Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
27s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
11/10/2023, 21:50
Static task
static1
Behavioral task
behavioral1
Sample
77574083a73bf4abe850f98c7cf758a8_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
77574083a73bf4abe850f98c7cf758a8_JC.exe
Resource
win10v2004-20230915-en
General
-
Target
77574083a73bf4abe850f98c7cf758a8_JC.exe
-
Size
714KB
-
MD5
77574083a73bf4abe850f98c7cf758a8
-
SHA1
69c245b5d48f16d63e90f8db771d11ac68984dc2
-
SHA256
9fcd6c43848454f32c61c3e2c86df019c71f6664fd19ce2e0e992e68cacf7b49
-
SHA512
40aabc9f55f5d2e9c1125364fbb66129c06c29e64f98aa7aa0b1ac42c5aeb7ca4a82f9c780e1864cc0365f3dd841137f27499c3d2d6fc187ca5d2023a680fedc
-
SSDEEP
12288:phJ6nTOYREU1gL5pRTcAkS/3hzN8qE43fm78V5:phJ6nTOYKx5jcAkSYqyE5
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
pid Process 4696 MSWDM.EXE 5028 MSWDM.EXE 3952 77574083A73BF4ABE850F98C7CF758A8_JC.EXE 3288 MSWDM.EXE -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE" 77574083a73bf4abe850f98c7cf758a8_JC.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE" 77574083a73bf4abe850f98c7cf758a8_JC.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE" MSWDM.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE" MSWDM.EXE -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\WINDOWS\MSWDM.EXE 77574083a73bf4abe850f98c7cf758a8_JC.exe File opened for modification C:\Windows\dev6C18.tmp 77574083a73bf4abe850f98c7cf758a8_JC.exe File opened for modification C:\Windows\dev6C18.tmp MSWDM.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 5028 MSWDM.EXE 5028 MSWDM.EXE -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2692 wrote to memory of 4696 2692 77574083a73bf4abe850f98c7cf758a8_JC.exe 85 PID 2692 wrote to memory of 4696 2692 77574083a73bf4abe850f98c7cf758a8_JC.exe 85 PID 2692 wrote to memory of 4696 2692 77574083a73bf4abe850f98c7cf758a8_JC.exe 85 PID 2692 wrote to memory of 5028 2692 77574083a73bf4abe850f98c7cf758a8_JC.exe 86 PID 2692 wrote to memory of 5028 2692 77574083a73bf4abe850f98c7cf758a8_JC.exe 86 PID 2692 wrote to memory of 5028 2692 77574083a73bf4abe850f98c7cf758a8_JC.exe 86 PID 5028 wrote to memory of 3952 5028 MSWDM.EXE 87 PID 5028 wrote to memory of 3952 5028 MSWDM.EXE 87 PID 5028 wrote to memory of 3288 5028 MSWDM.EXE 89 PID 5028 wrote to memory of 3288 5028 MSWDM.EXE 89 PID 5028 wrote to memory of 3288 5028 MSWDM.EXE 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\77574083a73bf4abe850f98c7cf758a8_JC.exe"C:\Users\Admin\AppData\Local\Temp\77574083a73bf4abe850f98c7cf758a8_JC.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\WINDOWS\MSWDM.EXE"C:\WINDOWS\MSWDM.EXE"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:4696
-
-
C:\WINDOWS\MSWDM.EXE-r!C:\Windows\dev6C18.tmp!C:\Users\Admin\AppData\Local\Temp\77574083a73bf4abe850f98c7cf758a8_JC.exe! !2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\77574083A73BF4ABE850F98C7CF758A8_JC.EXE
