Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
0s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
25/12/2023, 08:53
Static task
static1
Behavioral task
behavioral1
Sample
133d43885a96c4e24a1898e89cb8662b.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
133d43885a96c4e24a1898e89cb8662b.exe
Resource
win10v2004-20231222-en
General
-
Target
133d43885a96c4e24a1898e89cb8662b.exe
-
Size
40KB
-
MD5
133d43885a96c4e24a1898e89cb8662b
-
SHA1
1ddce979af178cc587175138971d39a12701a0d5
-
SHA256
00a883b1f66bb54dd01b0a0f49f68380d11e034aa2a6af70536506bf028bf589
-
SHA512
eb93af350332516d68f19075df42aa77751b92c43dd1650dfe066bf54e91d1691325d3bf8b780a0cbef300f1a8377f59afffb3f0f07b9f1fb532cd9c1dd05e6a
-
SSDEEP
768:aq9m/ZsybSg2ts4L3RLc/qjhsKmHbk1+qJ0UtHjo:aqk/Zdic/qjh8w19JDHjo
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1184 services.exe -
resource yara_rule behavioral2/files/0x0007000000023237-7.dat upx behavioral2/memory/1184-5-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/1184-13-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/1184-17-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/1184-21-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/1184-22-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/1184-26-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/1184-30-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/1184-31-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/1184-35-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/1184-86-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/1184-127-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/1184-140-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/1184-144-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/1184-145-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/1184-186-0x0000000000400000-0x0000000000408000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe" 133d43885a96c4e24a1898e89cb8662b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe" services.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\services.exe 133d43885a96c4e24a1898e89cb8662b.exe File opened for modification C:\Windows\java.exe 133d43885a96c4e24a1898e89cb8662b.exe File created C:\Windows\java.exe 133d43885a96c4e24a1898e89cb8662b.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4716 wrote to memory of 1184 4716 133d43885a96c4e24a1898e89cb8662b.exe 17 PID 4716 wrote to memory of 1184 4716 133d43885a96c4e24a1898e89cb8662b.exe 17 PID 4716 wrote to memory of 1184 4716 133d43885a96c4e24a1898e89cb8662b.exe 17
Processes
-
C:\Users\Admin\AppData\Local\Temp\133d43885a96c4e24a1898e89cb8662b.exe"C:\Users\Admin\AppData\Local\Temp\133d43885a96c4e24a1898e89cb8662b.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:1184
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
312B
MD5c15952329e9cd008b41f979b6c76b9a2
SHA153c58cc742b5a0273df8d01ba2779a979c1ff967
SHA2565d065a88f9a1fb565c2d70e87148d469dd9dcbbefea4ccc8c181745eda748ab7
SHA5126aecdd949abcd2cb54e2fe3e1171ee47c247aa3980a0847b9934f506ef9b2d3180831adf6554c68b0621f9f9f3cd88767ef9487bc6e51cecd6a8857099a7b296
-
Filesize
25B
MD58ba61a16b71609a08bfa35bc213fce49
SHA18374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA2566aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
SHA5125855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1
-
Filesize
1KB
MD505c1b09c58a619e6b34bcb2b224ccf85
SHA1064b00443cf5c429979a0ab26965347365e6136b
SHA256821cc04e7431ea9af1067a2e2cb6ff336dc83b9d4294f20dc38fd00041647775
SHA512890c1e96adf0854cc7aa1f5337621d03047714a7553fb4165ac5dd9be375c89ab85e94b091ee8da3b550528eac9d8311c912117509d3c566301869824b952d68
-
Filesize
1KB
MD515d50b96c3375ef9c3a3309f2842ec2b
SHA138c167ada952d932a764f2f95419c4cf4d5dcc2a
SHA256ca3f4f2d40bb26e4748cfb261bedbaff0f0c5a64ae4869562d618239fc6b91c9
SHA5120db7fd4cb991553fd28e0a72fbbf9fdc74322696419b9c32a08be260b22b141aca6ea2283a67b1fb49876a67971a98cb1ccce685d0c361286db246fc7b618be5
-
Filesize
1KB
MD5d5bde04f96940d399bd2a775d8107662
SHA137cd2ebe2821ea53825c4dee5bf874b49898b6dc
SHA25698c9537b6a4b1637a059fbeeaa05875f1931cb90efaf58b9660b6fa664d3768f
SHA5123cc03259626eba5d5fe02803bac0ecad09867fbfe0a8f27a806351194b050a23087d2250a630c3a14cf7222ca523db464d8009121228e941999de5d95072b363
-
Filesize
1KB
MD5a03f42cdda7b540bfad4dd5953dde824
SHA1be1408f69b9a5842ae77d7379f18cb26086e295d
SHA25607b3527f324a808258daeb2b55fb89a344b9aa854f352aa44aa655ab3ab5b9bc
SHA5125cf6d5300c6c6d7faed91aa196e189f9a011af23d3a76e4285767285c32a226dc977b59fbd8069ef8a318b7ae08519a0faa61da208706f04e08b897fec4b1f9a
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2