Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
93s -
max time network
115s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
06/06/2023, 18:22
Static task
static1
Behavioral task
behavioral1
Sample
79a4615df5fc5115056d6cd748d70490cf81322629b753ad26864e4a29b75e9d.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
79a4615df5fc5115056d6cd748d70490cf81322629b753ad26864e4a29b75e9d.exe
Resource
win10v2004-20230221-en
General
-
Target
79a4615df5fc5115056d6cd748d70490cf81322629b753ad26864e4a29b75e9d.exe
-
Size
2.3MB
-
MD5
2572c890776f92894c0e45f971de9f0b
-
SHA1
cc93bea092bcd70d4fe0b6d3d283f1fbea847bde
-
SHA256
79a4615df5fc5115056d6cd748d70490cf81322629b753ad26864e4a29b75e9d
-
SHA512
f18798d75fc90efb671eec96fb821d2c52ab1e8a96ee053bd593ab4507d6bc2cc61cbc88c84b2f8081e501a02cff17dc5eb2239d02be4b63883db12bc9245840
-
SSDEEP
49152:YrS/CzXaWG55+ovfGYqEAf8RlPMJlio68D:YrYCraWG55+ovfGYqEAf8RlPlo68
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation 79a4615df5fc5115056d6cd748d70490cf81322629b753ad26864e4a29b75e9d.exe Key value queried \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation 79a4615df5fc5115056d6cd748d70490cf81322629b753ad26864e4a29b75e9d.exe -
Executes dropped EXE 1 IoCs
pid Process 3448 79a4615df5fc5115056d6cd748d70490cf81322629b753ad26864e4a29b75e9d.exe -
Loads dropped DLL 1 IoCs
pid Process 3448 79a4615df5fc5115056d6cd748d70490cf81322629b753ad26864e4a29b75e9d.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\S: 79a4615df5fc5115056d6cd748d70490cf81322629b753ad26864e4a29b75e9d.exe File opened (read-only) \??\M: 79a4615df5fc5115056d6cd748d70490cf81322629b753ad26864e4a29b75e9d.exe File opened (read-only) \??\F: 79a4615df5fc5115056d6cd748d70490cf81322629b753ad26864e4a29b75e9d.exe File opened (read-only) \??\L: 79a4615df5fc5115056d6cd748d70490cf81322629b753ad26864e4a29b75e9d.exe File opened (read-only) \??\X: 79a4615df5fc5115056d6cd748d70490cf81322629b753ad26864e4a29b75e9d.exe File opened (read-only) \??\W: 79a4615df5fc5115056d6cd748d70490cf81322629b753ad26864e4a29b75e9d.exe File opened (read-only) \??\T: 79a4615df5fc5115056d6cd748d70490cf81322629b753ad26864e4a29b75e9d.exe File opened (read-only) \??\Q: 79a4615df5fc5115056d6cd748d70490cf81322629b753ad26864e4a29b75e9d.exe File opened (read-only) \??\P: 79a4615df5fc5115056d6cd748d70490cf81322629b753ad26864e4a29b75e9d.exe File opened (read-only) \??\O: 79a4615df5fc5115056d6cd748d70490cf81322629b753ad26864e4a29b75e9d.exe File opened (read-only) \??\N: 79a4615df5fc5115056d6cd748d70490cf81322629b753ad26864e4a29b75e9d.exe File opened (read-only) \??\K: 79a4615df5fc5115056d6cd748d70490cf81322629b753ad26864e4a29b75e9d.exe File opened (read-only) \??