Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
14/10/2023, 13:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
30f9a26a248fcf321c6a2eb4a405b636c2e2b9993e17cfff11adebf2cf6ef8f2.exe
Resource
win7-20230831-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
30f9a26a248fcf321c6a2eb4a405b636c2e2b9993e17cfff11adebf2cf6ef8f2.exe
Resource
win10v2004-20230915-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
30f9a26a248fcf321c6a2eb4a405b636c2e2b9993e17cfff11adebf2cf6ef8f2.exe
-
Size
183KB
-
MD5
b5d1e2f9fa12965377148e126caea6d6
-
SHA1
7cb800b5f095842c9844d38591cf803e57c4037c
-
SHA256
30f9a26a248fcf321c6a2eb4a405b636c2e2b9993e17cfff11adebf2cf6ef8f2
-
SHA512
ca955afbeac70f1c684ed9437d74dd8d2ac0f6f112d0392a89898e97b0fe7ac742ec8b252c6fb754792332fedafb5a29d196645539d354d7b2b2e6b69a89ff39
-
SSDEEP
3072:p2IRCfVPhfXLLGEhafyoi8jqRPzcp+1ZWLjJEP+Rw5TZFDJTEjyPIOY:A5pXLCRvi8jqNc+yLdEPWSn6iV
Score
7/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Control Panel\International\Geo\Nation 30f9a26a248fcf321c6a2eb4a405b636c2e2b9993e17cfff11adebf2cf6ef8f2.exe -
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\X: 30f9a26a248fcf321c6a2eb4a405b636c2e2b9993e17cfff11adebf2cf6ef8f2.exe File opened (read-only) \??\G: 30f9a26a248fcf321c6a2eb4a405b636c2e2b9993e17cfff11adebf2cf6ef8f2.exe File opened (read-only) \??\I: 30f9a26a248fcf321c6a2eb4a405b636c2e2b9993e17cfff11adebf2cf6ef8f2.exe File opened (read-only) \??\N: 30f9a26a248fcf321c6a2eb4a405b636c2e2b9993e17cfff11adebf2cf6ef8f2.exe File opened (read-only) \??\O: 30f9a26a248fcf321c6a2eb4a405b636c2e2b9993e17cfff11adebf2cf6ef8f2.exe File opened (read-only) \??\W: 30f9a26a248fcf321c6a2eb4a405b636c2e2b9993e17cfff11adebf2cf6ef8f2.exe File opened (read-only) \??\E: 30f9a26a248fcf321c6a2eb4a405b636c2e2b9993e17cfff11adebf2cf6ef8f2.exe File opened (read-only) \??\K: 30f9a26a248fcf321c6a2eb4a405b636c2e2b9993e17cfff11adebf2cf6ef8f2.exe File opened (read-only) \??\P: 30f9a26a248fcf321c6a2eb4a405b636c2e2b9993e17cfff11adebf2cf6ef8f2.exe File opened (read-only) \??\Q: 30f9a26a248fcf321c6a2eb4a405b636c2e2b9993e17cfff11adebf2cf6ef8f2.exe File opened (read-only) \??\Z: 30f9a26a248fcf321c6a2eb4a405b636c2e2b9993e17cfff11adebf2cf6ef8f2.exe File opened (read-only) \??\H: 30f9a26a248fcf321c6a2eb4a405b636c2e2b9993e17cfff11adebf2cf6ef8f2.exe File opened (read-only) \??\L: 30f9a26a248fcf321c6a2eb4a405b636c2e2b9993e17cfff11adebf2cf6ef8f2.exe File opened (read-only) \??