Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
181s -
max time network
200s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
25/12/2023, 00:11
Behavioral task
behavioral1
Sample
1bfb30639d02336395de9a01866d63b0.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
1bfb30639d02336395de9a01866d63b0.exe
Resource
win10v2004-20231215-en
General
-
Target
1bfb30639d02336395de9a01866d63b0.exe
-
Size
425KB
-
MD5
1bfb30639d02336395de9a01866d63b0
-
SHA1
6f1139516c8b5a7fd8a36fcfcc52d0e93fa15111
-
SHA256
20ba3ad626dca31c666bfff0ff3d1d2cf71b664383cb7c775b7f4a9725989b89
-
SHA512
2bced330d656d43ecbb89fc13e42cac77c125ce1f879f2e80f5032d02755da15ab70e99fe789b66d980dc72ec235e906ffc0734e07551aef291290da03871ed1
-
SSDEEP
1536:2TJjMefFvUW9jjaZoSbdD2DDo/wwyI5GM0M7eSB3/OizN+jsgevhWqLegb0hp:utMeN8W9jLS5D2g/Ry6GSB33Fge5ySo
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Control Panel\International\Geo\Nation 1bfb30639d02336395de9a01866d63b0.exe -
Executes dropped EXE 6 IoCs
pid Process 1880 winlogon.exe 548 winlogon.exe 2972 winlogon.exe 3176 winlogon.exe 4300 winlogon.exe 1552 winlogon.exe -
resource yara_rule behavioral2/memory/1384-0-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/1384-3-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/3644-4-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/3644-1-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/3644-5-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/files/0x000700000002321c-12.dat upx behavioral2/memory/1880-16-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/3644-17-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/1880-21-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/548-22-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/548-23-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/548-26-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/548-29-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/548-30-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/548-37-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/548-42-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/548-49-0x0000000000400000-0x000000000041C000-memory.dmp upx -
Suspicious use of SetThreadContext 6 IoCs
description pid Process procid_target PID 1384 set thread context of 3644 1384 1bfb30639d02336395de9a01866d63b0.exe 92 PID 1880 set thread context of 548 1880 winlogon.exe 97 PID 548 set thread context of 2972 548 winlogon.exe 98 PID 548 set thread context of 3176 548 winlogon.exe 110 PID 548 set thread context of 4300 548 winlogon.exe 116 PID 548 set thread context of 1552 548 winlogon.exe 122 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 4 IoCs
pid pid_target Process procid_target 3672 2972 WerFault.exe 98 3068 3176 WerFault.exe 110 4328 4300 WerFault.exe 116 1076 1552 WerFault.exe 122 -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3644 1bfb30639d02336395de9a01866d63b0.exe 548 winlogon.exe -
Suspicious use of WriteProcessMemory 57 IoCs
description pid Process procid_target PID 1384 wrote to memory of 4216 1384 1bfb30639d02336395de9a01866d63b0.exe 91 PID 1384 wrote to memory of 4216 1384 1bfb30639d02336395de9a01866d63b0.exe 91 PID 1384 wrote to memory of 4216 1384 1bfb30639d02336395de9a01866d63b0.exe 91 PID 1384 wrote to memory of 3644 1384 1bfb30639d02336395de9a01866d63b0.exe 92 PID 1384 wrote to memory of 3644 1384 1bfb30639d02336395de9a01866d63b0.exe 92 PID 1384 wrote to memory of 3644 1384 1bfb30639d02336395de9a01866d63b0.exe 92 PID 1384 wrote to memory of 3644 1384 1bfb30639d02336395de9a01866d63b0.exe 92 PID 1384 wrote to memory of 3644 1384 1bfb30639d02336395de9a01866d63b0.exe 92 PID 1384 wrote to memory of 3644 1384 1bfb30639d02336395de9a01866d63b0.exe 92 PID 1384 wrote to memory of 3644 1384 1bfb30639d02336395de9a01866d63b0.exe 92 PID 1384 wrote to memory of 3644 1384 1bfb30639d02336395de9a01866d63b0.exe 92 PID 3644 wrote to memory of 1880 3644 1bfb30639d02336395de9a01866d63b0.exe 95 PID 3644 wrote to memory of 1880 3644 1bfb30639d02336395de9a01866d63b0.exe 95 PID 3644 wrote to memory of 1880 3644 1bfb30639d02336395de9a01866d63b0.exe 95 PID 1880 wrote to memory of 5108 1880 winlogon.exe 96 PID 1880 wrote to memory of 5108 1880 winlogon.exe 96 PID 1880 wrote to memory of 5108 1880 winlogon.exe 96 PID 