Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230621-en -
resource tags
arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system -
submitted
30/06/2023, 01:19
Static task
static1
Behavioral task
behavioral1
Sample
2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88.exe
Resource
win7-20230621-en
Behavioral task
behavioral2
Sample
2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88.exe
Resource
win10v2004-20230621-en
General
-
Target
2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88.exe
-
Size
8.2MB
-
MD5
49821681a577c7aa118eca3400d71d53
-
SHA1
e96ae5a5f90e3a4622b64e91d374bbbd102165d3
-
SHA256
2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88
-
SHA512
5985f9fe71814ebf41786ddb3c4d7a37cc31e79d81aab0d8008ab701325c404c1316a78eb96ace3f2be4394f3c4eed7249e1d54b526b1d8f6e84f00a18ef0002
-
SSDEEP
196608:ihTb9B0BPrDz4pxgZZPy5RmStgxb/z6FDiSJXqeUh4mT:MTb9epDz4MZZ4RmxYDiScfhH
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4129409437-3162877118-52503038-1000\Control Panel\International\Geo\Nation 2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88.lnk 2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88.lnk 2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88.exe -
Executes dropped EXE 2 IoCs
pid Process 4148 2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88.exe 3428 2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4129409437-3162877118-52503038-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88 = "C:\\Users\\Admin\\AppData\\Roaming\\2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88.exe" 2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 29 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 680 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
pid Process 3440 powershell.exe 3440 powershell.exe 2500 powershell.exe 2500 powershell.exe 4760 powershell.exe 4760 powershell.exe 1512 2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 1512 2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88.exe Token: SeDebugPrivilege 3440 powershell.exe Token: SeDebugPrivilege 2500 powershell.exe Token: SeDebugPrivilege 4760 powershell.exe Token: SeDebugPrivilege 4148 2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1512 2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1512 wrote to memory of 3440 1512 2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88.exe 90 PID 1512 wrote to memory of 3440 1512 2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88.exe 90 PID 1512 wrote to memory of 3440 1512 2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88.exe 90 PID 1512 wrote to memory of 2500 1512 2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88.exe 92 PID 1512 wrote to memory of 2500 1512 2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88.exe 92 PID 1512 wrote to memory of 2500 1512 2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88.exe 92 PID 1512 wrote to memory of 4760 1512 2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88.exe 94 PID 1512 wrote to memory of 4760 1512 2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88.exe 94 PID 1512 wrote to memory of 4760 1512 2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88.exe 94 PID 1512 wrote to memory of 680 1512 2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88.exe 97 PID 1512 wrote to memory of 680 1512 2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88.exe 97 PID 1512 wrote to memory of 680 1512 2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88.exe"C:\Users\Admin\AppData\Local\Temp\2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88.exe"1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3440
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2500
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4760
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88" /tr "C:\Users\Admin\AppData\Roaming\2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88.exe"2⤵
- Creates scheduled task(s)
PID:680
-
-
C:\Users\Admin\AppData\Roaming\2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88.exeC:\Users\Admin\AppData\Roaming\2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4148
-
C:\Users\Admin\AppData\Roaming\2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88.exeC:\Users\Admin\AppData\Roaming\2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88.exe1⤵
- Executes dropped EXE
PID:3428
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88.exe.log
Filesize1KB
MD5a9361ad30054d2f7665453449a9f03bf
SHA1247f441df6e20cd1c128f017948d76e1bd21577a
SHA256f85751be66e3fb20f9d61debb89a0e0d3e73e8d690b78f36b9877b9b8d5635c8
SHA51224e171e8a44053f0579fac9cd418fcde158b21c1ee471fd75e30c90a269508a33c08b775b4ffd01363e07199fca26577667a92f38838051051e311febb98b53f
-
Filesize
2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
Filesize
18KB
MD51a63f2f51f6d662b5d9b83f8beb6ec22
SHA1bdebcc8c56fd5d9ed3d84ca4cb3cce57aaa4cdc9
SHA256da29d7cfa1eb5a97999243ccc6f35ce4de0ac70666c34f058cecfc25142180af
SHA51255fac79e68cd367c6e6ab3a86a33c014b56ab7d26212d21ae24ff39e00076924fc5ab8e672cd202e91e671e6769445275810baec451cb89c7d6e0227adce77b0
-
Filesize
18KB
MD580ddfffa32e4984a7f4fd257a412d572
SHA1fa2dc15c8ca349e4dd4b60b871544ab627bed912
SHA256ee48952638584bb64fbceebebf669f336ff3d6fc338f7a25bd9f23fa08ec0eda
SHA512e8d89b577c81c23d26c45ff2a2c5122587053ef60a2ffda818d0cef8cdeda2233c969b83d4a867805242d422d8163103c742f437f72de3fee69c38c11d3322fa
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
8.2MB
MD549821681a577c7aa118eca3400d71d53
SHA1e96ae5a5f90e3a4622b64e91d374bbbd102165d3
SHA2562658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88
SHA5125985f9fe71814ebf41786ddb3c4d7a37cc31e79d81aab0d8008ab701325c404c1316a78eb96ace3f2be4394f3c4eed7249e1d54b526b1d8f6e84f00a18ef0002
-
Filesize
8.2MB
MD549821681a577c7aa118eca3400d71d53
SHA1e96ae5a5f90e3a4622b64e91d374bbbd102165d3
SHA2562658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88
SHA5125985f9fe71814ebf41786ddb3c4d7a37cc31e79d81aab0d8008ab701325c404c1316a78eb96ace3f2be4394f3c4eed7249e1d54b526b1d8f6e84f00a18ef0002
-
Filesize
8.2MB
MD549821681a577c7aa118eca3400d71d53
SHA1e96ae5a5f90e3a4622b64e91d374bbbd102165d3
SHA2562658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88
SHA5125985f9fe71814ebf41786ddb3c4d7a37cc31e79d81aab0d8008ab701325c404c1316a78eb96ace3f2be4394f3c4eed7249e1d54b526b1d8f6e84f00a18ef0002
-
Filesize
8.2MB
MD549821681a577c7aa118eca3400d71d53
SHA1e96ae5a5f90e3a4622b64e91d374bbbd102165d3
SHA2562658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88
SHA5125985f9fe71814ebf41786ddb3c4d7a37cc31e79d81aab0d8008ab701325c404c1316a78eb96ace3f2be4394f3c4eed7249e1d54b526b1d8f6e84f00a18ef0002