Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

b1d306aa7b...88.exe

windows7-x64

7

b1d306aa7b...88.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    170s
  • max time network
    176s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/10/2023, 05:04

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    b1d306aa7b9a1c8e96f69f0f79f25a6f00a45bd7277021d570cf4fa21169e388.exe

  • Size

    1.2MB

  • MD5

    6a4028b7d5cfabce484c2e340696a96f

  • SHA1

    1e68ca70aacd00fc24bac10c530d28726e184455

  • SHA256

    b1d306aa7b9a1c8e96f69f0f79f25a6f00a45bd7277021d570cf4fa21169e388

  • SHA512

    d71f5886e2b92ae9930235084d0e912830fa894ddc4eb91bdda2b6e49d0d8aed8fca8dd47efc290bf87a316bd15ceb25ed1b899c8386af3d5f7802d669f6be72

  • SSDEEP

    24576:vlAzF5dI2vYKWb6Dsq3P3K4XY0esxUAUbwvaoslG45wyvCj8z7mwc:voep0hUbSklG45lvMcc

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 5 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b1d306aa7b9a1c8e96f69f0f79f25a6f00a45bd7277021d570cf4fa21169e388.exe
    "C:\Users\Admin\AppData\Local\Temp\b1d306aa7b9a1c8e96f69f0f79f25a6f00a45bd7277021d570cf4fa21169e388.exe"
    1⤵
    • Checks computer location settings
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3776
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
      2⤵
      • Checks computer location settings
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:4364
      • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:4280
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
      2⤵
      • Checks computer location settings
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:4592
      • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:3772
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
      2⤵
      • Checks computer location settings
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:4136
      • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:4456
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
      2⤵
      • Checks computer location settings
      • Modifies registry class
      PID:3592

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
    Filesize

    753B

    MD5

    7a379fd01515937f3c1d4153e04b7007

    SHA1

    7fa87db020fac1d62e350fccf063127d1c192eb5

    SHA256

    5d9e16ffa581e4cc83fe1e8376be0839249648b452a9bf8b4afe49e06622dec2

    SHA512

    84b96927078833a4840cda8416e8dd1784c3b3e9a6c8a33ff24fc1e9b4898f52becd876a8ccc1fe193592d28d6d6cc0c7041d504702361212c8819b0a04777b6

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
    Filesize

    753B

    MD5

    7a379fd01515937f3c1d4153e04b7007

    SHA1

    7fa87db020fac1d62e350fccf063127d1c192eb5

    SHA256

    5d9e16ffa581e4cc83fe1e8376be0839249648b452a9bf8b4afe49e06622dec2

    SHA512

    84b96927078833a4840cda8416e8dd1784c3b3e9a6c8a33ff24fc1e9b4898f52becd876a8ccc1fe193592d28d6d6cc0c7041d504702361212c8819b0a04777b6

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
    Filesize

    1.2MB

    MD5

    3c02a67c8c61778eb94c742cb9c40106

    SHA1

    6f9ef4f02388375ef34b493f63b2e91b8786a146

    SHA256

    81352d6e608ecde62ceab3f52bfd7ba1840b08edbdf228637cb7cfe093787972

    SHA512

    0500e17d00ce74b71c0318e24eab1f7d3870b6f2e8727cbcf830918ae569b4c23b264eb89471eb9ff7dfe2a84cf0e808cb2dc31e5b97d935fd12407d3be4db1a

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
    Filesize

    1.2MB

    MD5

    3c02a67c8c61778eb94c742cb9c40106

    SHA1

    6f9ef4f02388375ef34b493f63b2e91b8786a146

    SHA256

    81352d6e608ecde62ceab3f52bfd7ba1840b08edbdf228637cb7cfe093787972

    SHA512

    0500e17d00ce74b71c0318e24eab1f7d3870b6f2e8727cbcf830918ae569b4c23b264eb89471eb9ff7dfe2a84cf0e808cb2dc31e5b97d935fd12407d3be4db1a

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
    Filesize

    1.2MB

    MD5

    3c02a67c8c61778eb94c742cb9c40106

    SHA1

    6f9ef4f02388375ef34b493f63b2e91b8786a146

    SHA256

    81352d6e608ecde62ceab3f52bfd7ba1840b08edbdf228637cb7cfe093787972

    SHA512

    0500e17d00ce74b71c0318e24eab1f7d3870b6f2e8727cbcf830918ae569b4c23b264eb89471eb9ff7dfe2a84cf0e808cb2dc31e5b97d935fd12407d3be4db1a

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
    Filesize

    1.2MB

    MD5

    3c02a67c8c61778eb94c742cb9c40106

    SHA1

    6f9ef4f02388375ef34b493f63b2e91b8786a146

    SHA256

    81352d6e608ecde62ceab3f52bfd7ba1840b08edbdf228637cb7cfe093787972

    SHA512

    0500e17d00ce74b71c0318e24eab1f7d3870b6f2e8727cbcf830918ae569b4c23b264eb89471eb9ff7dfe2a84cf0e808cb2dc31e5b97d935fd12407d3be4db1a

    Download Submit