\M: 30f9a26a248fcf321c6a2eb4a405b636c2e2b9993e17cfff11adebf2cf6ef8f2.exe File opened (read-only) \??\R: 30f9a26a248fcf321c6a2eb4a405b636c2e2b9993e17cfff11adebf2cf6ef8f2.exe File opened (read-only) \??\U: 30f9a26a248fcf321c6a2eb4a405b636c2e2b9993e17cfff11adebf2cf6ef8f2.exe File opened (read-only) \??\Y: 30f9a26a248fcf321c6a2eb4a405b636c2e2b9993e17cfff11adebf2cf6ef8f2.exe File opened (read-only) \??\B: 30f9a26a248fcf321c6a2eb4a405b636c2e2b9993e17cfff11adebf2cf6ef8f2.exe File opened (read-only) \??\J: 30f9a26a248fcf321c6a2eb4a405b636c2e2b9993e17cfff11adebf2cf6ef8f2.exe File opened (read-only) \??\S: 30f9a26a248fcf321c6a2eb4a405b636c2e2b9993e17cfff11adebf2cf6ef8f2.exe File opened (read-only) \??\T: 30f9a26a248fcf321c6a2eb4a405b636c2e2b9993e17cfff11adebf2cf6ef8f2.exe File opened (read-only) \??\V: 30f9a26a248fcf321c6a2eb4a405b636c2e2b9993e17cfff11adebf2cf6ef8f2.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings 30f9a26a248fcf321c6a2eb4a405b636c2e2b9993e17cfff11adebf2cf6ef8f2.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 568 30f9a26a248fcf321c6a2eb4a405b636c2e2b9993e17cfff11adebf2cf6ef8f2.exe 568 30f9a26a248fcf321c6a2eb4a405b636c2e2b9993e17cfff11adebf2cf6ef8f2.exe 568 30f9a26a248fcf321c6a2eb4a405b636c2e2b9993e17cfff11adebf2cf6ef8f2.exe 568 30f9a26a248fcf321c6a2eb4a405b636c2e2b9993e17cfff11adebf2cf6ef8f2.exe 568 30f9a26a248fcf321c6a2eb4a405b636c2e2b9993e17cfff11adebf2cf6ef8f2.exe 568 30f9a26a248fcf321c6a2eb4a405b636c2e2b9993e17cfff11adebf2cf6ef8f2.exe 568 30f9a26a248fcf321c6a2eb4a405b636c2e2b9993e17cfff11adebf2cf6ef8f2.exe 568 30f9a26a248fcf321c6a2eb4a405b636c2e2b9993e17cfff11adebf2cf6ef8f2.exe 568 30f9a26a248fcf321c6a2eb4a405b636c2e2b9993e17cfff11adebf2cf6ef8f2.exe 568 30f9a26a248fcf321c6a2eb4a405b636c2e2b9993e17cfff11adebf2cf6ef8f2.exe 568 30f9a26a248fcf321c6a2eb4a405b636c2e2b9993e17cfff11adebf2cf6ef8f2.exe 568 30f9a26a248fcf321c6a2eb4a405b636c2e2b9993e17cfff11adebf2cf6ef8f2.exe 568 30f9a26a248fcf321c6a2eb4a405b636c2e2b9993e17cfff11adebf2cf6ef8f2.exe 568 30f9a26a248fcf321c6a2eb4a405b636c2e2b9993e17cfff11adebf2cf6ef8f2.exe 568 30f9a26a248fcf321c6a2eb4a405b636c2e2b9993e17cfff11adebf2cf6ef8f2.exe 568 30f9a26a248fcf321c6a2eb4a405b636c2e2b9993e17cfff11adebf2cf6ef8f2.exe 568 30f9a26a248fcf321c6a2eb4a405b636c2e2b9993e17cfff11adebf2cf6ef8f2.exe 568 30f9a26a248fcf321c6a2eb4a405b636c2e2b9993e17cfff11adebf2cf6ef8f2.exe 568 30f9a26a248fcf321c6a2eb4a405b636c2e2b9993e17cfff11adebf2cf6ef8f2.exe 568 