Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
134s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
28/11/2022, 19:13
Static task
static1
Behavioral task
behavioral1
Sample
12d0b3603ce81c1f27f0a07bf84c2df7e9218c74a543bf196758523babe09ee7.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
12d0b3603ce81c1f27f0a07bf84c2df7e9218c74a543bf196758523babe09ee7.exe
Resource
win10v2004-20220901-en
General
-
Target
12d0b3603ce81c1f27f0a07bf84c2df7e9218c74a543bf196758523babe09ee7.exe
-
Size
555KB
-
MD5
6d68f07977eca88d827e0b9484c848f0
-
SHA1
8195c1ee1114a4867c53b7ea255890fa7a3eacac
-
SHA256
12d0b3603ce81c1f27f0a07bf84c2df7e9218c74a543bf196758523babe09ee7
-
SHA512
99f62cb0d6468c823568534c663acbcf49b195d7b4b1df85e252a3930cc70757b252a7b507b16ee7cfe60af6bf572a6d726006958b097205bcab96059e2f3624
-
SSDEEP
6144:daIpkJ0+Lf1CoKQvwlX5cF5MSEdOOmR9eY865azUuSchCe8bfAPEDFV4klFuPGcy:daImJ714h52MSEdOVO6Mb1Li/FV8u/
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Idle System Process = "C:\\Users\\Admin\\AppData\\Roaming\\Window Idle System\\Windows Audio Device Graph Isolation.exe" msbuild.exe -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File created C:\Windows\assembly\Desktop.ini msbuild.exe File opened for modification C:\Windows\assembly\Desktop.ini msbuild.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2148 set thread context of 2248 2148 12d0b3603ce81c1f27f0a07bf84c2df7e9218c74a543bf196758523babe09ee7.exe 81 -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\assembly msbuild.exe File created C:\Windows\assembly\Desktop.ini msbuild.exe File opened for modification C:\Windows\assembly\Desktop.ini msbuild.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\msbuild.exe msbuild.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2248 msbuild.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2248 msbuild.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2248 msbuild.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2148 wrote to memory of 2248 2148 12d0b3603ce81c1f27f0a07bf84c2df7e9218c74a543bf196758523babe09ee7.exe 81 PID 2148 wrote to memory of 2248 2148 12d0b3603ce81c1f27f0a07bf84c2df7e9218c74a543bf196758523babe09ee7.exe 81 PID 2148 wrote to memory of 2248 2148 12d0b3603ce81c1f27f0a07bf84c2df7e9218c74a543bf196758523babe09ee7.exe 81 PID 2148 wrote to memory of 2248 2148 12d0b3603ce81c1f27f0a07bf84c2df7e9218c74a543bf196758523babe09ee7.exe 81 PID 2148 wrote to memory of 2248 2148 12d0b3603ce81c1f27f0a07bf84c2df7e9218c74a543bf196758523babe09ee7.exe 81 PID 2148 wrote to memory of 2248 2148 12d0b3603ce81c1f27f0a07bf84c2df7e9218c74a543bf196758523babe09ee7.exe 81 PID 2148 wrote to memory of 2248 2148 12d0b3603ce81c1f27f0a07bf84c2df7e9218c74a543bf196758523babe09ee7.exe 81 PID 2148 wrote to memory of 2248 2148 12d0b3603ce81c1f27f0a07bf84c2df7e9218c74a543bf196758523babe09ee7.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\12d0b3603ce81c1f27f0a07bf84c2df7e9218c74a543bf196758523babe09ee7.exe"C:\Users\Admin\AppData\Local\Temp\12d0b3603ce81c1f27f0a07bf84c2df7e9218c74a543bf196758523babe09ee7.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\msbuild.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\msbuild.exe2⤵
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2248
-