Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
22/11/2022, 01:53
Static task
static1
Behavioral task
behavioral1
Sample
f3773aa5c6bcd94e1715255e7305a40d749e6eb5f623e5aa26c29b8cec076f13.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
f3773aa5c6bcd94e1715255e7305a40d749e6eb5f623e5aa26c29b8cec076f13.exe
Resource
win10v2004-20220812-en
General
-
Target
f3773aa5c6bcd94e1715255e7305a40d749e6eb5f623e5aa26c29b8cec076f13.exe
-
Size
522KB
-
MD5
0c31f3a8feae5131e0df96ef87484427
-
SHA1
be824cf1843e48d304c7f474f343f897b8d1eb8e
-
SHA256
f3773aa5c6bcd94e1715255e7305a40d749e6eb5f623e5aa26c29b8cec076f13
-
SHA512
b0021e4df5ca451ad8016708315df1ded0399b7ff0bcf371dba9d31e264e9fda526705782525e061277bd62a2809d1f9f3ce86a7e17cef906fb5f034276b1d15
-
SSDEEP
12288:uif3lDOvnEQLeD/+YuPoy18xQqpx8O5PBo:uY4EM62Satqpx8mo
Malware Config
Signatures
-
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{FD982978-24DF-4AF4-BD3D-6532BFFB44B7}.catalogItem svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{4618EEBF-B294-413C-A80C-16C70AAC68E0}.catalogItem svchost.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString svchost.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU svchost.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1404 wrote to memory of 2840 1404 f3773aa5c6bcd94e1715255e7305a40d749e6eb5f623e5aa26c29b8cec076f13.exe 75 PID 1404 wrote to memory of 2840 1404 f3773aa5c6bcd94e1715255e7305a40d749e6eb5f623e5aa26c29b8cec076f13.exe 75 PID 1404 wrote to memory of 2840 1404 f3773aa5c6bcd94e1715255e7305a40d749e6eb5f623e5aa26c29b8cec076f13.exe 75 PID 1404 wrote to memory of 3964 1404 f3773aa5c6bcd94e1715255e7305a40d749e6eb5f623e5aa26c29b8cec076f13.exe 76 PID 1404 wrote to memory of 3964 1404 f3773aa5c6bcd94e1715255e7305a40d749e6eb5f623e5aa26c29b8cec076f13.exe 76 PID 1404 wrote to memory of 3964 1404 f3773aa5c6bcd94e1715255e7305a40d749e6eb5f623e5aa26c29b8cec076f13.exe 76
Processes
-
C:\Users\Admin\AppData\Local\Temp\f3773aa5c6bcd94e1715255e7305a40d749e6eb5f623e5aa26c29b8cec076f13.exe"C:\Users\Admin\AppData\Local\Temp\f3773aa5c6bcd94e1715255e7305a40d749e6eb5f623e5aa26c29b8cec076f13.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1404 -
C:\Users\Admin\AppData\Local\Temp\f3773aa5c6bcd94e1715255e7305a40d749e6eb5f623e5aa26c29b8cec076f13.exestart2⤵PID:2840
-
-
C:\Users\Admin\AppData\Local\Temp\f3773aa5c6bcd94e1715255e7305a40d749e6eb5f623e5aa26c29b8cec076f13.exewatch2⤵PID:3964
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
PID:3880