Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

6ba9caf5b6...c8.exe

windows7-x64

6

6ba9caf5b6...c8.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    185s
  • max time network
    201s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/10/2023, 06:10

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    6ba9caf5b6ce008df3e85986c46cb205262dd85c98f70c7f33f6016d6b6fabc8.exe

  • Size

    108KB

  • MD5

    af9f0235192180cf4483dff09a8c282d

  • SHA1

    bc5d74f26702a7a707f80f232502a181595b34d1

  • SHA256

    6ba9caf5b6ce008df3e85986c46cb205262dd85c98f70c7f33f6016d6b6fabc8

  • SHA512

    f3b5666e964d4120c950c37efd192517738703e1c3a05aaeb62c5c9b04cab67e60163d539c8b3ca0fa880e5278cf7ea6fac59c3216d593c1c536446feaf9a6ff

  • SSDEEP

    3072:MscXcqJBj7zrjbYze9jG9zdidWymoskh+gQ:q/Jt7LDo9zdidWzosk

Score
7/10
persistence

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Control Panel 43 IoCs
    evasion
  • Modifies registry key 1 TTPs 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6ba9caf5b6ce008df3e85986c46cb205262dd85c98f70c7f33f6016d6b6fabc8.exe
    "C:\Users\Admin\AppData\Local\Temp\6ba9caf5b6ce008df3e85986c46cb205262dd85c98f70c7f33f6016d6b6fabc8.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Modifies Control Panel
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:460
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UpdateReg.bat" "
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1440
      • C:\Windows\SysWOW64\reg.exe
        REG Add HKLM\Software\BohaoSoft\Market2 /v Path /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\\" /f /reg:64
        3⤵
        • Modifies registry key
        PID:4704
      • C:\Windows\SysWOW64\reg.exe
        REG Add HKLM\Software\BohaoSoft\Market2 /v Version /t REG_SZ /d "2.98.1212" /f /reg:64
        3⤵
        • Modifies registry key
        PID:3728
      • C:\Windows\SysWOW64\reg.exe
        REG Add "HKLM\Software\ActiveXperts\Serial Port Component" /v LicenseKey /t REG_SZ /d "01EC7-5DB2E-86042" /f /reg:64
        3⤵
          PID:4976

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\UpdateReg.bat
      Filesize

      329B

      MD5

      43de8352f4873246b3feeff9171096d1

      SHA1

      d04e380fe82d9f54c616ba2773fdb5666915a101

      SHA256

      b9e5435fd27b228a82359bf946d7cdd65ccea06e4e23c07271e51129672196e7

      SHA512

      30e331b6b8f351ebf42b0cebdd848d132c0abddc5b07fb26cd71371ab71a6e559c36c72a14262153601944795e4331506b9f717db9962b14391b37ca4f9bb46c

      Download Submit