\Y: 79a4615df5fc5115056d6cd748d70490cf81322629b753ad26864e4a29b75e9d.exe File opened (read-only) \??\U: 79a4615df5fc5115056d6cd748d70490cf81322629b753ad26864e4a29b75e9d.exe File opened (read-only) \??\R: 79a4615df5fc5115056d6cd748d70490cf81322629b753ad26864e4a29b75e9d.exe File opened (read-only) \??\I: 79a4615df5fc5115056d6cd748d70490cf81322629b753ad26864e4a29b75e9d.exe File opened (read-only) \??\Z: 79a4615df5fc5115056d6cd748d70490cf81322629b753ad26864e4a29b75e9d.exe File opened (read-only) \??\V: 79a4615df5fc5115056d6cd748d70490cf81322629b753ad26864e4a29b75e9d.exe File opened (read-only) \??\J: 79a4615df5fc5115056d6cd748d70490cf81322629b753ad26864e4a29b75e9d.exe File opened (read-only) \??\H: 79a4615df5fc5115056d6cd748d70490cf81322629b753ad26864e4a29b75e9d.exe File opened (read-only) \??\G: 79a4615df5fc5115056d6cd748d70490cf81322629b753ad26864e4a29b75e9d.exe File opened (read-only) \??\E: 79a4615df5fc5115056d6cd748d70490cf81322629b753ad26864e4a29b75e9d.exe File opened (read-only) \??\D: 79a4615df5fc5115056d6cd748d70490cf81322629b753ad26864e4a29b75e9d.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\xjkSet_220605\79a4615df5fc5115056d6cd748d70490cf81322629b753ad26864e4a29b75e9d.exe 79a4615df5fc5115056d6cd748d70490cf81322629b753ad26864e4a29b75e9d.exe File created C:\Program Files (x86)\xjkSet_220605\api2xxx_dll_M.dll 79a4615df5fc5115056d6cd748d70490cf81322629b753ad26864e4a29b75e9d.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4824 79a4615df5fc5115056d6cd748d70490cf81322629b753ad26864e4a29b75e9d.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 4824 79a4615df5fc5115056d6cd748d70490cf81322629b753ad26864e4a29b75e9d.exe 4824 79a4615df5fc5115056d6cd748d70490cf81322629b753ad26864e4a29b75e9d.exe 3448 79a4615df5fc5115056d6cd748d70490cf81322629b753ad26864e4a29b75e9d.exe 3448 79a4615df5fc5115056d6cd748d70490cf81322629b753ad26864e4a29b75e9d.exe 3448 79a4615df5fc5115056d6cd748d70490cf81322629b753ad26864e4a29b75e9d.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4824 wrote to memory of 3448 4824 79a4615df5fc5115056d6cd748d70490cf81322629b753ad26864e4a29b75e9d.exe 76 PID 4824 wrote to memory of 3448 4824 79a4615df5fc5115056d6cd748d70490cf81322629b753ad26864e4a29b75e9d.exe 76 PID 4824 wrote to memory of 3448 4824 79a4615df5fc5115056d6cd748d70490cf81322629b753ad26864e4a29b75e9d.exe 76 PID 3448 wrote to memory of 2756 3448 79a4615df5fc5115056d6cd748d70490cf81322629b753ad26864e4a29b75e9d.exe 79 PID 3448 wrote to memory of 2756 3448 79a4615df5fc5115056d6cd748d70490cf81322629b753ad26864e4a29b75e9d.exe 79 PID 3448 wrote to memory of 2756 3448 79a4615df5fc5115056d6cd748d70490cf81322629b753ad26864e4a29b75e9d.exe 79 PID 3448 wrote to memory of 3492 3448 