Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
24/12/2023, 20:25
Static task
static1
Behavioral task
behavioral1
Sample
10c546472c8671e8bcb8322a20132396.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
10c546472c8671e8bcb8322a20132396.exe
Resource
win10v2004-20231215-en
General
-
Target
10c546472c8671e8bcb8322a20132396.exe
-
Size
142KB
-
MD5
10c546472c8671e8bcb8322a20132396
-
SHA1
938624bd24157386e1b1ac57a18208ddbc58906d
-
SHA256
a313a6134e267c1c3e7c5f9790dcc0fa07ac7105977297051373b70c2de22283
-
SHA512
f67390449a01158327297342fb1bb2cd27c4f520dac6100adbb492f2e1bd94ade9dcbbe49767ba8c0f7d53b2f20efea5f7f05bcd58bc503752ba3fc7a57bdda5
-
SSDEEP
3072:89NzEfwf32SvZZ+0UxVG/PedD2v+V1b4NMeMxEcGgwXUE9CRy0gO4t:89eYfJvzB6U/qpcMeCEC1yDX
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List 10c546472c8671e8bcb8322a20132396.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile 10c546472c8671e8bcb8322a20132396.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications 10c546472c8671e8bcb8322a20132396.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Public\HEX-5823-6893-6818\vlcproc.exe = "C:\\Users\\Public\\HEX-5823-6893-6818\\vlcproc.exe:*:Enabled:Java Update Manager" 10c546472c8671e8bcb8322a20132396.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Control Panel\International\Geo\Nation 10c546472c8671e8bcb8322a20132396.exe -
Executes dropped EXE 3 IoCs
pid Process 3688 vlcproc.exe 3796 vlcproc.exe 548 vlcproc.exe -
resource yara_rule behavioral2/memory/824-3-0x0000000000400000-0x0000000000418000-memory.dmp upx behavioral2/memory/824-9-0x0000000000400000-0x0000000000418000-memory.dmp upx behavioral2/memory/824-7-0x0000000000400000-0x0000000000418000-memory.dmp upx behavioral2/memory/824-17-0x0000000000400000-0x0000000000418000-memory.dmp upx behavioral2/memory/3796-85-0x0000000000400000-0x0000000000418000-memory.dmp upx behavioral2/memory/3796-87-0x0000000000400000-0x0000000000418000-memory.dmp upx behavioral2/memory/3796-95-0x0000000000400000-0x0000000000418000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Java Update Manager = "C:\\Users\\Public\\HEX-5823-6893-6818\\vlcproc.exe" 10c546472c8671e8bcb8322a20132396.exe -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 1684 set thread context of 824 1684 10c546472c8671e8bcb8322a20132396.exe 91 PID 824 set thread context of 4780 824 10c546472c8671e8bcb8322a20132396.exe 92 PID 3688 set thread context of 3796 3688 vlcproc.exe 99 PID 3796 set thread context of 548 3796 vlcproc.exe 100 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 10c546472c8671e8bcb8322a20132396.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1684 10c546472c8671e8bcb8322a20132396.exe 824 10c546472c8671e8bcb8322a20132396.exe 3688 vlcproc.exe 3796 vlcproc.exe -
Suspicious use of WriteProcessMemory 35 IoCs