1880 wrote to memory of 548 1880 winlogon.exe 97 PID 1880 wrote to memory of 548 1880 winlogon.exe 97 PID 1880 wrote to memory of 548 1880 winlogon.exe 97 PID 1880 wrote to memory of 548 1880 winlogon.exe 97 PID 1880 wrote to memory of 548 1880 winlogon.exe 97 PID 1880 wrote to memory of 548 1880 winlogon.exe 97 PID 1880 wrote to memory of 548 1880 winlogon.exe 97 PID 1880 wrote to memory of 548 1880 winlogon.exe 97 PID 548 wrote to memory of 2972 548 winlogon.exe 98 PID 548 wrote to memory of 2972 548 winlogon.exe 98 PID 548 wrote to memory of 2972 548 winlogon.exe 98 PID 548 wrote to memory of 2972 548 winlogon.exe 98 PID 548 wrote to memory of 2972 548 winlogon.exe 98 PID 548 wrote to memory of 2972 548 winlogon.exe 98 PID 548 wrote to memory of 2972 548 winlogon.exe 98 PID 548 wrote to memory of 2972 548 winlogon.exe 98 PID 548 wrote to memory of 3176 548 winlogon.exe 110 PID 548 wrote to memory of 3176 548 winlogon.exe 110 PID 548 wrote to memory of 3176 548 winlogon.exe 110 PID 548 wrote to memory of 3176 548 winlogon.exe 110 PID 548 wrote to memory of 3176 548 winlogon.exe 110 PID 548 wrote to memory of 3176 548 winlogon.exe 110 PID 548 wrote to memory of 3176 548 winlogon.exe 110 PID 548 wrote to memory of 3176 548 winlogon.exe 110 PID 548 wrote to memory of 4300 548 winlogon.exe 116 PID 548 wrote to memory of 4300 548 winlogon.exe 116 PID 548 wrote to memory of 4300 548 winlogon.exe 116 PID 548 wrote to memory of 4300 548 winlogon.exe 116 PID 548 wrote to memory of 4300 548 winlogon.exe 116 PID 548 wrote to memory of 4300 548 winlogon.exe 116 PID 548 wrote to memory of 4300 548 winlogon.exe 116 PID 548 wrote to memory of 4300 548 winlogon.exe 116 PID 548 wrote to memory of 1552 548 winlogon.exe 122 PID 548 wrote to memory of 1552 548 winlogon.exe 122 PID 548 wrote to memory of 1552 548 winlogon.exe 122 PID 548 wrote to memory of 1552 548 winlogon.exe 122 PID 548 wrote to memory of 1552 548 winlogon.exe 122 PID 548 wrote to memory of 1552 548 winlogon.exe 122 PID 548 wrote to memory of 1552 548 winlogon.exe 122 PID 548 wrote to memory of 1552 548 winlogon.exe 122
Processes
-
C:\Users\Admin\AppData\Local\Temp\1bfb30639d02336395de9a01866d63b0.exe"C:\Users\Admin\AppData\Local\Temp\1bfb30639d02336395de9a01866d63b0.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1384 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\\svchost.exe2⤵PID:4216
-
-
C:\Users\Admin\AppData\Local\Temp\1bfb30639d02336395de9a01866d63b0.exe
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3644 -
C:\Users\Admin\E696D64614\winlogon.exe"C:\Users\Admin\E696D64614\winlogon.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\\svchost.exe4⤵PID:5108
-
-
C:\Users\Admin\E696D64614\winlogon.exe
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:548 -
C:\Users\Admin\E696D64614\winlogon.exe"C:\Users\Admin\E696D64614\winlogon.exe"5⤵
- Executes dropped EXE
PID:2972 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2972 -s 126⤵
- Program crash
PID:3672
-
-
-
C:\Users\Admin\E696D64614\winlogon.exe"C:\Users\Admin\E696D64614\winlogon.exe"5⤵
- Executes dropped EXE
PID:3176 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3176 -s 126⤵
- Program crash
PID:3068
-
-
-
C:\Users\Admin\E696D64614\winlogon.exe"C:\Users\Admin\E696D64614\winlogon.exe"5⤵
- Executes dropped EXE
PID:4300 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4300 -s 126⤵
- Program crash
PID:4328
-
-
-
C:\Users\Admin\E696D64614\winlogon.exe"C:\Users\Admin\E696D64614\winlogon.exe"5⤵
- Executes dropped EXE
PID:1552 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1552 -s 126⤵
- Program crash
PID:1076
-
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2972 -ip 29721⤵PID:4960
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 3176 -ip 31761⤵PID:844
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4300 -ip 43001⤵PID:2796
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 1552 -ip 15521⤵PID:3752
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
425KB
MD51bfb30639d02336395de9a01866d63b0
SHA16f1139516c8b5a7fd8a36fcfcc52d0e93fa15111
SHA25620ba3ad626dca31c666bfff0ff3d1d2cf71b664383cb7c775b7f4a9725989b89
SHA5122bced330d656d43ecbb89fc13e42cac77c125ce1f879f2e80f5032d02755da15ab70e99fe789b66d980dc72ec235e906ffc0734e07551aef291290da03871ed1