Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
06/08/2023, 08:30
Static task
static1
Behavioral task
behavioral1
Sample
96ae93cedac45544172c20d2b513301dea9936f412b098b7dfc5592b9fd2a29e.exe
Resource
win10v2004-20230703-en
General
-
Target
96ae93cedac45544172c20d2b513301dea9936f412b098b7dfc5592b9fd2a29e.exe
-
Size
2.7MB
-
MD5
7a79ef7c6cf5459d1bc9bbf354b88b6b
-
SHA1
5ea850f0b9dac1c99c1505dec317b806e5b19a93
-
SHA256
96ae93cedac45544172c20d2b513301dea9936f412b098b7dfc5592b9fd2a29e
-
SHA512
2a2fc49d4a6937f6ecef3d643cc490eb052535cbe4ac6fabbe0c04c18560552a2278048f2d8d39e739fa7c677e7b0bd7974c095cf474b48a30872f064e17ebbc
-
SSDEEP
49152:rLLWqo8KBZjPGdcxS6crimOoTIBn3Qd+d5xaKbhVCPf5clxevQd4:r+jbJG65QT+3QdcxaKvCPfvvQd4
Malware Config
Signatures
-
Loads dropped DLL 2 IoCs
pid Process 1208 rundll32.exe 1524 rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000_Classes\Local Settings 96ae93cedac45544172c20d2b513301dea9936f412b098b7dfc5592b9fd2a29e.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2584 wrote to memory of 3540 2584 96ae93cedac45544172c20d2b513301dea9936f412b098b7dfc5592b9fd2a29e.exe 81 PID 2584 wrote to memory of 3540 2584 96ae93cedac45544172c20d2b513301dea9936f412b098b7dfc5592b9fd2a29e.exe 81 PID 2584 wrote to memory of 3540 2584 96ae93cedac45544172c20d2b513301dea9936f412b098b7dfc5592b9fd2a29e.exe 81 PID 3540 wrote to memory of 1208 3540 control.exe 84 PID 3540 wrote to memory of 1208 3540 control.exe 84 PID 3540 wrote to memory of 1208 3540 control.exe 84 PID 1208 wrote to memory of 484 1208 rundll32.exe 92 PID 1208 wrote to memory of 484 1208 rundll32.exe 92 PID 484 wrote to memory of 1524 484 RunDll32.exe 93 PID 484 wrote to memory of 1524 484 RunDll32.exe 93 PID 484 wrote to memory of 1524 484 RunDll32.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\96ae93cedac45544172c20d2b513301dea9936f412b098b7dfc5592b9fd2a29e.exe"C:\Users\Admin\AppData\Local\Temp\96ae93cedac45544172c20d2b513301dea9936f412b098b7dfc5592b9fd2a29e.exe"1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Windows\SysWOW64\control.exe"C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\S5eLJ.cPl",2⤵
- Suspicious use of WriteProcessMemory
PID:3540 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\S5eLJ.cPl",3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Windows\system32\RunDll32.exeC:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\S5eLJ.cPl",4⤵
- Suspicious use of WriteProcessMemory
PID:484 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 "C:\Users\Admin\AppData\Local\Temp\S5eLJ.cPl",5⤵
- Loads dropped DLL
PID:1524
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.4MB
MD5abba001cf2118eee920cd99c5042b709
SHA1b8941db07ed0819ee9dbd2a4a3f66d1d59ae2f05
SHA256d06c0d095d910f3dda41d2f89a85e06d7f7b24a835712e9d6b51f4a9869aea10
SHA5121283be779a3a03d89092f894705dc9a387e6713bd263f526294bbe4ccf773b92eed6a21ca1ce5af286db4e43a40798adb080eb22c61ec020220dd7df9848c1a1
-
Filesize
2.4MB
MD5abba001cf2118eee920cd99c5042b709
SHA1b8941db07ed0819ee9dbd2a4a3f66d1d59ae2f05
SHA256d06c0d095d910f3dda41d2f89a85e06d7f7b24a835712e9d6b51f4a9869aea10
SHA5121283be779a3a03d89092f894705dc9a387e6713bd263f526294bbe4ccf773b92eed6a21ca1ce5af286db4e43a40798adb080eb22c61ec020220dd7df9848c1a1
-
Filesize
2.4MB
MD5abba001cf2118eee920cd99c5042b709
SHA1b8941db07ed0819ee9dbd2a4a3f66d1d59ae2f05
SHA256d06c0d095d910f3dda41d2f89a85e06d7f7b24a835712e9d6b51f4a9869aea10
SHA5121283be779a3a03d89092f894705dc9a387e6713bd263f526294bbe4ccf773b92eed6a21ca1ce5af286db4e43a40798adb080eb22c61ec020220dd7df9848c1a1
-
Filesize
2.4MB
MD5abba001cf2118eee920cd99c5042b709
SHA1b8941db07ed0819ee9dbd2a4a3f66d1d59ae2f05
SHA256d06c0d095d910f3dda41d2f89a85e06d7f7b24a835712e9d6b51f4a9869aea10
SHA5121283be779a3a03d89092f894705dc9a387e6713bd263f526294bbe4ccf773b92eed6a21ca1ce5af286db4e43a40798adb080eb22c61ec020220dd7df9848c1a1