Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
176s -
max time network
184s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
11/10/2023, 06:08
Behavioral task
behavioral1
Sample
New Client.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
New Client.exe
Resource
win10v2004-20230915-en
General
-
Target
New Client.exe
-
Size
164KB
-
MD5
f08772b3bdde7388a4c43b7e41da5684
-
SHA1
439cd4653ddbdf9d7433a165f5cd4eb6afe82bcb
-
SHA256
6e0125f382bf828fbff9e7467a227c0584385395c2cb20a06a4c045f9ac6a43d
-
SHA512
7776c2894397fae7a1934af7d87513d5e25114a10fd9cbb3fbbcc8fb1512dc68cad8b066dbba7c9462ded0d9c5c70f32d9fca42b18a72a0a2a67fd04755945a3
-
SSDEEP
3072:0ibn/zRv40/9nUx0EpuCRwzzbEcr5+cbet7lo9Wagc:0i3Ux0EjGz4q5jbKz5
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000\Control Panel\International\Geo\Nation New Client.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe Client.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe Client.exe -
Executes dropped EXE 1 IoCs
pid Process 860 Client.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Client.exe = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Client.exe\" .." Client.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Client.exe = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Client.exe\" .." Client.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2736 schtasks.exe 4492 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 29 IoCs
description pid Process Token: SeDebugPrivilege 860 Client.exe Token: 33 860 Client.exe Token: SeIncBasePriorityPrivilege 860 Client.exe Token: 33 860 Client.exe Token: SeIncBasePriorityPrivilege 860 Client.exe Token: 33 860 Client.exe Token: SeIncBasePriorityPrivilege 860 Client.exe Token: 33 860 Client.exe Token: SeIncBasePriorityPrivilege 860 Client.exe Token: 33 860 Client.exe Token: SeIncBasePriorityPrivilege 860 Client.exe Token: 33 860 Client.exe Token: SeIncBasePriorityPrivilege 860 Client.exe Token: 33 860 Client.exe Token: SeIncBasePriorityPrivilege 860 Client.exe Token: 33 860 Client.exe Token: SeIncBasePriorityPrivilege 860 Client.exe Token: 33 860 Client.exe Token: SeIncBasePriorityPrivilege 860 Client.exe Token: 33 860 Client.exe Token: SeIncBasePriorityPrivilege 860 Client.exe Token: 33 860 Client.exe Token: SeIncBasePriorityPrivilege 860 Client.exe Token: 33 860 Client.exe Token: SeIncBasePriorityPrivilege 860 Client.exe Token: 33 860 Client.exe Token: SeIncBasePriorityPrivilege 860 Client.exe Token: 33 860 Client.exe Token: SeIncBasePriorityPrivilege 860 Client.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 636 wrote to memory of 4172 636 New Client.exe 87 PID 636 wrote to memory of 4172 636 New Client.exe 87 PID 636 wrote to memory of 4172 636 New Client.exe 87 PID 636 wrote to memory of 2736 636 New Client.exe 90 PID 636 wrote to memory of 2736 636 New Client.exe 90 PID 636 wrote to memory of 2736 636 New Client.exe 90 PID 636 wrote to memory of 860 636 New Client.exe 98 PID 636 wrote to memory of 860 636 New Client.exe 98 PID 636 wrote to memory of 860 636 New Client.exe 98 PID 860 wrote to memory of 2352 860 Client.exe 101 PID 860 wrote to memory of 2352 860 Client.exe 101 PID 860 wrote to memory of 2352 860 Client.exe 101 PID 860 wrote to memory of 4492 860 Client.exe 103 PID 860 wrote to memory of 4492 860 Client.exe 103 PID 860 wrote to memory of 4492 860 Client.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\New Client.exe"C:\Users\Admin\AppData\Local\Temp\New Client.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:636 -
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /tn NYAN /F2⤵PID:4172
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn NYAN /tr "C:\Users\Admin\AppData\Local\Temp\New Client.exe" /sc minute /mo 12⤵
- Creates scheduled task(s)
PID:2736
-
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:860 -
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /tn NYAN /F3⤵PID:2352
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn NYAN /tr "C:\Users\Admin\AppData\Local\Temp\Client.exe" /sc minute /mo 13⤵
- Creates scheduled task(s)
PID:4492
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
164KB
MD5f08772b3bdde7388a4c43b7e41da5684
SHA1439cd4653ddbdf9d7433a165f5cd4eb6afe82bcb
SHA2566e0125f382bf828fbff9e7467a227c0584385395c2cb20a06a4c045f9ac6a43d
SHA5127776c2894397fae7a1934af7d87513d5e25114a10fd9cbb3fbbcc8fb1512dc68cad8b066dbba7c9462ded0d9c5c70f32d9fca42b18a72a0a2a67fd04755945a3
-
Filesize
164KB
MD5f08772b3bdde7388a4c43b7e41da5684
SHA1439cd4653ddbdf9d7433a165f5cd4eb6afe82bcb
SHA2566e0125f382bf828fbff9e7467a227c0584385395c2cb20a06a4c045f9ac6a43d
SHA5127776c2894397fae7a1934af7d87513d5e25114a10fd9cbb3fbbcc8fb1512dc68cad8b066dbba7c9462ded0d9c5c70f32d9fca42b18a72a0a2a67fd04755945a3
-
Filesize
164KB
MD5f08772b3bdde7388a4c43b7e41da5684
SHA1439cd4653ddbdf9d7433a165f5cd4eb6afe82bcb
SHA2566e0125f382bf828fbff9e7467a227c0584385395c2cb20a06a4c045f9ac6a43d
SHA5127776c2894397fae7a1934af7d87513d5e25114a10fd9cbb3fbbcc8fb1512dc68cad8b066dbba7c9462ded0d9c5c70f32d9fca42b18a72a0a2a67fd04755945a3