Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
24/12/2023, 19:25
Static task
static1
Behavioral task
behavioral1
Sample
0d4cbe904f7fb860570201e590346b7a.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
0d4cbe904f7fb860570201e590346b7a.exe
Resource
win10v2004-20231215-en
General
-
Target
0d4cbe904f7fb860570201e590346b7a.exe
-
Size
219KB
-
MD5
0d4cbe904f7fb860570201e590346b7a
-
SHA1
2fcdb7616591704861d177b5c0e3ade12de03d6b
-
SHA256
e11d974e59927cda7c8e614688afdc8cb3ab4942fb9a2bb86c686c4b24f5b9e6
-
SHA512
04866155ca76dc94872f9121536210e93bbb82d77c36be55d0dffa6a07ec73257439c314559586951f1dc1d392b4133e9778365d08e84c8547a99bc5ef1ee9c3
-
SSDEEP
6144:iPNeevOaGWpxcl/NdzFWE++GzB64/K7Hou:SEYOaG/zFWxvBD/
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Control Panel\International\Geo\Nation 0d4cbe904f7fb860570201e590346b7a.exe -
Executes dropped EXE 1 IoCs
pid Process 4916 bqvlpoxx.exe -
Loads dropped DLL 1 IoCs
pid Process 4916 bqvlpoxx.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Kills process with taskkill 1 IoCs
pid Process 1380 taskkill.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 4984 PING.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4916 bqvlpoxx.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1380 taskkill.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 4916 bqvlpoxx.exe 4916 bqvlpoxx.exe 4916 bqvlpoxx.exe -
Suspicious use of SendNotifyMessage 3 IoCs
pid Process 4916 bqvlpoxx.exe 4916 bqvlpoxx.exe 4916 bqvlpoxx.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 4240 wrote to memory of 3556 4240 0d4cbe904f7fb860570201e590346b7a.exe 90 PID 4240 wrote to memory of 3556 4240 0d4cbe904f7fb860570201e590346b7a.exe 90 PID 4240 wrote to memory of 3556 4240 0d4cbe904f7fb860570201e590346b7a.exe 90 PID 3556 wrote to memory of 1380 3556 cmd.exe 92 PID 3556 wrote to memory of 1380 3556 cmd.exe 92 PID 3556 wrote to memory of 1380 3556 cmd.exe 92 PID 3556 wrote to memory of 4984 3556 cmd.exe 94 PID 3556 wrote to memory of 4984 3556 cmd.exe 94 PID 3556 wrote to memory of 4984 3556 cmd.exe 94 PID 3556 wrote to memory of 4916 3556 cmd.exe 97 PID 3556 wrote to memory of 4916 3556 cmd.exe 97 PID 3556 wrote to memory of 4916 3556 cmd.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\0d4cbe904f7fb860570201e590346b7a.exe"C:\Users\Admin\AppData\Local\Temp\0d4cbe904f7fb860570201e590346b7a.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4240 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /f /pid 4240 & ping -n 3 127.1 & del /f /q "C:\Users\Admin\AppData\Local\Temp\0d4cbe904f7fb860570201e590346b7a.exe" & start C:\Users\Admin\AppData\Local\bqvlpoxx.exe -f2⤵
- Suspicious use of WriteProcessMemory
PID:3556 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /pid 42403⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1380
-
-
C:\Windows\SysWOW64\PING.EXEping -n 3 127.13⤵
- Runs ping.exe
PID:4984
-
-
C:\Users\Admin\AppData\Local\bqvlpoxx.exeC:\Users\Admin\AppData\Local\bqvlpoxx.exe -f3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4916
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
219KB
MD50d4cbe904f7fb860570201e590346b7a
SHA12fcdb7616591704861d177b5c0e3ade12de03d6b
SHA256e11d974e59927cda7c8e614688afdc8cb3ab4942fb9a2bb86c686c4b24f5b9e6
SHA51204866155ca76dc94872f9121536210e93bbb82d77c36be55d0dffa6a07ec73257439c314559586951f1dc1d392b4133e9778365d08e84c8547a99bc5ef1ee9c3