79a4615df5fc5115056d6cd748d70490cf81322629b753ad26864e4a29b75e9d.exe 81 PID 3448 wrote to memory of 3492 3448 79a4615df5fc5115056d6cd748d70490cf81322629b753ad26864e4a29b75e9d.exe 81 PID 3448 wrote to memory of 3492 3448 79a4615df5fc5115056d6cd748d70490cf81322629b753ad26864e4a29b75e9d.exe 81 PID 3448 wrote to memory of 4124 3448 79a4615df5fc5115056d6cd748d70490cf81322629b753ad26864e4a29b75e9d.exe 83 PID 3448 wrote to memory of 4124 3448 79a4615df5fc5115056d6cd748d70490cf81322629b753ad26864e4a29b75e9d.exe 83 PID 3448 wrote to memory of 4124 3448 79a4615df5fc5115056d6cd748d70490cf81322629b753ad26864e4a29b75e9d.exe 83 PID 3448 wrote to memory of 3808 3448 79a4615df5fc5115056d6cd748d70490cf81322629b753ad26864e4a29b75e9d.exe 85 PID 3448 wrote to memory of 3808 3448 79a4615df5fc5115056d6cd748d70490cf81322629b753ad26864e4a29b75e9d.exe 85 PID 3448 wrote to memory of 3808 3448 79a4615df5fc5115056d6cd748d70490cf81322629b753ad26864e4a29b75e9d.exe 85 PID 3448 wrote to memory of 4248 3448 79a4615df5fc5115056d6cd748d70490cf81322629b753ad26864e4a29b75e9d.exe 87 PID 3448 wrote to memory of 4248 3448 79a4615df5fc5115056d6cd748d70490cf81322629b753ad26864e4a29b75e9d.exe 87 PID 3448 wrote to memory of 4248 3448 79a4615df5fc5115056d6cd748d70490cf81322629b753ad26864e4a29b75e9d.exe 87 PID 3448 wrote to memory of 5064 3448 79a4615df5fc5115056d6cd748d70490cf81322629b753ad26864e4a29b75e9d.exe 89 PID 3448 wrote to memory of 5064 3448 79a4615df5fc5115056d6cd748d70490cf81322629b753ad26864e4a29b75e9d.exe 89 PID 3448 wrote to memory of 5064 3448 79a4615df5fc5115056d6cd748d70490cf81322629b753ad26864e4a29b75e9d.exe 89 PID 3448 wrote to memory of 2584 3448 79a4615df5fc5115056d6cd748d70490cf81322629b753ad26864e4a29b75e9d.exe 91 PID 3448 wrote to memory of 2584 3448 79a4615df5fc5115056d6cd748d70490cf81322629b753ad26864e4a29b75e9d.exe 91 PID 3448 wrote to memory of 2584 3448 79a4615df5fc5115056d6cd748d70490cf81322629b753ad26864e4a29b75e9d.exe 91 PID 3448 wrote to memory of 1716 3448 79a4615df5fc5115056d6cd748d70490cf81322629b753ad26864e4a29b75e9d.exe 93 PID 3448 wrote to memory of 1716 3448 79a4615df5fc5115056d6cd748d70490cf81322629b753ad26864e4a29b75e9d.exe 93 PID 3448 wrote to memory of 1716 3448 79a4615df5fc5115056d6cd748d70490cf81322629b753ad26864e4a29b75e9d.exe 93 PID 3448 wrote to memory of 1944 3448 79a4615df5fc5115056d6cd748d70490cf81322629b753ad26864e4a29b75e9d.exe 95 PID 3448 wrote to memory of 1944 3448 79a4615df5fc5115056d6cd748d70490cf81322629b753ad26864e4a29b75e9d.exe 95 PID 3448 wrote to memory of 1944 3448 79a4615df5fc5115056d6cd748d70490cf81322629b753ad26864e4a29b75e9d.exe 95 PID 3448 wrote to memory of 5092 3448 79a4615df5fc5115056d6cd748d70490cf81322629b753ad26864e4a29b75e9d.exe 