Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

c84a4b4a09...40.exe

windows7-x64

7

c84a4b4a09...40.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    142s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231020-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/11/2023, 01:45

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    c84a4b4a093f6c8724fc665d5aeb2be5338ce2d2c5c0691b946c64f2e1c9ee40.exe

  • Size

    1.1MB

  • MD5

    8366bdd359e719935c0925b4bf5631cf

  • SHA1

    34684eaf9c5d331ec3176cfdc6675f3d015044ba

  • SHA256

    c84a4b4a093f6c8724fc665d5aeb2be5338ce2d2c5c0691b946c64f2e1c9ee40

  • SHA512

    97541eca8d802017bfc57ee6459a401f4468bf3253814f2d344d067788154d3185364094c2714b9c99776fdc66e770d4addb7361d691243de701208a96c81b5b

  • SSDEEP

    24576:gRW3N/0f/oAPoRBchI5anfOlAUAi1K6oElG4lBujFAvCyRS:g5ApamAUAQ/lG4lBmFAvZS

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c84a4b4a093f6c8724fc665d5aeb2be5338ce2d2c5c0691b946c64f2e1c9ee40.exe
    "C:\Users\Admin\AppData\Local\Temp\c84a4b4a093f6c8724fc665d5aeb2be5338ce2d2c5c0691b946c64f2e1c9ee40.exe"
    1⤵
    • Checks computer location settings
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1656
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
      2⤵
      • Checks computer location settings
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:1536
      • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:4860
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
      2⤵
      • Checks computer location settings
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:1872
      • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
        3⤵
        • Deletes itself
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:4996
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
      2⤵
      • Checks computer location settings
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:4056
      • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:4324

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
    Filesize

    753B

    MD5

    edc1af53c38fb22a8027907db5649c3d

    SHA1

    4df3b96fb12a8efa17b025ff8876a5916f2f4194

    SHA256

    afccf366c9cec7bc8f5c32323f8576a6daec9b41b1f6b9f7b9962d616bb4d0b1

    SHA512

    aace1e9536aec2787d5dc13c34a27b6459f8b2621152fcbf1f27bea54e1864abc9dc84c2770f0306288d1e21b2e85d98826576e65d7c7cc048190b92bea38ef4

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
    Filesize

    753B

    MD5

    edc1af53c38fb22a8027907db5649c3d

    SHA1

    4df3b96fb12a8efa17b025ff8876a5916f2f4194

    SHA256

    afccf366c9cec7bc8f5c32323f8576a6daec9b41b1f6b9f7b9962d616bb4d0b1

    SHA512

    aace1e9536aec2787d5dc13c34a27b6459f8b2621152fcbf1f27bea54e1864abc9dc84c2770f0306288d1e21b2e85d98826576e65d7c7cc048190b92bea38ef4

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
    Filesize

    1.1MB

    MD5

    ee64ab4f00dedb4b81946d9f7ebe00b0

    SHA1

    66ea602f446d1c6384a4dfd4bbc03b7eb95e26af

    SHA256

    7c12aec4eafcb2843a923d10d2b6b96349a12ef6733f97138f3286419836d2a2

    SHA512

    f8adf67271a4aef8359c895f8524b5c824338f5adb8fdf7b83c4984c0c6909a2dfd239d64863ad5a89fdb837f81e5d7aebe69cfbefeb2c30e08ebaa539600e49

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
    Filesize

    1.1MB

    MD5

    ee64ab4f00dedb4b81946d9f7ebe00b0

    SHA1

    66ea602f446d1c6384a4dfd4bbc03b7eb95e26af

    SHA256

    7c12aec4eafcb2843a923d10d2b6b96349a12ef6733f97138f3286419836d2a2

    SHA512

    f8adf67271a4aef8359c895f8524b5c824338f5adb8fdf7b83c4984c0c6909a2dfd239d64863ad5a89fdb837f81e5d7aebe69cfbefeb2c30e08ebaa539600e49

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
    Filesize

    1.1MB

    MD5

    ee64ab4f00dedb4b81946d9f7ebe00b0

    SHA1

    66ea602f446d1c6384a4dfd4bbc03b7eb95e26af

    SHA256

    7c12aec4eafcb2843a923d10d2b6b96349a12ef6733f97138f3286419836d2a2

    SHA512

    f8adf67271a4aef8359c895f8524b5c824338f5adb8fdf7b83c4984c0c6909a2dfd239d64863ad5a89fdb837f81e5d7aebe69cfbefeb2c30e08ebaa539600e49

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
    Filesize

    1.1MB

    MD5

    ee64ab4f00dedb4b81946d9f7ebe00b0

    SHA1

    66ea602f446d1c6384a4dfd4bbc03b7eb95e26af

    SHA256

    7c12aec4eafcb2843a923d10d2b6b96349a12ef6733f97138f3286419836d2a2

    SHA512

    f8adf67271a4aef8359c895f8524b5c824338f5adb8fdf7b83c4984c0c6909a2dfd239d64863ad5a89fdb837f81e5d7aebe69cfbefeb2c30e08ebaa539600e49

    Download Submit