 srchadmini.exe 2248 srchadmini.exe 2248 srchadmini.exe 2248 srchadmini.exe 2248 srchadmini.exe 2248 srchadmini.exe 2248 srchadmini.exe 2248 srchadmini.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3068 3ed14e41859c151c8db0c9b6653d0c1e35f90cfc68ec1333f5a569292814b6a6.exe Token: SeDebugPrivilege 2248 srchadmini.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3068 wrote to memory of 2248 3068 3ed14e41859c151c8db0c9b6653d0c1e35f90cfc68ec1333f5a569292814b6a6.exe 80 PID 3068 wrote to memory of 2248 3068 3ed14e41859c151c8db0c9b6653d0c1e35f90cfc68ec1333f5a569292814b6a6.exe 80 PID 3068 wrote to memory of 2248 3068 3ed14e41859c151c8db0c9b6653d0c1e35f90cfc68ec1333f5a569292814b6a6.exe 80 PID 3068 wrote to memory of 2216 3068 3ed14e41859c151c8db0c9b6653d0c1e35f90cfc68ec1333f5a569292814b6a6.exe 82 PID 3068 wrote to memory of 2216 3068 3ed14e41859c151c8db0c9b6653d0c1e35f90cfc68ec1333f5a569292814b6a6.exe 82 PID 3068 wrote to memory of 2216 3068 3ed14e41859c151c8db0c9b6653d0c1e35f90cfc68ec1333f5a569292814b6a6.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\3ed14e41859c151c8db0c9b6653d0c1e35f90cfc68ec1333f5a569292814b6a6.exe"C:\Users\Admin\AppData\Local\Temp\3ed14e41859c151c8db0c9b6653d0c1e35f90cfc68ec1333f5a569292814b6a6.exe"1⤵
- Adds policy Run key to start application
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Windows\SysWOW64\srchadmini.exeC:\Windows\SysWOW64\srchadmini.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2248
-
-
C:\Windows\SysWOW64\cmd.exe/c C:\Users\Admin\AppData\Local\Temp\~unins4775.bat "C:\Users\Admin\AppData\Local\Temp\3ed14e41859c151c8db0c9b6653d0c1e35f90cfc68ec1333f5a569292814b6a6.exe"2⤵PID:2216
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
49B
MD59e0a2f5ab30517809b95a1ff1dd98c53
SHA15c1eefdf10e67d1e9216e2e3f5e92352d583c9ce
SHA25697ac9fee75a1f7b63b3115e9c4fb9dda80b1caba26d2fb51325670dee261fe32
SHA512e959cc1fd48fb1cccf135a697924c775a3812bab211fc7f9b00c5a9d617261d84c5d6f7cb548774c1e8f46811b06ca39c5603d0e10cbcb7b805f9abbe49b9b42
-
Filesize
248KB
MD5461e8bf5b6e8c2e5ccc3efd9ff75bfe9
SHA153cb4acd0b518bb0d2d039dca3744def27343d8a
SHA256278359e8a598d6ff92bb0d3fc5e8e6f4c0621b9091ef79c742c59d86c6a451d4
SHA512b40cd1fc4b9add9a30953ff5ccd4096a1a90fa11aadfb89219f78c5b4a91ea391e8747c747456037b8eb020ed973137269cb860e69152a998c299c90e567b72a
-
Filesize
248KB
MD5461e8bf5b6e8c2e5ccc3efd9ff75bfe9
SHA153cb4acd0b518bb0d2d039dca3744def27343d8a
SHA256278359e8a598d6ff92bb0d3fc5e8e6f4c0621b9091ef79c742c59d86c6a451d4
SHA512b40cd1fc4b9add9a30953ff5ccd4096a1a90fa11aadfb89219f78c5b4a91ea391e8747c747456037b8eb020ed973137269cb860e69152a998c299c90e567b72a