97 PID 3448 wrote to memory of 5092 3448 79a4615df5fc5115056d6cd748d70490cf81322629b753ad26864e4a29b75e9d.exe 97 PID 3448 wrote to memory of 5092 3448 79a4615df5fc5115056d6cd748d70490cf81322629b753ad26864e4a29b75e9d.exe 97 PID 3448 wrote to memory of 4996 3448 79a4615df5fc5115056d6cd748d70490cf81322629b753ad26864e4a29b75e9d.exe 101 PID 3448 wrote to memory of 4996 3448 79a4615df5fc5115056d6cd748d70490cf81322629b753ad26864e4a29b75e9d.exe 101 PID 3448 wrote to memory of 4996 3448 79a4615df5fc5115056d6cd748d70490cf81322629b753ad26864e4a29b75e9d.exe 101 PID 3448 wrote to memory of 4744 3448 79a4615df5fc5115056d6cd748d70490cf81322629b753ad26864e4a29b75e9d.exe 99 PID 3448 wrote to memory of 4744 3448 79a4615df5fc5115056d6cd748d70490cf81322629b753ad26864e4a29b75e9d.exe 99 PID 3448 wrote to memory of 4744 3448 79a4615df5fc5115056d6cd748d70490cf81322629b753ad26864e4a29b75e9d.exe 99 PID 3448 wrote to memory of 1044 3448 79a4615df5fc5115056d6cd748d70490cf81322629b753ad26864e4a29b75e9d.exe 103 PID 3448 wrote to memory of 1044 3448 79a4615df5fc5115056d6cd748d70490cf81322629b753ad26864e4a29b75e9d.exe 103 PID 3448 wrote to memory of 1044 3448 79a4615df5fc5115056d6cd748d70490cf81322629b753ad26864e4a29b75e9d.exe 103 PID 3448 wrote to memory of 4332 3448 79a4615df5fc5115056d6cd748d70490cf81322629b753ad26864e4a29b75e9d.exe 105 PID 3448 wrote to memory of 4332 3448 79a4615df5fc5115056d6cd748d70490cf81322629b753ad26864e4a29b75e9d.exe 105 PID 3448 wrote to memory of 4332 3448 79a4615df5fc5115056d6cd748d70490cf81322629b753ad26864e4a29b75e9d.exe 105 PID 3448 wrote to memory of 4416 3448 79a4615df5fc5115056d6cd748d70490cf81322629b753ad26864e4a29b75e9d.exe 106 PID 3448 wrote to memory of 4416 3448 79a4615df5fc5115056d6cd748d70490cf81322629b753ad26864e4a29b75e9d.exe 106 PID 3448 wrote to memory of 4416 3448 79a4615df5fc5115056d6cd748d70490cf81322629b753ad26864e4a29b75e9d.exe 106 PID 3448 wrote to memory of 3512 3448 79a4615df5fc5115056d6cd748d70490cf81322629b753ad26864e4a29b75e9d.exe 108 PID 3448 wrote to memory of 3512 3448 79a4615df5fc5115056d6cd748d70490cf81322629b753ad26864e4a29b75e9d.exe 108 PID 3448 wrote to memory of 3512 3448 79a4615df5fc5115056d6cd748d70490cf81322629b753ad26864e4a29b75e9d.exe 108 PID 3448 wrote to memory of 976 3448 79a4615df5fc5115056d6cd748d70490cf81322629b753ad26864e4a29b75e9d.exe 116 PID 3448 wrote to memory of 976 3448 79a4615df5fc5115056d6cd748d70490cf81322629b753ad26864e4a29b75e9d.exe 116 PID 3448 wrote to memory of 976 3448 79a4615df5fc5115056d6cd748d70490cf81322629b753ad26864e4a29b75e9d.exe 116 PID 3448 wrote to memory of 656 3448 79a4615df5fc5115056d6cd748d70490cf81322629b753ad26864e4a29b75e9d.exe 112 PID 