description pid Process procid_target PID 1684 wrote to memory of 824 1684 10c546472c8671e8bcb8322a20132396.exe 91 PID 1684 wrote to memory of 824 1684 10c546472c8671e8bcb8322a20132396.exe 91 PID 1684 wrote to memory of 824 1684 10c546472c8671e8bcb8322a20132396.exe 91 PID 1684 wrote to memory of 824 1684 10c546472c8671e8bcb8322a20132396.exe 91 PID 1684 wrote to memory of 824 1684 10c546472c8671e8bcb8322a20132396.exe 91 PID 1684 wrote to memory of 824 1684 10c546472c8671e8bcb8322a20132396.exe 91 PID 1684 wrote to memory of 824 1684 10c546472c8671e8bcb8322a20132396.exe 91 PID 1684 wrote to memory of 824 1684 10c546472c8671e8bcb8322a20132396.exe 91 PID 824 wrote to memory of 4780 824 10c546472c8671e8bcb8322a20132396.exe 92 PID 824 wrote to memory of 4780 824 10c546472c8671e8bcb8322a20132396.exe 92 PID 824 wrote to memory of 4780 824 10c546472c8671e8bcb8322a20132396.exe 92 PID 824 wrote to memory of 4780 824 10c546472c8671e8bcb8322a20132396.exe 92 PID 824 wrote to memory of 4780 824 10c546472c8671e8bcb8322a20132396.exe 92 PID 824 wrote to memory of 4780 824 10c546472c8671e8bcb8322a20132396.exe 92 PID 824 wrote to memory of 4780 824 10c546472c8671e8bcb8322a20132396.exe 92 PID 824 wrote to memory of 4780 824 10c546472c8671e8bcb8322a20132396.exe 92 PID 4780 wrote to memory of 3688 4780 10c546472c8671e8bcb8322a20132396.exe 96 PID 4780 wrote to memory of 3688 4780 10c546472c8671e8bcb8322a20132396.exe 96 PID 4780 wrote to memory of 3688 4780 10c546472c8671e8bcb8322a20132396.exe 96 PID 3688 wrote to memory of 3796 3688 vlcproc.exe 99 PID 3688 wrote to memory of 3796 3688 vlcproc.exe 99 PID 3688 wrote to memory of 3796 3688 vlcproc.exe 99 PID 3688 wrote to memory of 3796 3688 vlcproc.exe 99 PID 3688 wrote to memory of 3796 3688 vlcproc.exe 99 PID 3688 wrote to memory of 3796 3688 vlcproc.exe 99 PID 3688 wrote to memory of 3796 3688 vlcproc.exe 99 PID 3688 wrote to memory of 3796 3688 vlcproc.exe 99 PID 3796 wrote to memory of 548 3796 vlcproc.exe 100 PID 3796 wrote to memory of 548 3796 vlcproc.exe 100 PID 3796 wrote to memory of 548 3796 vlcproc.exe 100 PID 3796 wrote to memory of 548 3796 vlcproc.exe 100 PID 3796 wrote to memory of 548 3796 vlcproc.exe 100 PID 3796 wrote to memory of 548 3796 vlcproc.exe 100 PID 3796 wrote to memory of 548 3796 vlcproc.exe 100 PID 3796 wrote to memory of 548 3796 vlcproc.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\10c546472c8671e8bcb8322a20132396.exe"C:\Users\Admin\AppData\Local\Temp\10c546472c8671e8bcb8322a20132396.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\10c546472c8671e8bcb8322a20132396.exeC:\Users\Admin\AppData\Local\Temp\10c546472c8671e8bcb8322a20132396.exe2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:824 -
C:\Users\Admin\AppData\Local\Temp\10c546472c8671e8bcb8322a20132396.exe
- Modifies firewall policy service
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\Users\Public\HEX-5823-6893-6818\vlcproc.exe"C:\Users\Public\HEX-5823-6893-6818\vlcproc.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3688 -
C:\Users\Public\HEX-5823-6893-6818\vlcproc.exeC:\Users\Public\HEX-5823-6893-6818\vlcproc.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3796 -
C:\Users\Public\HEX-5823-6893-6818\vlcproc.exe
- Executes dropped EXE
PID:548
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
142KB
MD510c546472c8671e8bcb8322a20132396
SHA1938624bd24157386e1b1ac57a18208ddbc58906d
SHA256a313a6134e267c1c3e7c5f9790dcc0fa07ac7105977297051373b70c2de22283
SHA512f67390449a01158327297342fb1bb2cd27c4f520dac6100adbb492f2e1bd94ade9dcbbe49767ba8c0f7d53b2f20efea5f7f05bcd58bc503752ba3fc7a57bdda5