Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
25/12/2023, 06:44
Static task
static1
Behavioral task
behavioral1
Sample
0c7d8cd046f19eb731544cd0fa3304de.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
0c7d8cd046f19eb731544cd0fa3304de.exe
Resource
win10v2004-20231215-en
General
-
Target
0c7d8cd046f19eb731544cd0fa3304de.exe
-
Size
100KB
-
MD5
0c7d8cd046f19eb731544cd0fa3304de
-
SHA1
da28a7ce81aa7ac42865225691c0b9ac412fb05e
-
SHA256
ae9802f5188e465c7456ecf925c2116a35921cde096cfd7457e732d8c5507699
-
SHA512
6b1e577e092e43aec4c0fbfb90f8226746d56838f37cefb286ccd11b2ff42535e4737b59401f973470eb8c47d060279efb3b60a7d240e116d30c62b5f46e075d
-
SSDEEP
3072:7M+o7RdH5I96p+X9J1hvAaHafSEyNDWQDU6ra0BnwuJ6EQ1sNG8bJZ:M7RZ5S6p+X9J1RAaHafSEyNDPDU6G0Br
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 5044 System.exe 2604 System.exe -
resource yara_rule behavioral2/memory/3284-3-0x0000000000400000-0x000000000044F000-memory.dmp upx behavioral2/memory/3284-5-0x0000000000400000-0x000000000044F000-memory.dmp upx behavioral2/memory/3284-8-0x0000000000400000-0x000000000044F000-memory.dmp upx behavioral2/memory/2604-22-0x0000000000400000-0x000000000044F000-memory.dmp upx behavioral2/memory/3284-23-0x0000000000400000-0x000000000044F000-memory.dmp upx behavioral2/memory/2604-28-0x0000000000400000-0x000000000044F000-memory.dmp upx behavioral2/memory/2604-29-0x0000000000400000-0x000000000044F000-memory.dmp upx behavioral2/memory/2604-30-0x0000000000400000-0x000000000044F000-memory.dmp upx behavioral2/memory/2604-31-0x0000000000400000-0x000000000044F000-memory.dmp upx behavioral2/memory/2604-32-0x0000000000400000-0x000000000044F000-memory.dmp upx behavioral2/memory/2604-33-0x0000000000400000-0x000000000044F000-memory.dmp upx behavioral2/memory/2604-34-0x0000000000400000-0x000000000044F000-memory.dmp upx behavioral2/memory/2604-35-0x0000000000400000-0x000000000044F000-memory.dmp upx behavioral2/memory/2604-36-0x0000000000400000-0x000000000044F000-memory.dmp upx behavioral2/memory/2604-37-0x0000000000400000-0x000000000044F000-memory.dmp upx behavioral2/memory/2604-38-0x0000000000400000-0x000000000044F000-memory.dmp upx behavioral2/memory/2604-39-0x0000000000400000-0x000000000044F000-memory.dmp upx behavioral2/memory/2604-40-0x0000000000400000-0x000000000044F000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MSN Messanger = "C:\\Windows\\System.exe" 0c7d8cd046f19eb731544cd0fa3304de.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1424 set thread context of 3284 1424 0c7d8cd046f19eb731544cd0fa3304de.exe 88 PID 5044 set thread context of 2604 5044 System.exe 92 -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\System.exe 0c7d8cd046f19eb731544cd0fa3304de.exe File opened for modification C:\Windows\System.exe 0c7d8cd046f19eb731544cd0fa3304de.exe File opened for modification C:\Windows\System.exe System.exe File created C:\Windows\System.exe System.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1424 0c7d8cd046f19eb731544cd0fa3304de.exe 5044 System.exe -
Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 1424 wrote to memory of 3284 1424 0c7d8cd046f19eb731544cd0fa3304de.exe 88 PID 1424 wrote to memory of 3284 1424 0c7d8cd046f19eb731544cd0fa3304de.exe 88 PID 1424 wrote to memory of 3284 1424 0c7d8cd046f19eb731544cd0fa3304de.exe 88 PID 1424 wrote to memory of 3284 1424 0c7d8cd046f19eb731544cd0fa3304de.exe 88 PID 1424 wrote to memory of 3284 1424 0c7d8cd046f19eb731544cd0fa3304de.exe 88 PID 1424 wrote to memory of 3284 1424 0c7d8cd046f19eb731544cd0fa3304de.exe 88 PID 1424 wrote to memory of 3284 1424 0c7d8cd046f19eb731544cd0fa3304de.exe 88 PID 1424 wrote to memory of 3284 1424 0c7d8cd046f19eb731544cd0fa3304de.exe 88 PID 3284 wrote to memory of 5044 3284 0c7d8cd046f19eb731544cd0fa3304de.exe 91 PID 3284 wrote to memory of 5044 3284 0c7d8cd046f19eb731544cd0fa3304de.exe 91 PID 3284 wrote to memory of 5044 3284 0c7d8cd046f19eb731544cd0fa3304de.exe 91 PID 5044 wrote to memory of 2604 5044 System.exe 92 PID 5044 wrote to memory of 2604 5044 System.exe 92 PID 5044 wrote to memory of 2604 5044 System.exe 92 PID 5044 wrote to memory of 2604 5044 System.exe 92 PID 5044 wrote to memory of 2604 5044 System.exe 92 PID 5044 wrote to memory of 2604 5044 System.exe 92 PID 5044 wrote to memory of 2604 5044 System.exe 92 PID 5044 wrote to memory of 2604 5044 System.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\0c7d8cd046f19eb731544cd0fa3304de.exe"C:\Users\Admin\AppData\Local\Temp\0c7d8cd046f19eb731544cd0fa3304de.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Users\Admin\AppData\Local\Temp\0c7d8cd046f19eb731544cd0fa3304de.exe"C:\Users\Admin\AppData\Local\Temp\0c7d8cd046f19eb731544cd0fa3304de.exe"2⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3284 -
C:\Windows\System.exe"C:\Windows\System.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\Windows\System.exe"C:\Windows\System.exe"4⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2604
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
100KB
MD50c7d8cd046f19eb731544cd0fa3304de
SHA1da28a7ce81aa7ac42865225691c0b9ac412fb05e
SHA256ae9802f5188e465c7456ecf925c2116a35921cde096cfd7457e732d8c5507699
SHA5126b1e577e092e43aec4c0fbfb90f8226746d56838f37cefb286ccd11b2ff42535e4737b59401f973470eb8c47d060279efb3b60a7d240e116d30c62b5f46e075d