Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
19/07/2023, 02:55
Static task
static1
Behavioral task
behavioral1
Sample
6fa95e4e25eb2cf60595af08ca20573f260e87b40a8202bbcfeb439634f0aeb6.exe
Resource
win10v2004-20230703-en
General
-
Target
6fa95e4e25eb2cf60595af08ca20573f260e87b40a8202bbcfeb439634f0aeb6.exe
-
Size
1.8MB
-
MD5
b15a0e59e709856f57c011a4110fae6b
-
SHA1
53b9ba00065d07992fab361316441de49eda1626
-
SHA256
6fa95e4e25eb2cf60595af08ca20573f260e87b40a8202bbcfeb439634f0aeb6
-
SHA512
f79f92a8f6bbdb7902f676f712ebfb61ffc0ba14020c09bf397ea1ce56fc17f64227a345c61d0e63de51fe27d828c7d8961ed9026a556efe4815a9661e7012d3
-
SSDEEP
49152:zereFL30O/xFBOFFW34tx9sZ7/3UY0nb5D:zueFF/xrMO4P9s10t
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\Control Panel\International\Geo\Nation 6fa95e4e25eb2cf60595af08ca20573f260e87b40a8202bbcfeb439634f0aeb6.exe -
Loads dropped DLL 2 IoCs
pid Process 220 rundll32.exe 1132 rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000_Classes\Local Settings 6fa95e4e25eb2cf60595af08ca20573f260e87b40a8202bbcfeb439634f0aeb6.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 1576 wrote to memory of 744 1576 6fa95e4e25eb2cf60595af08ca20573f260e87b40a8202bbcfeb439634f0aeb6.exe 85 PID 1576 wrote to memory of 744 1576 6fa95e4e25eb2cf60595af08ca20573f260e87b40a8202bbcfeb439634f0aeb6.exe 85 PID 1576 wrote to memory of 744 1576 6fa95e4e25eb2cf60595af08ca20573f260e87b40a8202bbcfeb439634f0aeb6.exe 85 PID 744 wrote to memory of 220 744 control.exe 87 PID 744 wrote to memory of 220 744 control.exe 87 PID 744 wrote to memory of 220 744 control.exe 87 PID 220 wrote to memory of 716 220 rundll32.exe 94 PID 220 wrote to memory of 716 220 rundll32.exe 94 PID 716 wrote to memory of 1132 716 RunDll32.exe 95 PID 716 wrote to memory of 1132 716 RunDll32.exe 95 PID 716 wrote to memory of 1132 716 RunDll32.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\6fa95e4e25eb2cf60595af08ca20573f260e87b40a8202bbcfeb439634f0aeb6.exe"C:\Users\Admin\AppData\Local\Temp\6fa95e4e25eb2cf60595af08ca20573f260e87b40a8202bbcfeb439634f0aeb6.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1576 -
C:\Windows\SysWOW64\control.exe"C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\LJtDWS~O.cpl",2⤵
- Suspicious use of WriteProcessMemory
PID:744 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\LJtDWS~O.cpl",3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:220 -
C:\Windows\system32\RunDll32.exeC:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\LJtDWS~O.cpl",4⤵
- Suspicious use of WriteProcessMemory
PID:716 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 "C:\Users\Admin\AppData\Local\Temp\LJtDWS~O.cpl",5⤵
- Loads dropped DLL
PID:1132
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD5c18be9990d123202d3a6f04d2565c9fc
SHA115ffd3ff9f0d3b96e78d87cd2a8141f060c67902
SHA256fe587e83e84faaaf71bce643c77b077a3c8162bb63973cc43831a0f9f4c7dbe9
SHA5126000ad5d38b3ee99fd4391c01949ebc5a2b6243ad0c7062fc157926cece51abbff56526d5c8c350de5a492e60035b46b8b50b7217a348a1b5160caa82cc54296
-
Filesize
1.3MB
MD5c18be9990d123202d3a6f04d2565c9fc
SHA115ffd3ff9f0d3b96e78d87cd2a8141f060c67902
SHA256fe587e83e84faaaf71bce643c77b077a3c8162bb63973cc43831a0f9f4c7dbe9
SHA5126000ad5d38b3ee99fd4391c01949ebc5a2b6243ad0c7062fc157926cece51abbff56526d5c8c350de5a492e60035b46b8b50b7217a348a1b5160caa82cc54296
-
Filesize
1.3MB
MD5c18be9990d123202d3a6f04d2565c9fc
SHA115ffd3ff9f0d3b96e78d87cd2a8141f060c67902
SHA256fe587e83e84faaaf71bce643c77b077a3c8162bb63973cc43831a0f9f4c7dbe9
SHA5126000ad5d38b3ee99fd4391c01949ebc5a2b6243ad0c7062fc157926cece51abbff56526d5c8c350de5a492e60035b46b8b50b7217a348a1b5160caa82cc54296
-
Filesize
1.3MB
MD5c18be9990d123202d3a6f04d2565c9fc
SHA115ffd3ff9f0d3b96e78d87cd2a8141f060c67902
SHA256fe587e83e84faaaf71bce643c77b077a3c8162bb63973cc43831a0f9f4c7dbe9
SHA5126000ad5d38b3ee99fd4391c01949ebc5a2b6243ad0c7062fc157926cece51abbff56526d5c8c350de5a492e60035b46b8b50b7217a348a1b5160caa82cc54296