Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
0s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
25/12/2023, 07:55
Static task
static1
Behavioral task
behavioral1
Sample
105e462ca9cd66e19c70d12ddb1cf5c1.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
105e462ca9cd66e19c70d12ddb1cf5c1.exe
Resource
win10v2004-20231215-en
General
-
Target
105e462ca9cd66e19c70d12ddb1cf5c1.exe
-
Size
170KB
-
MD5
105e462ca9cd66e19c70d12ddb1cf5c1
-
SHA1
6b9a3aa84bbca8e634f33791fc9c3c3bf4cfcca4
-
SHA256
3c9c30c90537b242913e54b31b45aac963ad5f2e5cd0ad69f5388341088c5002
-
SHA512
5f17b7b921ea1d36faa6474eb66c6db97c5a432d4fc6f2a133f66f68eea12cca2bc0e3915b296e156b0880e9dacd444a80f9930b9685ef31f8cbde9a7eafeb8d
-
SSDEEP
3072:/cT9g8immW6Pozkk2eKs/CSr2nQ/E2S5ny+bF2u1I+ddDK7Hlq/B89W:o68i3odBiTl2+TCU/EW
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft I Service = "C:\\Windows\\winhash_up.exe /REGstart" 105e462ca9cd66e19c70d12ddb1cf5c1.exe -
Drops file in Windows directory 12 IoCs
description ioc Process File created C:\Windows\SHARE_TEMP\Icon7.ico 105e462ca9cd66e19c70d12ddb1cf5c1.exe File created C:\Windows\SHARE_TEMP\Icon12.ico 105e462ca9cd66e19c70d12ddb1cf5c1.exe File created C:\Windows\SHARE_TEMP\Icon14.ico 105e462ca9cd66e19c70d12ddb1cf5c1.exe File created C:\Windows\bugMAKER.bat 105e462ca9cd66e19c70d12ddb1cf5c1.exe File created C:\Windows\winhash_up.exez 105e462ca9cd66e19c70d12ddb1cf5c1.exe File opened for modification C:\Windows\winhash_up.exez 105e462ca9cd66e19c70d12ddb1cf5c1.exe File created C:\Windows\SHARE_TEMP\Icon3.ico 105e462ca9cd66e19c70d12ddb1cf5c1.exe File created C:\Windows\SHARE_TEMP\Icon6.ico 105e462ca9cd66e19c70d12ddb1cf5c1.exe File created C:\Windows\winhash_up.exe 105e462ca9cd66e19c70d12ddb1cf5c1.exe File created C:\Windows\SHARE_TEMP\Icon2.ico 105e462ca9cd66e19c70d12ddb1cf5c1.exe File created C:\Windows\SHARE_TEMP\Icon5.ico 105e462ca9cd66e19c70d12ddb1cf5c1.exe File created C:\Windows\SHARE_TEMP\Icon10.ico 105e462ca9cd66e19c70d12ddb1cf5c1.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2304 wrote to memory of 3432 2304 105e462ca9cd66e19c70d12ddb1cf5c1.exe 17 PID 2304 wrote to memory of 3432 2304 105e462ca9cd66e19c70d12ddb1cf5c1.exe 17 PID 2304 wrote to memory of 3432 2304 105e462ca9cd66e19c70d12ddb1cf5c1.exe 17
Processes
-
C:\Users\Admin\AppData\Local\Temp\105e462ca9cd66e19c70d12ddb1cf5c1.exe"C:\Users\Admin\AppData\Local\Temp\105e462ca9cd66e19c70d12ddb1cf5c1.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\bugMAKER.bat2⤵PID:3432
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
76B
MD508506809c2cec7138263383dedb88156
SHA1a1e51ce74ba207b8badc156cc6e6c45f65f3a46b
SHA2562393cc5cd4824b27dba5ab8c12b4d9dd1d506aca12c503d3efd4f018a6ee9168
SHA512f975249457048927564704145c8839c4e389442b1a90c3149141b4860d6de02512d0c3cbc7eaa7ff15844f4e2d98c3d394ddc3751ad009d49e292489484169db