3448 wrote to memory of 656 3448 79a4615df5fc5115056d6cd748d70490cf81322629b753ad26864e4a29b75e9d.exe 112 PID 3448 wrote to memory of 656 3448 79a4615df5fc5115056d6cd748d70490cf81322629b753ad26864e4a29b75e9d.exe 112 PID 3448 wrote to memory of 700 3448 79a4615df5fc5115056d6cd748d70490cf81322629b753ad26864e4a29b75e9d.exe 113 PID 3448 wrote to memory of 700 3448 79a4615df5fc5115056d6cd748d70490cf81322629b753ad26864e4a29b75e9d.exe 113 PID 3448 wrote to memory of 700 3448 79a4615df5fc5115056d6cd748d70490cf81322629b753ad26864e4a29b75e9d.exe 113 PID 3448 wrote to memory of 3456 3448 79a4615df5fc5115056d6cd748d70490cf81322629b753ad26864e4a29b75e9d.exe 117 PID 3448 wrote to memory of 3456 3448 79a4615df5fc5115056d6cd748d70490cf81322629b753ad26864e4a29b75e9d.exe 117 PID 3448 wrote to memory of 3456 3448 79a4615df5fc5115056d6cd748d70490cf81322629b753ad26864e4a29b75e9d.exe 117 PID 3448 wrote to memory of 4412 3448 79a4615df5fc5115056d6cd748d70490cf81322629b753ad26864e4a29b75e9d.exe 120
Processes
-
C:\Users\Admin\AppData\Local\Temp\79a4615df5fc5115056d6cd748d70490cf81322629b753ad26864e4a29b75e9d.exe"C:\Users\Admin\AppData\Local\Temp\79a4615df5fc5115056d6cd748d70490cf81322629b753ad26864e4a29b75e9d.exe"1⤵
- Checks computer location settings
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\Program Files (x86)\xjkSet_220605\79a4615df5fc5115056d6cd748d70490cf81322629b753ad26864e4a29b75e9d.exe"C:\Program Files (x86)\xjkSet_220605\79a4615df5fc5115056d6cd748d70490cf81322629b753ad26864e4a29b75e9d.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3448 -
C:\Windows\SysWOW64\subst.exe"C:\Windows\System32\subst.exe" C: /D3⤵PID:2756
-
-
C:\Windows\SysWOW64\subst.exe"C:\Windows\System32\subst.exe" D: /D3⤵PID:3492
-
-
C:\Windows\SysWOW64\subst.exe"C:\Windows\System32\subst.exe" E: /D3⤵PID:4124
-
-
C:\Windows\SysWOW64\subst.exe"C:\Windows\System32\subst.exe" F: /D3⤵PID:3808
-
-
C:\Windows\SysWOW64\subst.exe"C:\Windows\System32\subst.exe" G: /D3⤵PID:4248
-
-
C:\Windows\SysWOW64\subst.exe"C:\Windows\System32\subst.exe" H: /D3⤵PID:5064
-
-
C:\Windows\SysWOW64\subst.exe"C:\Windows\System32\subst.exe" I: /D3⤵PID:2584
-
-
C:\Windows\SysWOW64\subst.exe"C:\Windows\System32\subst.exe" J: /D3⤵PID:1716
-
-
C:\Windows\SysWOW64\subst.exe"C:\Windows\System32\subst.exe" K: /D3⤵PID:1944
-
-
C:\Windows\SysWOW64\subst.exe"C:\Windows\System32\subst.exe" L: /D3⤵PID:5092
-
-
C:\Windows\SysWOW64\subst.exe"C:\Windows\System32\subst.exe" N: /D3⤵PID:4744
-
-
C:\Windows\SysWOW64\subst.exe"C:\Windows\System32\subst.exe" M: /D3⤵PID:4996
-
-
C:\Windows\SysWOW64\subst.exe"C:\Windows\System32\subst.exe" O: /D3⤵PID:1044
-
-
C:\Windows\SysWOW64\subst.exe"C:\Windows\System32\subst.exe" P: /D3⤵PID:4332
