Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
25/12/2023, 03:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0204bb7d418b715226b4875a9436402e.exe
Resource
win7-20231215-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
0204bb7d418b715226b4875a9436402e.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
0204bb7d418b715226b4875a9436402e.exe
-
Size
626KB
-
MD5
0204bb7d418b715226b4875a9436402e
-
SHA1
73ecbf75a0218d7753d970dce357f8ca2813f158
-
SHA256
28fdd0612e2c3716cd09fb7c166b7b839c5aa0c4596189ee5fffdf92b57a6375
-
SHA512
6cfd96cb5d18b2daa925e130c675e680b665f9e84a6ac8101b509752358727a99fe45c97721b0cb0682f4038bd4f57e73bd6309fceef747d2329d9dd1a0c42e7
-
SSDEEP
3072:7+ZvkWp8qX96QfCDpMqrT4GmdVM3bXKCKk3T1a/PTYhA7Jf22QA6Ivv1tH/nSrNF:aZmqt6Qyiy3b6CR10TY8JOArF9S9
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SvcHosts32 = "C:\\Windows\\system32\\svchosts.exe" 0204bb7d418b715226b4875a9436402e.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\drivers32\WinZip 9.x Serial Generator.exe 0204bb7d418b715226b4875a9436402e.exe File opened for modification C:\Windows\SysWOW64\drivers32\Splinter Cell No-Cd Crack.exe 0204bb7d418b715226b4875a9436402e.exe File created C:\Windows\SysWOW64\drivers32\MechWarrior 3 No-Cd Crack.exe 0204bb7d418b715226b4875a9436402e.exe File created C:\Windows\SysWOW64\drivers32\Adobe Photoshop 7.x Serial Generator.exe 0204bb7d418b715226b4875a9436402e.exe File opened for modification C:\Windows\SysWOW64\drivers32\Elder Scrolls III - Tribunal Serial Generator.exe 0204bb7d418b715226b4875a9436402e.exe File opened for modification C:\Windows\SysWOW64\drivers32\The Sims Superstar Serial Generator.exe 0204bb7d418b715226b4875a9436402e.exe File created C:\Windows\SysWOW64\drivers32\RealOne Player 2.0 Serial Generator.exe 0204bb7d418b715226b4875a9436402e.exe File opened for modification C:\Windows\SysWOW64\drivers32\PhotoShow 2.0 Crack.exe 0204bb7d418b715226b4875a9436402e.exe File opened for modification C:\Windows\SysWOW64\drivers32\NASCAR Thunder 2003 Serial Generator.exe 0204bb7d418b715226b4875a9436402e.exe File created C:\Windows\SysWOW64\drivers32\MechWarrior V Serial Generator.exe 0204bb7d418b715226b4875a9436402e.exe File opened for modification C:\Windows\SysWOW64\drivers32\IconPackager 2.12 Crack.exe 0204bb7d418b715226b4875a9436402e.exe File created C:\Windows\SysWOW64\drivers32\Command & Conquer Generals Serial Generator.exe 0204bb7d418b715226b4875a9436402e.exe File opened for modification C:\Windows\SysWOW64\drivers32\FIFA Soccer 2004 Serial Generator.exe 0204bb7d418b715226b4875a9436402e.exe File created C:\Windows\SysWOW64\drivers32\UT 2004 Serial Generator.exe 0204bb7d418b715226b4875a9436402e.exe File created C:\Windows\SysWOW64\drivers32\Midtown Madness II Serial Generator.exe 0204bb7d418b715226b4875a9436402e.exe File opened for modification C:\Windows\SysWOW64\drivers32\SimCity 4 No-Cd Crack.exe 0204bb7d418b715226b4875a9436402e.exe File opened for modification C:\Windows\SysWOW64\drivers32\Quake IV Serial Generator.exe 0204bb7d418b715226b4875a9436402e.exe File created C:\Windows\SysWOW64\drivers32\Internet Download Manager 3.15 Serial Generator.exe 0204bb7d418b715226b4875a9436402e.exe File created C:\Windows\SysWOW64\drivers32\SWiSH 2.0 Serial Generator.exe 0204bb7d418b715226b4875a9436402e.exe File opened for modification C:\Windows\SysWOW64\drivers32\FlashGet 