Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
27/11/2023, 01:56
Behavioral task
behavioral1
Sample
ba750c9db7f06008205b3d93a947f6c2c94d92dba50eb08816e7b6dca51099ab.exe
Resource
win7-20231025-en
Behavioral task
behavioral2
Sample
ba750c9db7f06008205b3d93a947f6c2c94d92dba50eb08816e7b6dca51099ab.exe
Resource
win10v2004-20231023-en
General
-
Target
ba750c9db7f06008205b3d93a947f6c2c94d92dba50eb08816e7b6dca51099ab.exe
-
Size
1.5MB
-
MD5
f3c88013538d71aedd9fd37acc71d968
-
SHA1
62cca485047adcc3f357f8a91d1974a188c58099
-
SHA256
ba750c9db7f06008205b3d93a947f6c2c94d92dba50eb08816e7b6dca51099ab
-
SHA512
f0b1936987966fe61db23493e30772dd02a221029699da3ea152dc5e424b20c9829ce58cc1ec5ea5250827e4e40b2eaae40fd809d619874183d10a73c194e0f5
-
SSDEEP
24576:2opGDjnvrPpkjos0OtjcFc5kM49dj+IuxWQOIjuJuVvhbqL0HtFcgekRP9dT0WNI:OnvrPGT0Egyudc4tI3bqL0NFchaP9dTy
Malware Config
Signatures
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnk ba750c9db7f06008205b3d93a947f6c2c94d92dba50eb08816e7b6dca51099ab.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MaxLoonaFest131 = "C:\\Users\\Admin\\AppData\\Local\\MaxLoonaFest131\\MaxLoonaFest131.exe" ba750c9db7f06008205b3d93a947f6c2c94d92dba50eb08816e7b6dca51099ab.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 5080 schtasks.exe 1844 schtasks.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 264 wrote to memory of 5080 264 ba750c9db7f06008205b3d93a947f6c2c94d92dba50eb08816e7b6dca51099ab.exe 84 PID 264 wrote to memory of 5080 264 ba750c9db7f06008205b3d93a947f6c2c94d92dba50eb08816e7b6dca51099ab.exe 84 PID 264 wrote to memory of 5080 264 ba750c9db7f06008205b3d93a947f6c2c94d92dba50eb08816e7b6dca51099ab.exe 84 PID 264 wrote to memory of 1844 264 ba750c9db7f06008205b3d93a947f6c2c94d92dba50eb08816e7b6dca51099ab.exe 87 PID 264 wrote to memory of 1844 264 ba750c9db7f06008205b3d93a947f6c2c94d92dba50eb08816e7b6dca51099ab.exe 87 PID 264 wrote to memory of 1844 264 ba750c9db7f06008205b3d93a947f6c2c94d92dba50eb08816e7b6dca51099ab.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\ba750c9db7f06008205b3d93a947f6c2c94d92dba50eb08816e7b6dca51099ab.exe"C:\Users\Admin\AppData\Local\Temp\ba750c9db7f06008205b3d93a947f6c2c94d92dba50eb08816e7b6dca51099ab.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:264 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST2⤵
- Creates scheduled task(s)
PID:5080
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST2⤵
- Creates scheduled task(s)
PID:1844
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.5MB
MD5f3c88013538d71aedd9fd37acc71d968
SHA162cca485047adcc3f357f8a91d1974a188c58099
SHA256ba750c9db7f06008205b3d93a947f6c2c94d92dba50eb08816e7b6dca51099ab
SHA512f0b1936987966fe61db23493e30772dd02a221029699da3ea152dc5e424b20c9829ce58cc1ec5ea5250827e4e40b2eaae40fd809d619874183d10a73c194e0f5