Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
25/12/2023, 07:25
Static task
static1
Behavioral task
behavioral1
Sample
0e9a652935256f228780d0c3e32b68f5.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
0e9a652935256f228780d0c3e32b68f5.exe
Resource
win10v2004-20231215-en
General
-
Target
0e9a652935256f228780d0c3e32b68f5.exe
-
Size
31KB
-
MD5
0e9a652935256f228780d0c3e32b68f5
-
SHA1
34ae9519b8597409b25cb93762a7177d4bd2ac5f
-
SHA256
d007594d8fcea52f2e56f3007294af8fbd8c3109a7a499f118a0e6f71fd5dffa
-
SHA512
67a045b6ae6cc6f19e5969c3b825d6e5d36977a2738cdea1d7abb8a56c6c56daafdac0c2929518f417233b579c2e34d7d7556f7908996be80cf7da502cb3c0c9
-
SSDEEP
768:ufj3dfoZWKZcDVWl8zHPHXyXHCzcHHvzQBdi9vc:uf6WyUVWl4vUv4Wvc
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 0e9a652935256f228780d0c3e32b68f5.exe Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" Admin.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation 0e9a652935256f228780d0c3e32b68f5.exe -
Executes dropped EXE 1 IoCs
pid Process 2852 Admin.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Admin = "C:\\Users\\Admin\\Admin.exe" 0e9a652935256f228780d0c3e32b68f5.exe Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Admin = "C:\\Users\\Admin\\Admin.exe" Admin.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2920 0e9a652935256f228780d0c3e32b68f5.exe 2920 0e9a652935256f228780d0c3e32b68f5.exe 2920 0e9a652935256f228780d0c3e32b68f5.exe 2920 0e9a652935256f228780d0c3e32b68f5.exe 2920 0e9a652935256f228780d0c3e32b68f5.exe 2920 0e9a652935256f228780d0c3e32b68f5.exe 2852 Admin.exe 2852 Admin.exe 2920 0e9a652935256f228780d0c3e32b68f5.exe 2920 0e9a652935256f228780d0c3e32b68f5.exe 2852 Admin.exe 2852 Admin.exe 2920 0e9a652935256f228780d0c3e32b68f5.exe 2920 0e9a652935256f228780d0c3e32b68f5.exe 2852 Admin.exe 2852 Admin.exe 2852 Admin.exe 2852 Admin.exe 2852 Admin.exe 2852 Admin.exe 2852 Admin.exe 2852 Admin.exe 2852 Admin.exe 2852 Admin.exe 2852 Admin.exe 2852 Admin.exe 2852 Admin.exe 2852 Admin.exe 2852 Admin.exe 2852 Admin.exe 2852 Admin.exe 2852 Admin.exe 2852 Admin.exe 2852 Admin.exe 2852 Admin.exe 2852 Admin.exe 2852 Admin.exe 2852 Admin.exe 2852 Admin.exe 2852 Admin.exe 2852 Admin.exe 2852 Admin.exe 2852 Admin.exe 2852 Admin.exe 2852 Admin.exe 2852 Admin.exe 2852 Admin.exe 2852 Admin.exe 2852 Admin.exe 2852 Admin.exe 2852 Admin.exe 2852 Admin.exe 2852 Admin.exe 2852 Admin.exe 2852 Admin.exe 2852 Admin.exe 2852 Admin.exe 2852 Admin.exe 2852 Admin.exe 2852 Admin.exe 2852 Admin.exe 2852 Admin.exe 2852 Admin.exe 2852 Admin.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2920 0e9a652935256f228780d0c3e32b68f5.exe 2852 Admin.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2920 wrote to memory of 2852 2920 0e9a652935256f228780d0c3e32b68f5.exe 70 PID 2920 wrote to memory of 2852 2920 0e9a652935256f228780d0c3e32b68f5.exe 70 PID 2920 wrote to memory of 2852 2920 0e9a652935256f228780d0c3e32b68f5.exe 70
Processes
-
C:\Users\Admin\AppData\Local\Temp\0e9a652935256f228780d0c3e32b68f5.exe"C:\Users\Admin\AppData\Local\Temp\0e9a652935256f228780d0c3e32b68f5.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Users\Admin\Admin.exe"C:\Users\Admin\Admin.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2852
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
31KB
MD5614381950e58b4b9ec6161ba6e08736b
SHA1afce595590e2caf27c1c6ebc7765d697227b511a
SHA25637ba76768881622644ef297c0e08de85da3bafa5f111f3b80f54e89b7d83888d
SHA51211f779966b574aaef07b3fff46a8ca96e6cc3aad6ccfb94504a6bff1e7cb2d1aa7b9af78dd5e421478f7b01fe9666a949a3760c1671eb40e8fa36eab094a5615
-
Filesize
89B
MD52bd83f0dd1740fff26d071dcdd59af56
SHA1221e9e64a79255053a9e4da65957a7bdd6bc045b
SHA25670a676e21716581858de2753ea5eec8befe6741ed299216f65a13c3853805c05
SHA512fe632b63b8b850cc83f0eb2a114de60693ec0dd8b62fe8f0938b42526557889f48357da0ca3bb06bed1ad68562280023a69b54d93cff8b7266bb8ebb63ac903c