1.3 Serial Generator.exe 0204bb7d418b715226b4875a9436402e.exe File created C:\Windows\SysWOW64\drivers32\NetPumper 1.03 Crack.exe 0204bb7d418b715226b4875a9436402e.exe File created C:\Windows\SysWOW64\drivers32\DAP Plus 5.3 Serial Generator.exe 0204bb7d418b715226b4875a9436402e.exe File opened for modification C:\Windows\SysWOW64\drivers32\Quake 3 No-Cd Crack.exe 0204bb7d418b715226b4875a9436402e.exe File opened for modification C:\Windows\SysWOW64\drivers32\WinZip 9.x Crack.exe 0204bb7d418b715226b4875a9436402e.exe File created C:\Windows\SysWOW64\drivers32\Quake 4 Serial Generator.exe 0204bb7d418b715226b4875a9436402e.exe File created C:\Windows\SysWOW64\drivers32\ZoneAlarm 3.x Serial Generator.exe 0204bb7d418b715226b4875a9436402e.exe File created C:\Windows\SysWOW64\drivers32\Midtown Madness III No-Cd Crack.exe 0204bb7d418b715226b4875a9436402e.exe File created C:\Windows\SysWOW64\drivers32\Commandos 3 - Destination Berlin Serial Generator.exe 0204bb7d418b715226b4875a9436402e.exe File created C:\Windows\SysWOW64\drivers32\World War II - Frontline Command No-Cd Crack.exe 0204bb7d418b715226b4875a9436402e.exe File opened for modification C:\Windows\SysWOW64\drivers32\Tomb Raider - The Angel of Darkness No-Cd Crack.exe 0204bb7d418b715226b4875a9436402e.exe File opened for modification C:\Windows\SysWOW64\drivers32\Adobe Acrobat 5.x Crack.exe 0204bb7d418b715226b4875a9436402e.exe File opened for modification C:\Windows\SysWOW64\drivers32\MechWarrior 3 Serial Generator.exe 0204bb7d418b715226b4875a9436402e.exe File opened for modification C:\Windows\SysWOW64\drivers32\NBA Live 2003 No-Cd Crack.exe 0204bb7d418b715226b4875a9436402e.exe File opened for modification C:\Windows\SysWOW64\drivers32\Half-Life Serial Generator.exe 0204bb7d418b715226b4875a9436402e.exe File created C:\Windows\SysWOW64\drivers32\Commandos 3 - Destination Berlin No-Cd Crack.exe 0204bb7d418b715226b4875a9436402e.exe File created C:\Windows\SysWOW64\drivers32\CloneCD 5.0 Serial Generator.exe 0204bb7d418b715226b4875a9436402e.exe File opened for modification C:\Windows\SysWOW64\drivers32\World War II - Frontline Command No-Cd Crack.exe 0204bb7d418b715226b4875a9436402e.exe File opened for modification C:\Windows\SysWOW64\drivers32\Easy CD-DA Extractor 5.1 Crack.exe 0204bb7d418b715226b4875a9436402e.exe File opened for modification C:\Windows\SysWOW64\drivers32\Network Cable e ADSL Speed 1.0.6 Crack.exe 0204bb7d418b715226b4875a9436402e.exe File opened for modification C:\Windows\SysWOW64\drivers32\Return to Castle Wolfenstein Serial Generator.exe 0204bb7d418b715226b4875a9436402e.exe File created C:\Windows\SysWOW64\drivers32\Chrome No-Cd Crack.exe 0204bb7d418b715226b4875a9436402e.exe File created C:\Windows\SysWOW64\drivers32\Winamp 3.x Serial Generator.exe 0204bb7d418b715226b4875a9436402e.exe File opened for modification C:\Windows\SysWOW64\drivers32\SWiSH 2.x Crack.exe 0204bb7d418b715226b4875a9436402e.exe File created C:\Windows\SysWOW64\drivers32\Civilization III - Conquest Serial Generator.exe 0204bb7d418b715226b4875a9436402e.exe File created C:\Windows\SysWOW64\drivers32\Shrek 2 Serial Generator.exe 0204bb7d418b715226b4875a9436402e.exe File created C:\Windows\SysWOW64\drivers32\Divx 5.x Serial Generator.exe 0204bb7d418b715226b4875a9436402e.exe File opened for modification C:\Windows\SysWOW64\drivers32\IL-2 