30f9a26a248fcf321c6a2eb4a405b636c2e2b9993e17cfff11adebf2cf6ef8f2.exe 568 30f9a26a248fcf321c6a2eb4a405b636c2e2b9993e17cfff11adebf2cf6ef8f2.exe 568 30f9a26a248fcf321c6a2eb4a405b636c2e2b9993e17cfff11adebf2cf6ef8f2.exe 568 30f9a26a248fcf321c6a2eb4a405b636c2e2b9993e17cfff11adebf2cf6ef8f2.exe 568 30f9a26a248fcf321c6a2eb4a405b636c2e2b9993e17cfff11adebf2cf6ef8f2.exe 568 30f9a26a248fcf321c6a2eb4a405b636c2e2b9993e17cfff11adebf2cf6ef8f2.exe 568 30f9a26a248fcf321c6a2eb4a405b636c2e2b9993e17cfff11adebf2cf6ef8f2.exe 568 30f9a26a248fcf321c6a2eb4a405b636c2e2b9993e17cfff11adebf2cf6ef8f2.exe 568 30f9a26a248fcf321c6a2eb4a405b636c2e2b9993e17cfff11adebf2cf6ef8f2.exe 568 30f9a26a248fcf321c6a2eb4a405b636c2e2b9993e17cfff11adebf2cf6ef8f2.exe 568 30f9a26a248fcf321c6a2eb4a405b636c2e2b9993e17cfff11adebf2cf6ef8f2.exe 568 30f9a26a248fcf321c6a2eb4a405b636c2e2b9993e17cfff11adebf2cf6ef8f2.exe 568 30f9a26a248fcf321c6a2eb4a405b636c2e2b9993e17cfff11adebf2cf6ef8f2.exe 568 30f9a26a248fcf321c6a2eb4a405b636c2e2b9993e17cfff11adebf2cf6ef8f2.exe 568 30f9a26a248fcf321c6a2eb4a405b636c2e2b9993e17cfff11adebf2cf6ef8f2.exe 568 30f9a26a248fcf321c6a2eb4a405b636c2e2b9993e17cfff11adebf2cf6ef8f2.exe 568 30f9a26a248fcf321c6a2eb4a405b636c2e2b9993e17cfff11adebf2cf6ef8f2.exe 568 30f9a26a248fcf321c6a2eb4a405b636c2e2b9993e17cfff11adebf2cf6ef8f2.exe 568 30f9a26a248fcf321c6a2eb4a405b636c2e2b9993e17cfff11adebf2cf6ef8f2.exe 568 30f9a26a248fcf321c6a2eb4a405b636c2e2b9993e17cfff11adebf2cf6ef8f2.exe 568 30f9a26a248fcf321c6a2eb4a405b636c2e2b9993e17cfff11adebf2cf6ef8f2.exe 568 30f9a26a248fcf321c6a2eb4a405b636c2e2b9993e17cfff11adebf2cf6ef8f2.exe 568 30f9a26a248fcf321c6a2eb4a405b636c2e2b9993e17cfff11adebf2cf6ef8f2.exe 568 30f9a26a248fcf321c6a2eb4a405b636c2e2b9993e17cfff11adebf2cf6ef8f2.exe 568 30f9a26a248fcf321c6a2eb4a405b636c2e2b9993e17cfff11adebf2cf6ef8f2.exe 568 30f9a26a248fcf321c6a2eb4a405b636c2e2b9993e17cfff11adebf2cf6ef8f2.exe 568 30f9a26a248fcf321c6a2eb4a405b636c2e2b9993e17cfff11adebf2cf6ef8f2.exe 568 30f9a26a248fcf321c6a2eb4a405b636c2e2b9993e17cfff11adebf2cf6ef8f2.exe 568 30f9a26a248fcf321c6a2eb4a405b636c2e2b9993e17cfff11adebf2cf6ef8f2.exe 568 30f9a26a248fcf321c6a2eb4a405b636c2e2b9993e17cfff11adebf2cf6ef8f2.exe 568 30f9a26a248fcf321c6a2eb4a405b636c2e2b9993e17cfff11adebf2cf6ef8f2.exe 568 30f9a26a248fcf321c6a2eb4a405b636c2e2b9993e17cfff11adebf2cf6ef8f2.exe 568 30f9a26a248fcf321c6a2eb4a405b636c2e2b9993e17cfff11adebf2cf6ef8f2.exe 568 30f9a26a248fcf321c6a2eb4a405b636c2e2b9993e17cfff11adebf2cf6ef8f2.exe 