Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
123s -
max time network
131s -
platform
windows10-1703_x64 -
resource
win10-20230703-en -
resource tags
arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system -
submitted
27/08/2023, 15:11
Static task
static1
Behavioral task
behavioral1
Sample
3116278bbc60be67ae2884876133cc594b9efeb70710dd251e4e3283a28ce7f2.exe
Resource
win10-20230703-en
General
-
Target
3116278bbc60be67ae2884876133cc594b9efeb70710dd251e4e3283a28ce7f2.exe
-
Size
3.0MB
-
MD5
e4906eee0b813e779889c559f6ba6489
-
SHA1
cbf260ff621740b0f2fa9a7123e161f191121a92
-
SHA256
3116278bbc60be67ae2884876133cc594b9efeb70710dd251e4e3283a28ce7f2
-
SHA512
8b5cdade2505d7b3b5a63200ff210fff11fb327c609366bdd0ec5fc6954a74a20e5f210feaaea91ba6ff37d41ec8713835a4e314d6cd59282ddce7801d7badce
-
SSDEEP
98304:kWhSeBfKEGNO3Bi3ZoQu9xH51rZ9YTDD1TeTUiz:Cm3gJoQSxHDZOvpMUiz
Malware Config
Signatures
-
Loads dropped DLL 3 IoCs
pid Process 5004 rundll32.exe 972 rundll32.exe 972 rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1766410430-2870137818-4067673745-1000_Classes\Local Settings 3116278bbc60be67ae2884876133cc594b9efeb70710dd251e4e3283a28ce7f2.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 4816 wrote to memory of 4884 4816 3116278bbc60be67ae2884876133cc594b9efeb70710dd251e4e3283a28ce7f2.exe 69 PID 4816 wrote to memory of 4884 4816 3116278bbc60be67ae2884876133cc594b9efeb70710dd251e4e3283a28ce7f2.exe 69 PID 4816 wrote to memory of 4884 4816 3116278bbc60be67ae2884876133cc594b9efeb70710dd251e4e3283a28ce7f2.exe 69 PID 4884 wrote to memory of 5004 4884 control.exe 71 PID 4884 wrote to memory of 5004 4884 control.exe 71 PID 4884 wrote to memory of 5004 4884 control.exe 71 PID 5004 wrote to memory of 4032 5004 rundll32.exe 72 PID 5004 wrote to memory of 4032 5004 rundll32.exe 72 PID 4032 wrote to memory of 972 4032 RunDll32.exe 73 PID 4032 wrote to memory of 972 4032 RunDll32.exe 73 PID 4032 wrote to memory of 972 4032 RunDll32.exe 73
Processes
-
C:\Users\Admin\AppData\Local\Temp\3116278bbc60be67ae2884876133cc594b9efeb70710dd251e4e3283a28ce7f2.exe"C:\Users\Admin\AppData\Local\Temp\3116278bbc60be67ae2884876133cc594b9efeb70710dd251e4e3283a28ce7f2.exe"1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Windows\SysWOW64\control.exe"C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\1EHyC.cpl",2⤵
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\1EHyC.cpl",3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Windows\system32\RunDll32.exeC:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\1EHyC.cpl",4⤵
- Suspicious use of WriteProcessMemory
PID:4032 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 "C:\Users\Admin\AppData\Local\Temp\1EHyC.cpl",5⤵
- Loads dropped DLL
PID:972
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.6MB
MD547a8b04f2ffdc38ba095c8ceb6c9b555
SHA150a0caae1e2d9417f26bf027e75c607c7d3ed538
SHA25659c942fa22766ff4d5ec7561b905aebd4874756c9f7251b65eeb67ec9d94758f
SHA512caae235fa87282a38213221396734c01ef6b1811902da1714a9c5f68ef7e8e6c6feeee329b0a59eb7432b0eed3134fddaca80e04e9e16edb8b96ddcb6cd7a0b2
-
Filesize
2.6MB
MD547a8b04f2ffdc38ba095c8ceb6c9b555
SHA150a0caae1e2d9417f26bf027e75c607c7d3ed538
SHA25659c942fa22766ff4d5ec7561b905aebd4874756c9f7251b65eeb67ec9d94758f
SHA512caae235fa87282a38213221396734c01ef6b1811902da1714a9c5f68ef7e8e6c6feeee329b0a59eb7432b0eed3134fddaca80e04e9e16edb8b96ddcb6cd7a0b2
-
Filesize
2.6MB
MD547a8b04f2ffdc38ba095c8ceb6c9b555
SHA150a0caae1e2d9417f26bf027e75c607c7d3ed538
SHA25659c942fa22766ff4d5ec7561b905aebd4874756c9f7251b65eeb67ec9d94758f
SHA512caae235fa87282a38213221396734c01ef6b1811902da1714a9c5f68ef7e8e6c6feeee329b0a59eb7432b0eed3134fddaca80e04e9e16edb8b96ddcb6cd7a0b2
-
Filesize
2.6MB
MD547a8b04f2ffdc38ba095c8ceb6c9b555
SHA150a0caae1e2d9417f26bf027e75c607c7d3ed538
SHA25659c942fa22766ff4d5ec7561b905aebd4874756c9f7251b65eeb67ec9d94758f
SHA512caae235fa87282a38213221396734c01ef6b1811902da1714a9c5f68ef7e8e6c6feeee329b0a59eb7432b0eed3134fddaca80e04e9e16edb8b96ddcb6cd7a0b2