Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
92s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
06/12/2022, 13:18
Behavioral task
behavioral1
Sample
fe4b50fecb15897d058be7ae401d5d50a093eb4edadfbc896e81ac0ee42000ee.exe
Resource
win7-20220901-en
General
-
Target
fe4b50fecb15897d058be7ae401d5d50a093eb4edadfbc896e81ac0ee42000ee.exe
-
Size
17KB
-
MD5
31eb00e4884b371aaa5302699e0e6f75
-
SHA1
45ba700180d087e003a61bd17e8a9034a39d879d
-
SHA256
fe4b50fecb15897d058be7ae401d5d50a093eb4edadfbc896e81ac0ee42000ee
-
SHA512
862a4e7faa9c958375ec1276e7c04daf051a531a680c82b44e110fba20833b81e740be6cd052285637d5043fc2939dadcba51184e672edda3e2ca57ea138835c
-
SSDEEP
384:YHpwViqRd2ca4VoJOxXnV8sLUlGCmrRQXSvYEQECaNJawcudoD7UB:YHoq/kmsgMCG+XSHTjnbcuyD7U
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts cmd.exe -
Sets file to hidden 1 TTPs 4 IoCs
Modifies file attributes to stop it showing in Explorer etc.
pid Process 2116 attrib.exe 460 attrib.exe 396 attrib.exe 4308 attrib.exe -
resource yara_rule behavioral2/memory/868-132-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/memory/868-145-0x0000000000400000-0x0000000000410000-memory.dmp upx -
Loads dropped DLL 1 IoCs
pid Process 868 fe4b50fecb15897d058be7ae401d5d50a093eb4edadfbc896e81ac0ee42000ee.exe -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
pid Process 3396 ipconfig.exe -
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 868 wrote to memory of 4940 868 fe4b50fecb15897d058be7ae401d5d50a093eb4edadfbc896e81ac0ee42000ee.exe 81 PID 868 wrote to memory of 4940 868 fe4b50fecb15897d058be7ae401d5d50a093eb4edadfbc896e81ac0ee42000ee.exe 81 PID 868 wrote to memory of 4940 868 fe4b50fecb15897d058be7ae401d5d50a093eb4edadfbc896e81ac0ee42000ee.exe 81 PID 4940 wrote to memory of 5040 4940 cmd.exe 82 PID 4940 wrote to memory of 5040 4940 cmd.exe 82 PID 4940 wrote to memory of 5040 4940 cmd.exe 82 PID 4940 wrote to memory of 2160 4940 cmd.exe 83 PID 4940 wrote to memory of 2160 4940 cmd.exe 83 PID 4940 wrote to memory of 2160 4940 cmd.exe 83 PID 4940 wrote to memory of 3624 4940 cmd.exe 84 PID 4940 wrote to memory of 3624 4940 cmd.exe 84 PID 4940 wrote to memory of 3624 4940 cmd.exe 84 PID 4940 wrote to memory of 3232 4940 cmd.exe 85 PID 4940 wrote to memory of 3232 4940 cmd.exe 85 PID 4940 wrote to memory of 3232 4940 cmd.exe 85 PID 4940 wrote to memory of 2116 4940 cmd.exe 86 PID 4940 wrote to memory of 2116 4940 cmd.exe 86 PID 4940 wrote to memory of 2116 4940 cmd.exe 86 PID 4940 wrote to memory of 460 4940 cmd.exe 87 PID 4940 wrote to memory of 460 4940 cmd.exe 87 PID 4940 wrote to memory of 460 4940 cmd.exe 87 PID 4940 wrote to memory of 396 4940 cmd.exe 88 PID 4940 wrote to memory of 396 4940 cmd.exe 88 PID 4940 wrote to memory of 396 4940 cmd.exe 88 PID 4940 wrote to memory of 4308 4940 cmd.exe 89 PID 4940 wrote to memory of 4308 4940 cmd.exe 89 PID 4940 wrote to memory of 4308 4940 cmd.exe 89 PID 4940 wrote to memory of 3396 4940 cmd.exe 90 PID 4940 wrote to memory of 3396 4940 cmd.exe 90 PID 4940 wrote to memory of 3396 4940 cmd.exe 90 -
Views/modifies file attributes 1 TTPs 8 IoCs
pid Process 5040 attrib.exe 2160 attrib.exe 3624 attrib.exe 3232 attrib.exe 2116 attrib.exe 460 attrib.exe 396 attrib.exe 4308 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fe4b50fecb15897d058be7ae401d5d50a093eb4edadfbc896e81ac0ee42000ee.exe"C:\Users\Admin\AppData\Local\Temp\fe4b50fecb15897d058be7ae401d5d50a093eb4edadfbc896e81ac0ee42000ee.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:868 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\A1A4.tmp\bnm2.bat""2⤵
- Drops file in Drivers directory
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\Windows\SysWOW64\attrib.exeattrib -a -s -h -r C:\Windows\system32\drivers\etc\hosts3⤵
- Views/modifies file attributes
PID:5040
-
-
C:\Windows\SysWOW64\attrib.exeattrib -a -s -h -r C:\Windows\system32\drivers\hosts3⤵
- Views/modifies file attributes
PID:2160
-
-
C:\Windows\SysWOW64\attrib.exeattrib -a -s -h -r C:\Windows\system32\hosts3⤵
- Views/modifies file attributes
PID:3624
-
-
C:\Windows\SysWOW64\attrib.exeattrib -a -s -h -r C:\Windows\hosts3⤵
- Views/modifies file attributes
PID:3232
-
-
C:\Windows\SysWOW64\attrib.exeattrib +s +h +r C:\Windows\system32\drivers\etc\hosts3⤵
- Sets file to hidden
- Views/modifies file attributes
PID:2116
-
-
C:\Windows\SysWOW64\attrib.exeattrib +s +h +r C:\Windows\system32\drivers\hosts3⤵
- Sets file to hidden
- Views/modifies file attributes
PID:460
-
-
C:\Windows\SysWOW64\attrib.exeattrib +s +h +r C:\Windows\system32\hosts3⤵
- Sets file to hidden
- Views/modifies file attributes
PID:396
-
-
C:\Windows\SysWOW64\attrib.exeattrib +s +h +r C:\Windows\hosts3⤵
- Sets file to hidden
- Views/modifies file attributes
PID:4308
-
-
C:\Windows\SysWOW64\ipconfig.exeipconfig /flushdns3⤵
- Gathers network information
PID:3396
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
31KB
MD57b860f28be19d4aef761fb991134a556
SHA10658a7456d0234dcca598b6ee599fe134d0ecd61
SHA25657a2586d73188a694944c7da60c78380f82fac46452ed1a31c818ceb93e660bc
SHA512a0685a25cbc3fff74aa4ad538ade5282242980f07fe1171e01644e0fa98e1ec6adc87b943290983f6fb5070d26fc15d697ae31a1f570e83e504ae1e4508aefa5
-
Filesize
5KB
MD59e80a79d25b637efe0296afc170b076d
SHA1ebbc541478ab9ee46101a6b410a1bb5a2f7d7bba
SHA2567d647475d092c3babc6b75def1af0bfd36386658fcdb0b1aa7136030add3fa8d
SHA5128a16eac5952406a333e54af152756c07a7fb1e22c77c69069fa96671ae90ac0a933564d10de754f98a3e3e33bed105f942de161968cad40bff5cc94f6508bc88