Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
91s -
max time network
76s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
25/12/2023, 19:15
Static task
static1
Behavioral task
behavioral1
Sample
373001231538087e3c16b4ec0bbca786.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
373001231538087e3c16b4ec0bbca786.exe
Resource
win10v2004-20231215-en
General
-
Target
373001231538087e3c16b4ec0bbca786.exe
-
Size
80KB
-
MD5
373001231538087e3c16b4ec0bbca786
-
SHA1
b92dfecc2bc482a23a2d0227c8546e6bd34ea567
-
SHA256
cfe97965be7a8260ab099c665b716a2a628d688d332980ef974611c1f257d555
-
SHA512
a5e9d1604a65b010bf3c84eddb884297fdd9b767c48df16565823f6910e057d66f125ac31dc8bdb0b6335b9d60eafd6008dd5295a839b7a1120998214ae6483d
-
SSDEEP
1536:FbTToxv23XJ7hfJsrsCEu5sz0qOOLnNTTo:FbTToxv2nJ76vEKszZnNTTo
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\micrososo = "c:\\users\\admin\\appdata\\local\\temp\\373001231538087e3c16b4ec0bbca786.exe " reg.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Survival_0.txt 373001231538087e3c16b4ec0bbca786.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4796 373001231538087e3c16b4ec0bbca786.exe 4796 373001231538087e3c16b4ec0bbca786.exe 4796 373001231538087e3c16b4ec0bbca786.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4796 wrote to memory of 736 4796 373001231538087e3c16b4ec0bbca786.exe 44 PID 4796 wrote to memory of 736 4796 373001231538087e3c16b4ec0bbca786.exe 44 PID 4796 wrote to memory of 736 4796 373001231538087e3c16b4ec0bbca786.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\373001231538087e3c16b4ec0bbca786.exe"C:\Users\Admin\AppData\Local\Temp\373001231538087e3c16b4ec0bbca786.exe"1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\Windows\SysWOW64\reg.exereg add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v "micrososo" /d "c:\users\admin\appdata\local\temp\373001231538087e3c16b4ec0bbca786.exe " /f2⤵
- Adds Run key to start application
PID:736
-