Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
03/12/2022, 03:05
Static task
static1
Behavioral task
behavioral1
Sample
3445353d18d7cb9c956b1a16b52a35eb8467fa296c238a900a414241ecd205c2.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
3445353d18d7cb9c956b1a16b52a35eb8467fa296c238a900a414241ecd205c2.exe
Resource
win10v2004-20220901-en
General
-
Target
3445353d18d7cb9c956b1a16b52a35eb8467fa296c238a900a414241ecd205c2.exe
-
Size
37KB
-
MD5
0d5ecbddfb341e9cbe0abe4d63d912b0
-
SHA1
ebe8adf2ade62bd523626b6d53ec20f65e1874dd
-
SHA256
3445353d18d7cb9c956b1a16b52a35eb8467fa296c238a900a414241ecd205c2
-
SHA512
6ad753d2acd1d529f15cdd3ee1e2a510d149c856a2e7320362cf1afd9807c75b931c5990b9f3fe0eef21ed9311f7ae5489e7ab3b1585c09b91a6966acc488e62
-
SSDEEP
768:vhSeJiWaxtEvzx22NiQknwaQCXlnFXdwe4p9G3jRoOE+p+:ZfStEvt22N57MT5o0NoLw+
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2408 SVCH0SFT.EXE -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\SVCH0SFT.EXE cmd.exe File opened for modification C:\Windows\SysWOW64\SVCH0SFT.EXE cmd.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 4404 PING.EXE -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3544 3445353d18d7cb9c956b1a16b52a35eb8467fa296c238a900a414241ecd205c2.exe 3544 3445353d18d7cb9c956b1a16b52a35eb8467fa296c238a900a414241ecd205c2.exe 2408 SVCH0SFT.EXE 2408 SVCH0SFT.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 3544 wrote to memory of 4376 3544 3445353d18d7cb9c956b1a16b52a35eb8467fa296c238a900a414241ecd205c2.exe 77 PID 3544 wrote to memory of 4376 3544 3445353d18d7cb9c956b1a16b52a35eb8467fa296c238a900a414241ecd205c2.exe 77 PID 3544 wrote to memory of 4376 3544 3445353d18d7cb9c956b1a16b52a35eb8467fa296c238a900a414241ecd205c2.exe 77 PID 4376 wrote to memory of 2408 4376 cmd.exe 79 PID 4376 wrote to memory of 2408 4376 cmd.exe 79 PID 4376 wrote to memory of 2408 4376 cmd.exe 79 PID 4376 wrote to memory of 4404 4376 cmd.exe 80 PID 4376 wrote to memory of 4404 4376 cmd.exe 80 PID 4376 wrote to memory of 4404 4376 cmd.exe 80 PID 3544 wrote to memory of 3236 3544 3445353d18d7cb9c956b1a16b52a35eb8467fa296c238a900a414241ecd205c2.exe 82 PID 3544 wrote to memory of 3236 3544 3445353d18d7cb9c956b1a16b52a35eb8467fa296c238a900a414241ecd205c2.exe 82 PID 3544 wrote to memory of 3236 3544 3445353d18d7cb9c956b1a16b52a35eb8467fa296c238a900a414241ecd205c2.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\3445353d18d7cb9c956b1a16b52a35eb8467fa296c238a900a414241ecd205c2.exe"C:\Users\Admin\AppData\Local\Temp\3445353d18d7cb9c956b1a16b52a35eb8467fa296c238a900a414241ecd205c2.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3544 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~gagad2.bat2⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4376 -
C:\Windows\SysWOW64\SVCH0SFT.EXESVCH0SFT.EXE3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2408
-
-
C:\Windows\SysWOW64\PING.EXEping 127.13⤵
- Runs ping.exe
PID:4404
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\3445353d18d7cb9c956b1a16b52a35eb8467fa296c238a900a414241ecd205c2.exe"2⤵PID:3236
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
336B
MD5e8479cc3204be57fc21f818a0b328578
SHA1618d786ec3f1ed9d2fbce4ae89d666d6d3210964
SHA2563af41568d9c3864716c0d964a6e9ba5d628c9fa320832a5d95404043d85ddb51
SHA51274a72514799409f016f24d6b55fa6c086ce385b01d2e1f045f6f9b88320c680dcc6a0dd9a154bf98ff01d1c550591c03aaf019e4c45247814949159036f894fd
-
Filesize
37KB
MD50d5ecbddfb341e9cbe0abe4d63d912b0
SHA1ebe8adf2ade62bd523626b6d53ec20f65e1874dd
SHA2563445353d18d7cb9c956b1a16b52a35eb8467fa296c238a900a414241ecd205c2
SHA5126ad753d2acd1d529f15cdd3ee1e2a510d149c856a2e7320362cf1afd9807c75b931c5990b9f3fe0eef21ed9311f7ae5489e7ab3b1585c09b91a6966acc488e62
-
Filesize
37KB
MD50d5ecbddfb341e9cbe0abe4d63d912b0
SHA1ebe8adf2ade62bd523626b6d53ec20f65e1874dd
SHA2563445353d18d7cb9c956b1a16b52a35eb8467fa296c238a900a414241ecd205c2
SHA5126ad753d2acd1d529f15cdd3ee1e2a510d149c856a2e7320362cf1afd9807c75b931c5990b9f3fe0eef21ed9311f7ae5489e7ab3b1585c09b91a6966acc488e62