Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
06/12/2022, 12:57
Static task
static1
Behavioral task
behavioral1
Sample
b9cc26f6cc30942c0f54134fd8ff95c87d0c63a74bc57c6724603ec63e4d94e2.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
b9cc26f6cc30942c0f54134fd8ff95c87d0c63a74bc57c6724603ec63e4d94e2.exe
Resource
win10v2004-20220812-en
General
-
Target
b9cc26f6cc30942c0f54134fd8ff95c87d0c63a74bc57c6724603ec63e4d94e2.exe
-
Size
249KB
-
MD5
4011c591946de4c19898e1c5e54f0aa4
-
SHA1
5210204058d35f1c53cd278eee34a5b6f327e9df
-
SHA256
b9cc26f6cc30942c0f54134fd8ff95c87d0c63a74bc57c6724603ec63e4d94e2
-
SHA512
b9a6e72c0e3948c8f8e585390857d4e9eeedac3d13bb3e6b459f232abac0ff5b3818836c4f8417dbbff2d032e276c08fca3be054b07dd0cd605f3d5645e311a5
-
SSDEEP
6144:eWq8/eR6p0yN90QE1BRYU+d0rwqR6M3hIPk:L/eBy905RP+d0Eq48N
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 4088 15911.exe 1424 15911.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce b9cc26f6cc30942c0f54134fd8ff95c87d0c63a74bc57c6724603ec63e4d94e2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" b9cc26f6cc30942c0f54134fd8ff95c87d0c63a74bc57c6724603ec63e4d94e2.exe -
Suspicious use of SetThreadContext 6 IoCs
description pid Process procid_target PID 4088 set thread context of 1424 4088 15911.exe 80 PID 4088 set thread context of 0 4088 15911.exe PID 4088 set thread context of 0 4088 15911.exe PID 4088 set thread context of 0 4088 15911.exe PID 4088 set thread context of 0 4088 15911.exe PID 4088 set thread context of 0 4088 15911.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1424 15911.exe 1424 15911.exe 1424 15911.exe 1424 15911.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4088 15911.exe -
Suspicious use of WriteProcessMemory 34 IoCs
description pid Process procid_target PID 1436 wrote to memory of 4088 1436 b9cc26f6cc30942c0f54134fd8ff95c87d0c63a74bc57c6724603ec63e4d94e2.exe 79 PID 1436 wrote to memory of 4088 1436 b9cc26f6cc30942c0f54134fd8ff95c87d0c63a74bc57c6724603ec63e4d94e2.exe 79 PID 1436 wrote to memory of 4088 1436 b9cc26f6cc30942c0f54134fd8ff95c87d0c63a74bc57c6724603ec63e4d94e2.exe 79 PID 4088 wrote to memory of 1424 4088 15911.exe 80 PID 4088 wrote to memory of 1424 4088 15911.exe 80 PID 4088 wrote to memory of 1424 4088 15911.exe 80 PID 4088 wrote to memory of 1424 4088 15911.exe 80 PID 4088 wrote to memory of 1424 4088 15911.exe 80 PID 4088 wrote to memory of 1424 4088 15911.exe 80 PID 4088 wrote to memory of 1424 4088 15911.exe 80 PID 4088 wrote to memory of 0 4088 15911.exe PID 4088 wrote to memory of 0 4088 15911.exe PID 4088 wrote to memory of 0 4088 15911.exe PID 4088 wrote to memory of 0 4088 15911.exe PID 4088 wrote to memory of 0 4088 15911.exe PID 4088 wrote to memory of 0 4088 15911.exe PID 4088 wrote to memory of 0 4088 15911.exe PID 4088 wrote to memory of 0 4088 15911.exe PID 4088 wrote to memory of 0 4088 15911.exe PID 4088 wrote to memory of 0 4088 15911.exe PID 4088 wrote to memory of 0 4088 15911.exe PID 4088 wrote to memory of 0 4088 15911.exe PID 4088 wrote to memory of 0 4088 15911.exe PID 4088 wrote to memory of 0 4088 15911.exe PID 4088 wrote to memory of 0 4088 15911.exe PID 4088 wrote to memory of 0 4088 15911.exe PID 4088 wrote to memory of 0 4088 15911.exe PID 4088 wrote to memory of 0 4088 15911.exe PID 4088 wrote to memory of 0 4088 15911.exe PID 4088 wrote to memory of 0 4088 15911.exe PID 1424 wrote to memory of 2484 1424 15911.exe 44 PID 1424 wrote to memory of 2484 1424 15911.exe 44 PID 1424 wrote to memory of 2484 1424 15911.exe 44 PID 1424 wrote to memory of 2484 1424 15911.exe 44
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\b9cc26f6cc30942c0f54134fd8ff95c87d0c63a74bc57c6724603ec63e4d94e2.exe"C:\Users\Admin\AppData\Local\Temp\b9cc26f6cc30942c0f54134fd8ff95c87d0c63a74bc57c6724603ec63e4d94e2.exe"2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1436 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\15911.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\15911.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4088 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\15911.exe"C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\15911.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1424
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
364KB
MD5a4a0b5864d177694528dc6fdd80b091d
SHA1e00a83525b26cfeb8fee5e9dc20aceef4b809458
SHA256de91bc1712e52bc0faa976700ed5a2152a3a466e2ba46a684fe189d414b239bb
SHA512e7f3a8ece722f8fefe7e95dc71fe9004c112d302a63e3924d22a2c89a2af333151cd48c9842c136929cdf9392417f893953bbed4dfdc2e727e21a7fb62161955
-
Filesize
364KB
MD5a4a0b5864d177694528dc6fdd80b091d
SHA1e00a83525b26cfeb8fee5e9dc20aceef4b809458
SHA256de91bc1712e52bc0faa976700ed5a2152a3a466e2ba46a684fe189d414b239bb
SHA512e7f3a8ece722f8fefe7e95dc71fe9004c112d302a63e3924d22a2c89a2af333151cd48c9842c136929cdf9392417f893953bbed4dfdc2e727e21a7fb62161955
-
Filesize
364KB
MD5a4a0b5864d177694528dc6fdd80b091d
SHA1e00a83525b26cfeb8fee5e9dc20aceef4b809458
SHA256de91bc1712e52bc0faa976700ed5a2152a3a466e2ba46a684fe189d414b239bb
SHA512e7f3a8ece722f8fefe7e95dc71fe9004c112d302a63e3924d22a2c89a2af333151cd48c9842c136929cdf9392417f893953bbed4dfdc2e727e21a7fb62161955