Sturmovik - Forgotten Battles No-Cd Crack.exe 0204bb7d418b715226b4875a9436402e.exe File opened for modification C:\Windows\SysWOW64\drivers32\Direct Connect 1.x Crack.exe 0204bb7d418b715226b4875a9436402e.exe File created C:\Windows\SysWOW64\drivers32\Lords of EverQuest No-Cd Crack.exe 0204bb7d418b715226b4875a9436402e.exe File created C:\Windows\SysWOW64\drivers32\Tiger Woods PGA TOUR 2002 No-Cd Crack.exe 0204bb7d418b715226b4875a9436402e.exe File created C:\Windows\SysWOW64\drivers32\Download Accelerator Plus 5.3 Crack.exe 0204bb7d418b715226b4875a9436402e.exe File created C:\Windows\SysWOW64\drivers32\Tiger Woods PGA TOUR 2003 Serial Generator.exe 0204bb7d418b715226b4875a9436402e.exe File created C:\Windows\SysWOW64\drivers32\SWiSH 2.x Serial Generator.exe 0204bb7d418b715226b4875a9436402e.exe File created C:\Windows\SysWOW64\drivers32\Grand Theft Auto - Vice City No-Cd Crack.exe 0204bb7d418b715226b4875a9436402e.exe File opened for modification C:\Windows\SysWOW64\drivers32\Warlords 4 Serial Generator.exe 0204bb7d418b715226b4875a9436402e.exe File created C:\Windows\SysWOW64\drivers32\MechWarrior III No-Cd Crack.exe 0204bb7d418b715226b4875a9436402e.exe File opened for modification C:\Windows\SysWOW64\drivers32\NBA Live 2004 No-Cd Crack.exe 0204bb7d418b715226b4875a9436402e.exe File created C:\Windows\SysWOW64\drivers32\Silent Hill 3 Serial Generator.exe 0204bb7d418b715226b4875a9436402e.exe File opened for modification C:\Windows\SysWOW64\drivers32\Lord of the Rings - The Two Towers No-Cd Crack.exe 0204bb7d418b715226b4875a9436402e.exe File opened for modification C:\Windows\SysWOW64\drivers32\SWiSH 2.0 Crack.exe 0204bb7d418b715226b4875a9436402e.exe File opened for modification C:\Windows\SysWOW64\drivers32\Internet Turbo 2003 5.x Serial Generator.exe 0204bb7d418b715226b4875a9436402e.exe File opened for modification C:\Windows\SysWOW64\drivers32\Hitman 3 Serial Generator.exe 0204bb7d418b715226b4875a9436402e.exe File created C:\Windows\SysWOW64\drivers32\Neverwinter Nights - Shadows of Undrentide No-Cd Crack.exe 0204bb7d418b715226b4875a9436402e.exe File created C:\Windows\SysWOW64\drivers32\GetRight 5.0 Crack.exe 0204bb7d418b715226b4875a9436402e.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1156 wrote to memory of 3620 1156 0204bb7d418b715226b4875a9436402e.exe 99 PID 1156 wrote to memory of 3620 1156 0204bb7d418b715226b4875a9436402e.exe 99 PID 1156 wrote to memory of 3620 1156 0204bb7d418b715226b4875a9436402e.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\0204bb7d418b715226b4875a9436402e.exe"C:\Users\Admin\AppData\Local\Temp\0204bb7d418b715226b4875a9436402e.exe"1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\$$$$$.bat2⤵PID:3620
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
626KB
MD50204bb7d418b715226b4875a9436402e
SHA173ecbf75a0218d7753d970dce357f8ca2813f158
SHA25628fdd0612e2c3716cd09fb7c166b7b839c5aa0c4596189ee5fffdf92b57a6375
SHA5126cfd96cb5d18b2daa925e130c675e680b665f9e84a6ac8101b509752358727a99fe45c97721b0cb0682f4038bd4f57e73bd6309fceef747d2329d9dd1a0c42e7
-
Filesize
200B
MD54e1d0b8ae589b66ea3f87dd0fb946ebc
SHA1aa4e2ece3cce024c8d66f9f3eb0f123a28c52d96
SHA2560926a8d09fa7ef9111da30e4d238bb07197b151026b0ec92571c6a531fc242c5
SHA512ed6e1c97187a7f01e170c9281e09b7e0d588b9a54ca1c006be58dd24ea924f1b02ece32d5e8a35ea46bb07b1a891767ff00f77353a199a63c0cc674926c49e42