Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
59s -
max time network
63s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
09/05/2023, 23:00
Static task
static1
Behavioral task
behavioral1
Sample
m4589881.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
m4589881.exe
Resource
win10v2004-20230220-en
General
-
Target
m4589881.exe
-
Size
211KB
-
MD5
2b17cbaf633234f8bbd588a0ad2e2763
-
SHA1
383b93a9f3dad345cae3817421c1c1c56d3ad87c
-
SHA256
b30bf19ac08a3b26742e2088523306224ef627ffef605ffc43a0566fdad066ea
-
SHA512
891c79719b2bd050b492616d3635ecdbfa460660fcb21447a36d07db1d620ddc7377d3f8356a62f400b711962a8b4356817450f8da00e6760abe8c8517ee2f30
-
SSDEEP
3072:mhMCsw9/w+A4cwP+5OzutpHKGruONM4QuZA+67bi83eILfbq5kmh:5Cswq+AXYu7HGOSuZAlAILjq
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation m4589881.exe Key value queried \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation oneetx.exe -
Executes dropped EXE 2 IoCs
pid Process 4776 oneetx.exe 3004 oneetx.exe -
Loads dropped DLL 1 IoCs
pid Process 2196 rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3784 schtasks.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3384 m4589881.exe -
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 3384 wrote to memory of 4776 3384 m4589881.exe 84 PID 3384 wrote to memory of 4776 3384 m4589881.exe 84 PID 3384 wrote to memory of 4776 3384 m4589881.exe 84 PID 4776 wrote to memory of 3784 4776 oneetx.exe 85 PID 4776 wrote to memory of 3784 4776 oneetx.exe 85 PID 4776 wrote to memory of 3784 4776 oneetx.exe 85 PID 4776 wrote to memory of 4816 4776 oneetx.exe 87 PID 4776 wrote to memory of 4816 4776 oneetx.exe 87 PID 4776 wrote to memory of 4816 4776 oneetx.exe 87 PID 4816 wrote to memory of 564 4816 cmd.exe 89 PID 4816 wrote to memory of 564 4816 cmd.exe 89 PID 4816 wrote to memory of 564 4816 cmd.exe 89 PID 4816 wrote to memory of 408 4816 cmd.exe 90 PID 4816 wrote to memory of 408 4816 cmd.exe 90 PID 4816 wrote to memory of 408 4816 cmd.exe 90 PID 4816 wrote to memory of 1560 4816 cmd.exe 91 PID 4816 wrote to memory of 1560 4816 cmd.exe 91 PID 4816 wrote to memory of 1560 4816 cmd.exe 91 PID 4816 wrote to memory of 3580 4816 cmd.exe 92 PID 4816 wrote to memory of 3580 4816 cmd.exe 92 PID 4816 wrote to memory of 3580 4816 cmd.exe 92 PID 4816 wrote to memory of 2588 4816 cmd.exe 93 PID 4816 wrote to memory of 2588 4816 cmd.exe 93 PID 4816 wrote to memory of 2588 4816 cmd.exe 93 PID 4816 wrote to memory of 464 4816 cmd.exe 94 PID 4816 wrote to memory of 464 4816 cmd.exe 94 PID 4816 wrote to memory of 464 4816 cmd.exe 94 PID 4776 wrote to memory of 2196 4776 oneetx.exe 103 PID 4776 wrote to memory of 2196 4776 oneetx.exe 103 PID 4776 wrote to memory of 2196 4776 oneetx.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\m4589881.exe"C:\Users\Admin\AppData\Local\Temp\m4589881.exe"1⤵
- Checks computer location settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3384 -
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe" /F3⤵
- Creates scheduled task(s)
PID:3784
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\c3912af058" /P "Admin:N"&&CACLS "..\c3912af058" /P "Admin:R" /E&&Exit3⤵
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵PID:564
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:N"4⤵PID:408
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:R" /E4⤵PID:1560
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵PID:3580
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\c3912af058" /P "Admin:N"4⤵PID:2588
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\c3912af058" /P "Admin:R" /E4⤵PID:464
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main3⤵
- Loads dropped DLL
PID:2196
-
-
-
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exeC:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe1⤵
- Executes dropped EXE
PID:3004
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
211KB
MD52b17cbaf633234f8bbd588a0ad2e2763
SHA1383b93a9f3dad345cae3817421c1c1c56d3ad87c
SHA256b30bf19ac08a3b26742e2088523306224ef627ffef605ffc43a0566fdad066ea
SHA512891c79719b2bd050b492616d3635ecdbfa460660fcb21447a36d07db1d620ddc7377d3f8356a62f400b711962a8b4356817450f8da00e6760abe8c8517ee2f30
-
Filesize
211KB
MD52b17cbaf633234f8bbd588a0ad2e2763
SHA1383b93a9f3dad345cae3817421c1c1c56d3ad87c
SHA256b30bf19ac08a3b26742e2088523306224ef627ffef605ffc43a0566fdad066ea
SHA512891c79719b2bd050b492616d3635ecdbfa460660fcb21447a36d07db1d620ddc7377d3f8356a62f400b711962a8b4356817450f8da00e6760abe8c8517ee2f30
-
Filesize
211KB
MD52b17cbaf633234f8bbd588a0ad2e2763
SHA1383b93a9f3dad345cae3817421c1c1c56d3ad87c
SHA256b30bf19ac08a3b26742e2088523306224ef627ffef605ffc43a0566fdad066ea
SHA512891c79719b2bd050b492616d3635ecdbfa460660fcb21447a36d07db1d620ddc7377d3f8356a62f400b711962a8b4356817450f8da00e6760abe8c8517ee2f30
-
Filesize
211KB
MD52b17cbaf633234f8bbd588a0ad2e2763
SHA1383b93a9f3dad345cae3817421c1c1c56d3ad87c
SHA256b30bf19ac08a3b26742e2088523306224ef627ffef605ffc43a0566fdad066ea
SHA512891c79719b2bd050b492616d3635ecdbfa460660fcb21447a36d07db1d620ddc7377d3f8356a62f400b711962a8b4356817450f8da00e6760abe8c8517ee2f30
-
Filesize
89KB
MD58451a2c5daa42b25333b1b2089c5ea39
SHA1700cc99ec8d3113435e657070d2d6bde0a833adc
SHA256b8c8aedd84c363853db934a55087a3b730cf9dc758dea3dc3a98f54217f4c9d0
SHA5126d2bad0e6ec7852d7b6d1a70a10285db28c06c37252503e01c52458a463582d5211b7e183ae064a36b60f990971a5b14f8af3aaaacc4226be1c2e3e0bf38af53
-
Filesize
89KB
MD58451a2c5daa42b25333b1b2089c5ea39
SHA1700cc99ec8d3113435e657070d2d6bde0a833adc
SHA256b8c8aedd84c363853db934a55087a3b730cf9dc758dea3dc3a98f54217f4c9d0
SHA5126d2bad0e6ec7852d7b6d1a70a10285db28c06c37252503e01c52458a463582d5211b7e183ae064a36b60f990971a5b14f8af3aaaacc4226be1c2e3e0bf38af53
-
Filesize
89KB
MD58451a2c5daa42b25333b1b2089c5ea39
SHA1700cc99ec8d3113435e657070d2d6bde0a833adc
SHA256b8c8aedd84c363853db934a55087a3b730cf9dc758dea3dc3a98f54217f4c9d0
SHA5126d2bad0e6ec7852d7b6d1a70a10285db28c06c37252503e01c52458a463582d5211b7e183ae064a36b60f990971a5b14f8af3aaaacc4226be1c2e3e0bf38af53
-
Filesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5