568 30f9a26a248fcf321c6a2eb4a405b636c2e2b9993e17cfff11adebf2cf6ef8f2.exe 568 30f9a26a248fcf321c6a2eb4a405b636c2e2b9993e17cfff11adebf2cf6ef8f2.exe 568 30f9a26a248fcf321c6a2eb4a405b636c2e2b9993e17cfff11adebf2cf6ef8f2.exe 568 30f9a26a248fcf321c6a2eb4a405b636c2e2b9993e17cfff11adebf2cf6ef8f2.exe 568 30f9a26a248fcf321c6a2eb4a405b636c2e2b9993e17cfff11adebf2cf6ef8f2.exe 568 30f9a26a248fcf321c6a2eb4a405b636c2e2b9993e17cfff11adebf2cf6ef8f2.exe 568 30f9a26a248fcf321c6a2eb4a405b636c2e2b9993e17cfff11adebf2cf6ef8f2.exe 568 30f9a26a248fcf321c6a2eb4a405b636c2e2b9993e17cfff11adebf2cf6ef8f2.exe 568 30f9a26a248fcf321c6a2eb4a405b636c2e2b9993e17cfff11adebf2cf6ef8f2.exe 568 30f9a26a248fcf321c6a2eb4a405b636c2e2b9993e17cfff11adebf2cf6ef8f2.exe 568 30f9a26a248fcf321c6a2eb4a405b636c2e2b9993e17cfff11adebf2cf6ef8f2.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 568 30f9a26a248fcf321c6a2eb4a405b636c2e2b9993e17cfff11adebf2cf6ef8f2.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 568 30f9a26a248fcf321c6a2eb4a405b636c2e2b9993e17cfff11adebf2cf6ef8f2.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 568 30f9a26a248fcf321c6a2eb4a405b636c2e2b9993e17cfff11adebf2cf6ef8f2.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 568 wrote to memory of 2828 568 30f9a26a248fcf321c6a2eb4a405b636c2e2b9993e17cfff11adebf2cf6ef8f2.exe 84 PID 568 wrote to memory of 2828 568 30f9a26a248fcf321c6a2eb4a405b636c2e2b9993e17cfff11adebf2cf6ef8f2.exe 84 PID 568 wrote to memory of 2828 568 30f9a26a248fcf321c6a2eb4a405b636c2e2b9993e17cfff11adebf2cf6ef8f2.exe 84 PID 2828 wrote to memory of 2020 2828 cmd.exe 86 PID 2828 wrote to memory of 2020 2828 cmd.exe 86 PID 2828 wrote to memory of 2020 2828 cmd.exe 86 -
Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 2020 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\30f9a26a248fcf321c6a2eb4a405b636c2e2b9993e17cfff11adebf2cf6ef8f2.exe"C:\Users\Admin\AppData\Local\Temp\30f9a26a248fcf321c6a2eb4a405b636c2e2b9993e17cfff11adebf2cf6ef8f2.exe"1⤵
- Checks computer location settings
- Enumerates connected drives
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:568 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c attrib +h +s +r C:\Users\Default\AppData\MsgE.exe2⤵
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Windows\SysWOW64\attrib.exeattrib +h +s +r C:\Users\Default\AppData\MsgE.exe3⤵
- Views/modifies file attributes
PID:2020
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:3848