- Executes dropped EXE
PID:3952
-
-
C:\WINDOWS\MSWDM.EXE-e!C:\Windows\dev6C18.tmp!C:\Users\Admin\AppData\Local\Temp\77574083A73BF4ABE850F98C7CF758A8_JC.EXE!3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3288
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
714KB
MD51d25aa70c057827a6e6965c420dd1c4c
SHA187f177cc00ec4a9ae40bcfc145e854f23d39b682
SHA2568765fba8d862dec093cf1bd223c949534b46cf15eb877397ba3c9197e50438c9
SHA512a7cb92a6360804b7a2c039901d92b70f6f1fb6d2f34ef1b10b2b88922043286770f8283e7753ff6e0b7c2e2169b23c94cc71eba36e237cf3ba6ac78fe482ee3d
-
Filesize
714KB
MD51d25aa70c057827a6e6965c420dd1c4c
SHA187f177cc00ec4a9ae40bcfc145e854f23d39b682
SHA2568765fba8d862dec093cf1bd223c949534b46cf15eb877397ba3c9197e50438c9
SHA512a7cb92a6360804b7a2c039901d92b70f6f1fb6d2f34ef1b10b2b88922043286770f8283e7753ff6e0b7c2e2169b23c94cc71eba36e237cf3ba6ac78fe482ee3d
-
Filesize
458KB
MD5619f7135621b50fd1900ff24aade1524
SHA16c7ea8bbd435163ae3945cbef30ef6b9872a4591
SHA256344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2
SHA5122c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628
-
Filesize
714KB
MD51d25aa70c057827a6e6965c420dd1c4c
SHA187f177cc00ec4a9ae40bcfc145e854f23d39b682
SHA2568765fba8d862dec093cf1bd223c949534b46cf15eb877397ba3c9197e50438c9
SHA512a7cb92a6360804b7a2c039901d92b70f6f1fb6d2f34ef1b10b2b88922043286770f8283e7753ff6e0b7c2e2169b23c94cc71eba36e237cf3ba6ac78fe482ee3d
-
Filesize
256KB
MD58a1198209520897514a2d82a912a66d2
SHA15dda8ec47f948814d808cd71e89ebe65940a1ff7
SHA2565ce9e416f5b7811b9e91ec2de680aad0c38aa4a080999853b096b06d409887f0
SHA5129a6e4e3729f77bcdcc1ace7fa154490717473fb05899e13b1f920ee438dc1c1812eae6fdec8b97da7807e9d626014ad0481d9cf0d4f5a06e327b4b75534f7e00
-
Filesize
256KB
MD58a1198209520897514a2d82a912a66d2
SHA15dda8ec47f948814d808cd71e89ebe65940a1ff7
SHA2565ce9e416f5b7811b9e91ec2de680aad0c38aa4a080999853b096b06d409887f0
SHA5129a6e4e3729f77bcdcc1ace7fa154490717473fb05899e13b1f920ee438dc1c1812eae6fdec8b97da7807e9d626014ad0481d9cf0d4f5a06e327b4b75534f7e00
-
Filesize
256KB
MD58a1198209520897514a2d82a912a66d2
SHA15dda8ec47f948814d808cd71e89ebe65940a1ff7
SHA2565ce9e416f5b7811b9e91ec2de680aad0c38aa4a080999853b096b06d409887f0
SHA5129a6e4e3729f77bcdcc1ace7fa154490717473fb05899e13b1f920ee438dc1c1812eae6fdec8b97da7807e9d626014ad0481d9cf0d4f5a06e327b4b75534f7e00
-
Filesize
256KB
MD58a1198209520897514a2d82a912a66d2
SHA15dda8ec47f948814d808cd71e89ebe65940a1ff7
SHA2565ce9e416f5b7811b9e91ec2de680aad0c38aa4a080999853b096b06d409887f0
SHA5129a6e4e3729f77bcdcc1ace7fa154490717473fb05899e13b1f920ee438dc1c1812eae6fdec8b97da7807e9d626014ad0481d9cf0d4f5a06e327b4b75534f7e00
-
Filesize
458KB
MD5619f7135621b50fd1900ff24aade1524
SHA16c7ea8bbd435163ae3945cbef30ef6b9872a4591
SHA256344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2
SHA5122c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628