Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
112s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
07/11/2022, 11:46
Static task
static1
Behavioral task
behavioral1
Sample
8ed429b289646fe25aec1554ffa72a9eb9ebae8f06ab38f849d34c9afd4d96e4.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
8ed429b289646fe25aec1554ffa72a9eb9ebae8f06ab38f849d34c9afd4d96e4.exe
Resource
win10v2004-20220812-en
General
-
Target
8ed429b289646fe25aec1554ffa72a9eb9ebae8f06ab38f849d34c9afd4d96e4.exe
-
Size
23KB
-
MD5
08b258d89a1438b418bbd185292f51e3
-
SHA1
92bc28160d66cf8aae5f59039be42e9d82bff698
-
SHA256
8ed429b289646fe25aec1554ffa72a9eb9ebae8f06ab38f849d34c9afd4d96e4
-
SHA512
a5bd7a29604dbd99bacd64332d7001539ab4086ca6721377451935130df81e35c5c0a3613f41a57329553dc193199122952b83b81af6ca33b3f44f6685d18b3b
-
SSDEEP
384:c9pFjVSoZRDg+wqvlIqOaM20an/KFv8WUX/14yKxg97Xo2+z4wS+mR3s:c9zjVhLRrMha/K18T/14Vxg9or/dm
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\RECYCLER\\S-1-5-21-0243556031-888888379-781863308-12310\\newcont2rnd1.exe" 8ed429b289646fe25aec1554ffa72a9eb9ebae8f06ab38f849d34c9afd4d96e4.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run 8ed429b289646fe25aec1554ffa72a9eb9ebae8f06ab38f849d34c9afd4d96e4.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\newcontr2nd1 = "C:\\RECYCLER\\S-1-5-21-0243556031-888888379-781863308-12310\\newcont2rnd1.exe" 8ed429b289646fe25aec1554ffa72a9eb9ebae8f06ab38f849d34c9afd4d96e4.exe -
Drops desktop.ini file(s) 1 IoCs
description ioc Process File created C:\RECYCLER\S-1-5-21-0243556031-888888379-781863308-12310\Desktop.ini 8ed429b289646fe25aec1554ffa72a9eb9ebae8f06ab38f849d34c9afd4d96e4.exe -
Modifies WinLogon 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman = "C:\\RECYCLER\\S-1-5-21-0243556031-888888379-781863308-12310\\newcont2rnd1.exe" 8ed429b289646fe25aec1554ffa72a9eb9ebae8f06ab38f849d34c9afd4d96e4.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 5076 8ed429b289646fe25aec1554ffa72a9eb9ebae8f06ab38f849d34c9afd4d96e4.exe 5076 8ed429b289646fe25aec1554ffa72a9eb9ebae8f06ab38f849d34c9afd4d96e4.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 5076 wrote to memory of 2864 5076 8ed429b289646fe25aec1554ffa72a9eb9ebae8f06ab38f849d34c9afd4d96e4.exe 39 PID 5076 wrote to memory of 2864 5076 8ed429b289646fe25aec1554ffa72a9eb9ebae8f06ab38f849d34c9afd4d96e4.exe 39 PID 5076 wrote to memory of 2864 5076 8ed429b289646fe25aec1554ffa72a9eb9ebae8f06ab38f849d34c9afd4d96e4.exe 39
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\8ed429b289646fe25aec1554ffa72a9eb9ebae8f06ab38f849d34c9afd4d96e4.exe"C:\Users\Admin\AppData\Local\Temp\8ed429b289646fe25aec1554ffa72a9eb9ebae8f06ab38f849d34c9afd4d96e4.exe"2⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Drops desktop.ini file(s)
- Modifies WinLogon
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5076
-