Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
158s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
04/11/2023, 08:36
Static task
static1
Behavioral task
behavioral1
Sample
809852ffea8c153ff88ddcad0299224e9177535e293ec0d580c61747b9248bf6.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
809852ffea8c153ff88ddcad0299224e9177535e293ec0d580c61747b9248bf6.exe
Resource
win10v2004-20231020-en
General
-
Target
809852ffea8c153ff88ddcad0299224e9177535e293ec0d580c61747b9248bf6.exe
-
Size
193KB
-
MD5
98a7a9bfa7080f96ddf437cc1e66d3d2
-
SHA1
91238833ab01f0e1ef78306ed441770789fac04e
-
SHA256
809852ffea8c153ff88ddcad0299224e9177535e293ec0d580c61747b9248bf6
-
SHA512
1cf4f2c8bd44c90f750384831985c343ae1e0a53e25b0aed0045fcccac07337048b9c7d890d64f7500b4f46564af8a14ea3c9ab4f8e8a7a7181050b057c4c795
-
SSDEEP
6144:rBs27MMLyX5HXXXDTXXXOGqIII+pXXX5AYjKXXXDoXXXG6XXXxXXXLIIIEAkOCOh:rK20HXXX/XXXFqIIIcXXX5j2XXXcXXXs
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\Control Panel\International\Geo\Nation 809852ffea8c153ff88ddcad0299224e9177535e293ec0d580c61747b9248bf6.exe -
Executes dropped EXE 1 IoCs
pid Process 1364 guehost.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Debug\guehost.exe 809852ffea8c153ff88ddcad0299224e9177535e293ec0d580c61747b9248bf6.exe File opened for modification C:\Windows\Debug\guehost.exe 809852ffea8c153ff88ddcad0299224e9177535e293ec0d580c61747b9248bf6.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 guehost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz guehost.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 4792 809852ffea8c153ff88ddcad0299224e9177535e293ec0d580c61747b9248bf6.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4792 wrote to memory of 1140 4792 809852ffea8c153ff88ddcad0299224e9177535e293ec0d580c61747b9248bf6.exe 90 PID 4792 wrote to memory of 1140 4792 809852ffea8c153ff88ddcad0299224e9177535e293ec0d580c61747b9248bf6.exe 90 PID 4792 wrote to memory of 1140 4792 809852ffea8c153ff88ddcad0299224e9177535e293ec0d580c61747b9248bf6.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\809852ffea8c153ff88ddcad0299224e9177535e293ec0d580c61747b9248bf6.exe"C:\Users\Admin\AppData\Local\Temp\809852ffea8c153ff88ddcad0299224e9177535e293ec0d580c61747b9248bf6.exe"1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\809852~1.EXE > nul2⤵PID:1140
-
-
C:\Windows\Debug\guehost.exeC:\Windows\Debug\guehost.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
PID:1364
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
193KB
MD54492610ac660ebc3ab386697d1db3d3e
SHA155fc432155f52c6ce545822f12056a3f3ffb0321
SHA25687cb454c1686650a065ee982acbca1942702757a771541c83a54dba9b9ed4ac4
SHA512d2c9c7d33d76485e64ce5722e4e2239987560d4740bcff616ea5438cc3dfc1043bf052699bdfe806db3860705febb0d637bd96527791f73f0eb223390f71a283
-
Filesize
193KB
MD54492610ac660ebc3ab386697d1db3d3e
SHA155fc432155f52c6ce545822f12056a3f3ffb0321
SHA25687cb454c1686650a065ee982acbca1942702757a771541c83a54dba9b9ed4ac4
SHA512d2c9c7d33d76485e64ce5722e4e2239987560d4740bcff616ea5438cc3dfc1043bf052699bdfe806db3860705febb0d637bd96527791f73f0eb223390f71a283