-
-
C:\Windows\SysWOW64\subst.exe"C:\Windows\System32\subst.exe" Q: /D3⤵PID:4416
-
-
C:\Windows\SysWOW64\subst.exe"C:\Windows\System32\subst.exe" R: /D3⤵PID:3512
-
-
C:\Windows\SysWOW64\subst.exe"C:\Windows\System32\subst.exe" T: /D3⤵PID:656
-
-
C:\Windows\SysWOW64\subst.exe"C:\Windows\System32\subst.exe" U: /D3⤵PID:700
-
-
C:\Windows\SysWOW64\subst.exe"C:\Windows\System32\subst.exe" S: /D3⤵PID:976
-
-
C:\Windows\SysWOW64\subst.exe"C:\Windows\System32\subst.exe" V: /D3⤵PID:3456
-
-
C:\Windows\SysWOW64\subst.exe"C:\Windows\System32\subst.exe" W: /D3⤵PID:4412
-
-
C:\Windows\SysWOW64\subst.exe"C:\Windows\System32\subst.exe" Y: /D3⤵PID:244
-
-
C:\Windows\SysWOW64\subst.exe"C:\Windows\System32\subst.exe" Z: /D3⤵PID:1540
-
-
C:\Windows\SysWOW64\subst.exe"C:\Windows\System32\subst.exe" X: /D3⤵PID:2160
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\xjkSet_220605\79a4615df5fc5115056d6cd748d70490cf81322629b753ad26864e4a29b75e9d.exe
Filesize300KB
MD55ff996cd94bec3ea22f8f1fc902029cf
SHA1a75f6a96b4be036699eebbdff84cdae2c5de84a8
SHA256d11446931035181c951a5b853f44c82c27d653185e7edee0c2de518abdb3945f
SHA512396eb61ea00139355faac12c378765f8dc67af025c879f5e6538218c2115217f01139315467ecd9c6c50414f10c211d7c1963c246a80247f3320180f06790fe7
-
C:\Program Files (x86)\xjkSet_220605\79a4615df5fc5115056d6cd748d70490cf81322629b753ad26864e4a29b75e9d.exe
Filesize300KB
MD55ff996cd94bec3ea22f8f1fc902029cf
SHA1a75f6a96b4be036699eebbdff84cdae2c5de84a8
SHA256d11446931035181c951a5b853f44c82c27d653185e7edee0c2de518abdb3945f
SHA512396eb61ea00139355faac12c378765f8dc67af025c879f5e6538218c2115217f01139315467ecd9c6c50414f10c211d7c1963c246a80247f3320180f06790fe7
-
C:\Program Files (x86)\xjkSet_220605\79a4615df5fc5115056d6cd748d70490cf81322629b753ad26864e4a29b75e9d.exe
Filesize300KB
MD55ff996cd94bec3ea22f8f1fc902029cf
SHA1a75f6a96b4be036699eebbdff84cdae2c5de84a8
SHA256d11446931035181c951a5b853f44c82c27d653185e7edee0c2de518abdb3945f
SHA512396eb61ea00139355faac12c378765f8dc67af025c879f5e6538218c2115217f01139315467ecd9c6c50414f10c211d7c1963c246a80247f3320180f06790fe7
-
Filesize
1.8MB
MD5ff1c75cd32367a44baba026c6e65d237
SHA1a89c7f1a61a4d88fcd06d6a261534fbfd1d12020
SHA256792f847ac258fdfa929a7bcce0c7d8e3653e6cbe8814b5fdb047235e798a9f35
SHA5124d5866c40f9d69bcbea061f46790d7bc7fc3379cc8a2609bab7bdb88d75e0f8bfe7d908a2ce28e4de411c179fdfd84052bf043bdf0be311c95be92887f167a5a
-
Filesize
1.8MB
MD5ff1c75cd32367a44baba026c6e65d237
SHA1a89c7f1a61a4d88fcd06d6a261534fbfd1d12020
SHA256792f847ac258fdfa929a7bcce0c7d8e3653e6cbe8814b5fdb047235e798a9f35
SHA5124d5866c40f9d69bcbea061f46790d7bc7fc3379cc8a2609bab7bdb88d75e0f8bfe7d908a2ce28e4de411c179fdfd84052bf043bdf0be311c95be92887f167a5a