Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
10/10/2023, 21:35
Static task
static1
Behavioral task
behavioral1
Sample
c2366c6bdbe1cf73d9a5143bdfb174be_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
c2366c6bdbe1cf73d9a5143bdfb174be_JC.exe
Resource
win10v2004-20230915-en
General
-
Target
c2366c6bdbe1cf73d9a5143bdfb174be_JC.exe
-
Size
124KB
-
MD5
c2366c6bdbe1cf73d9a5143bdfb174be
-
SHA1
af6d1f0615d206a1cf5924d35ed39c581e2b498a
-
SHA256
e19e92308a0f36cf3de48aba6d968d47e1776105622c47481c20c76600ac4af9
-
SHA512
d1cacab1421573dc360cf4d4e4bc3a5045f7e840b94b76b71734f7e81414449440b31de367ad9df04a34642ecc20d87b8f0913d5a23558ceb5edae1bdfcb2b9b
-
SSDEEP
3072:a27TcK5uQxqTvCIDw0x+G3dF/Ytq7xIpNelN:/cguamrL/v7xIpNiN
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Control Panel\International\Geo\Nation c2366c6bdbe1cf73d9a5143bdfb174be_JC.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IntelPowerAgent1 = "rundll32.exe shell32.dll, ShellExec_RunDLL C:\\PROGRA~3\\9c431685.exe" svchost.exe -
Checks for any installed AV software in registry 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Software\WOW6432Node\Avira svchost.exe Key opened \REGISTRY\MACHINE\Software\WOW6432Node\AVAST Software\Avast svchost.exe Key opened \REGISTRY\MACHINE\Software\WOW6432Node\Eset\Nod svchost.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1064 set thread context of 3544 1064 c2366c6bdbe1cf73d9a5143bdfb174be_JC.exe 83 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3544 svchost.exe 3544 svchost.exe 3544 svchost.exe 3544 svchost.exe 3544 svchost.exe 3544 svchost.exe 3544 svchost.exe 3544 svchost.exe 3544 svchost.exe 3544 svchost.exe 3544 svchost.exe 3544 svchost.exe 3544 svchost.exe 3544 svchost.exe 3544 svchost.exe 3544 svchost.exe 3544 svchost.exe 3544 svchost.exe 3544 svchost.exe 3544 svchost.exe 3544 svchost.exe 3544 svchost.exe 3544 svchost.exe 3544 svchost.exe 3544 svchost.exe 3544 svchost.exe 3544 svchost.exe 3544 svchost.exe 3544 svchost.exe 3544 svchost.exe 3544 svchost.exe 3544 svchost.exe 3544 svchost.exe 3544 svchost.exe 3544 svchost.exe 3544 svchost.exe 3544 svchost.exe 3544 svchost.exe 3544 svchost.exe 3544 svchost.exe 3544 svchost.exe 3544 svchost.exe 3544 svchost.exe 3544 svchost.exe 3544 svchost.exe 3544 svchost.exe 3544 svchost.exe 3544 svchost.exe 3544 svchost.exe 3544 svchost.exe 3544 svchost.exe 3544 svchost.exe 3544 svchost.exe 3544 svchost.exe 3544 svchost.exe 3544 svchost.exe 3544 svchost.exe 3544 svchost.exe 3544 svchost.exe 3544 svchost.exe 3544 svchost.exe 3544 svchost.exe 3544 svchost.exe 3544 svchost.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1064 c2366c6bdbe1cf73d9a5143bdfb174be_JC.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1064 wrote to memory of 3544 1064 c2366c6bdbe1cf73d9a5143bdfb174be_JC.exe 83 PID 1064 wrote to memory of 3544 1064 c2366c6bdbe1cf73d9a5143bdfb174be_JC.exe 83 PID 1064 wrote to memory of 3544 1064 c2366c6bdbe1cf73d9a5143bdfb174be_JC.exe 83 PID 1064 wrote to memory of 3544 1064 c2366c6bdbe1cf73d9a5143bdfb174be_JC.exe 83 PID 1064 wrote to memory of 2216 1064 c2366c6bdbe1cf73d9a5143bdfb174be_JC.exe 84 PID 1064 wrote to memory of 2216 1064 c2366c6bdbe1cf73d9a5143bdfb174be_JC.exe 84 PID 1064 wrote to memory of 2216 1064 c2366c6bdbe1cf73d9a5143bdfb174be_JC.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\c2366c6bdbe1cf73d9a5143bdfb174be_JC.exe"C:\Users\Admin\AppData\Local\Temp\c2366c6bdbe1cf73d9a5143bdfb174be_JC.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Windows\SysWOW64\svchost.exeC:\ProgramData\9c431685.exe2⤵
- Adds Run key to start application
- Checks for any installed AV software in registry
- Suspicious behavior: EnumeratesProcesses
PID:3544
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\ProgramData\xcm6385.tmp.bat" "C:\Users\Admin\AppData\Local\Temp\c2366c6bdbe1cf73d9a5143bdfb174be_JC.exe""2⤵PID:2216
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
35B
MD5c627ddf2bb74193d29148db2ed2da3cb
SHA11ce174cdee3b74b169a2bf4b1fdeb24effd0fe21
SHA2569a28f0c10fd4deb3566def50f7bbe27522a8b4a19ebbd0ab483834e3bc95d5ce
SHA512cf2e1d629653fb262fc1e60cb1b2040b12af3a6fdef4a8871fa191468b3f795d2c32102173049a68b5b1a0d6b80af29dcd6049222a0b88c7ad786533c2eb560c