Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
90s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
06/12/2022, 06:04
Static task
static1
Behavioral task
behavioral1
Sample
edacec5165574683223b96666a6ab206089fe2c60c45d4b010e899441b7ba622.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
edacec5165574683223b96666a6ab206089fe2c60c45d4b010e899441b7ba622.exe
Resource
win10v2004-20220812-en
General
-
Target
edacec5165574683223b96666a6ab206089fe2c60c45d4b010e899441b7ba622.exe
-
Size
366KB
-
MD5
7ddc9d7e7d73ac709c5d549fda478360
-
SHA1
f786cc4bf8db1660331fbd85410fdb3d20e0939a
-
SHA256
edacec5165574683223b96666a6ab206089fe2c60c45d4b010e899441b7ba622
-
SHA512
06475435f7744d047365312189c4957289d7559bac2dfe39c0489cfe19caf569bb10693c76bc363557068b3c69adebbc7793cea2327f88361a636f6c51b4828c
-
SSDEEP
6144:4f+zrJY+/vLTHu4GATr9eRjVla9qqz3xKrBcZmGizBJhtb1xbKIAQMkigXf:nmqOw9eNVw9qq3Si8GUTb5Mkiuf
Malware Config
Signatures
-
Uses Session Manager for persistence 2 TTPs 3 IoCs
Creates Session Manager registry key to run executable early in system boot.
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Session Manager\BootExecute = 6100750074006f0063006800650063006b0020006100750074006f00630068006b0020002a0000000000 reg.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet002\Control\Session manager\BootExecute = 6100750074006f0063006800650063006b0020006100750074006f00630068006b0020002a0000000000 reg.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Session Manager\BootExecute = 6100750074006f0063006800650063006b0020006100750074006f00630068006b0020002a0000000000 reg.exe -
Kills process with taskkill 1 IoCs
pid Process 2064 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2064 taskkill.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 3012 wrote to memory of 2108 3012 edacec5165574683223b96666a6ab206089fe2c60c45d4b010e899441b7ba622.exe 79 PID 3012 wrote to memory of 2108 3012 edacec5165574683223b96666a6ab206089fe2c60c45d4b010e899441b7ba622.exe 79 PID 3012 wrote to memory of 2108 3012 edacec5165574683223b96666a6ab206089fe2c60c45d4b010e899441b7ba622.exe 79 PID 3012 wrote to memory of 1696 3012 edacec5165574683223b96666a6ab206089fe2c60c45d4b010e899441b7ba622.exe 80 PID 3012 wrote to memory of 1696 3012 edacec5165574683223b96666a6ab206089fe2c60c45d4b010e899441b7ba622.exe 80 PID 3012 wrote to memory of 1696 3012 edacec5165574683223b96666a6ab206089fe2c60c45d4b010e899441b7ba622.exe 80 PID 3012 wrote to memory of 4968 3012 edacec5165574683223b96666a6ab206089fe2c60c45d4b010e899441b7ba622.exe 81 PID 3012 wrote to memory of 4968 3012 edacec5165574683223b96666a6ab206089fe2c60c45d4b010e899441b7ba622.exe 81 PID 3012 wrote to memory of 4968 3012 edacec5165574683223b96666a6ab206089fe2c60c45d4b010e899441b7ba622.exe 81 PID 3012 wrote to memory of 2064 3012 edacec5165574683223b96666a6ab206089fe2c60c45d4b010e899441b7ba622.exe 85 PID 3012 wrote to memory of 2064 3012 edacec5165574683223b96666a6ab206089fe2c60c45d4b010e899441b7ba622.exe 85 PID 3012 wrote to memory of 2064 3012 edacec5165574683223b96666a6ab206089fe2c60c45d4b010e899441b7ba622.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\edacec5165574683223b96666a6ab206089fe2c60c45d4b010e899441b7ba622.exe"C:\Users\Admin\AppData\Local\Temp\edacec5165574683223b96666a6ab206089fe2c60c45d4b010e899441b7ba622.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Windows\SysWOW64\reg.exereg add "HKLM\SYSTEM\ControlSet001\Control\Session manager" /v BootExecute /t REG_MULTI_SZ /d "autocheck autochk *" /f2⤵
- Uses Session Manager for persistence
PID:2108
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\SYSTEM\ControlSet002\Control\Session manager" /v BootExecute /t REG_MULTI_SZ /d "autocheck autochk *" /f2⤵
- Uses Session Manager for persistence
PID:1696
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\SYSTEM\CurrentControlSet\Control\Session manager" /v BootExecute /t REG_MULTI_SZ /d "autocheck autochk *" /f2⤵
- Uses Session Manager for persistence
PID:4968
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM javasq2.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2064
-