Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
214s -
max time network
227s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
25/12/2023, 19:54
Static task
static1
Behavioral task
behavioral1
Sample
3975ff2aa7b5d7b9e15c411bf1501c8c.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
3975ff2aa7b5d7b9e15c411bf1501c8c.exe
Resource
win10v2004-20231215-en
General
-
Target
3975ff2aa7b5d7b9e15c411bf1501c8c.exe
-
Size
20KB
-
MD5
3975ff2aa7b5d7b9e15c411bf1501c8c
-
SHA1
b5555fb6bda3ddc24924c49c254a6d6e44a82ba3
-
SHA256
4d8ee5361e4b6544235d0664b01974807032fbe6b801272b00387c7095284ce5
-
SHA512
cc1e412cbabfe02a8bd76aadb5bd649b46ccba8be5dbeaa62f611c89acfa35beaf1c2bc2dad867335ebe566ef5e39a0301901978a9af849ca314921b9275d28d
-
SSDEEP
192:1l5E3krTuntKy0peHDfCpHfBv+I4QwXt9V+jqu0G5KDJBWXhg:1M3PnQoHDCpHf4I4Qwdc0G5KDJ8g
Malware Config
Signatures
-
Drops file in Drivers directory 6 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\drivers\winlogon.exe 3975ff2aa7b5d7b9e15c411bf1501c8c.exe File opened for modification C:\Windows\SysWOW64\drivers\winlogon.exe winlogon.exe File created C:\Windows\SysWOW64\drivers\Msvbvm60.dll winlogon.exe File opened for modification C:\Windows\SysWOW64\drivers\Msvbvm60.dll winlogon.exe File opened for modification C:\Windows\SysWOW64\drivers\winlogon.exe winlogon.exe File opened for modification C:\Windows\SysWOW64\drivers\winlogon.exe winlogon.exe -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Control Panel\International\Geo\Nation 3975ff2aa7b5d7b9e15c411bf1501c8c.exe Key value queried \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Control Panel\International\Geo\Nation winlogon.exe Key value queried \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Control Panel\International\Geo\Nation AE 0124 BE.exe -
Executes dropped EXE 4 IoCs
pid Process 2484 winlogon.exe 3136 AE 0124 BE.exe 3644 winlogon.exe 1504 winlogon.exe -
Loads dropped DLL 3 IoCs
pid Process 3136 AE 0124 BE.exe 1504 winlogon.exe 3644 winlogon.exe -
Drops autorun.inf file 1 TTPs 26 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification F:\Autorun.inf winlogon.exe File opened for modification \??\Y:\Autorun.inf winlogon.exe File opened for modification \??\R:\Autorun.inf winlogon.exe File opened for modification \??\S:\Autorun.inf winlogon.exe File opened for modification \??\M:\Autorun.inf winlogon.exe File opened for modification \??\N:\Autorun.inf winlogon.exe File opened for modification \??\B:\Autorun.inf winlogon.exe File opened for modification \??\G:\Autorun.inf winlogon.exe File opened for modification \??\L:\Autorun.inf winlogon.exe File opened for modification \??\P:\Autorun.inf winlogon.exe File opened for modification \??\V:\Autorun.inf winlogon.exe File opened for modification \??\A:\Autorun.inf winlogon.exe File opened for modification \??\J:\Autorun.inf winlogon.exe File opened for modification \??\U:\Autorun.inf winlogon.exe File opened for modification \??\X:\Autorun.inf winlogon.exe File opened for modification \??\O:\Autorun.inf winlogon.exe File opened for modification \??\T:\Autorun.inf winlogon.exe File opened for modification \??\W:\Autorun.inf winlogon.exe File opened for modification \??\Z:\Autorun.inf winlogon.exe File opened for modification D:\Autorun.inf winlogon.exe File opened for modification \??\E:\Autorun.inf winlogon.exe File opened for modification C:\Autorun.inf winlogon.exe File opened for modification \??\K:\Autorun.inf winlogon.exe File opened for modification \??\Q:\Autorun.inf winlogon.exe File opened for modification \??\H:\Autorun.inf winlogon.exe File opened for modification \??\I:\Autorun.inf winlogon.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\regedit.exe AE 0124 BE.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.dll AE 0124 BE.exe File opened for modification C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.Interop.Word\15.0.0.0__71e9bce111e9429c\Policy.12.0.Microsoft.Office.Interop.Word.dll AE 0124 BE.exe File opened for modification C:\Windows\assembly\GAC_MSIL\System.AddIn.Contract\2.0.0.0__b03f5f7f11d50a3a\System.AddIn.Contract.dll AE 0124 BE.exe File opened for modification C:\Windows\LanguageOverlayCache AE 0124 BE.exe File opened for modification C:\Windows\assembly\GAC_64\Microsoft.Ink\6.1.0.0__31bf3856ad364e35\Microsoft.Ink.dll AE 0124 BE.exe File opened for modification C:\Windows\assembly\GAC_MSIL\System.Data.Entity.Design.Resources AE 0124 BE.exe File opened for modification C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.PowerPoint\15.0.0.0__71e9bce111e9429c AE 0124 BE.exe File opened for modification C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks.v3.5\3.5.0.0__b03f5f7f11d50a3a\Microsoft.Build.Tasks.v3.5.dll AE 0124 BE.exe File opened for modification C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Data.Resources\8.0.0.0_it_b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.Data.resources.dll AE 0124 BE.exe File opened for modification C:\Windows\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\3.0.0.0__b03f5f7f11d50a3a\Microsoft.Transactions.Bridge.Dtc.dll AE 0124 BE.exe File opened for modification C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\normnfd.nlp AE 0124 BE.exe File opened for modification C:\Windows\assembly\GAC_MSIL\System.DirectoryServices.AccountManagement.Resources AE 0124 BE.exe File opened for modification C:\Windows\assembly\GAC_MSIL\System.IO.Log.Resources AE 0124 BE.exe File opened for modification C:\Windows\assembly\GAC_MSIL\System AE 0124 BE.exe File opened for modification C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Utilities.Resources\2.0.0.0_fr_b03f5f7f11d50a3a\Microsoft.Build.Utilities.Resources.dll AE 0124 BE.exe File opened for modification C:\Windows\assembly\GAC_MSIL\Policy.14.0.office\15.0.0.0__71e9bce111e9429c\Policy.14.0.office.config AE 0124 BE.exe File opened for modification C:\Windows\addins AE 0124 BE.exe File opened for modification C:\Windows\L2Schemas AE 0124 BE.exe File opened for modification C:\Windows\PFRO.log AE 0124 BE.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationBuildTasks AE 0124 BE.exe File opened for modification C:\Windows\assembly\GAC_64\Microsoft.Transactions.Bridge.Dtc\3.0.0.0__b03f5f7f11d50a3a\Microsoft.Transactions.Bridge.Dtc.dll AE 0124 BE.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc AE 0124 BE.exe File opened for modification C:\Windows\assembly\GAC_MSIL\Microsoft.Transactions.Bridge.Resources\3.0.0.0_es_b03f5f7f11d50a3a AE 0124 BE.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFramework.Aero\3.0.0.0__31bf3856ad364e35\PresentationFramework.Aero.dll AE 0124 BE.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMDiagnostics.Resources\3.0.0.0_es_b77a5c561934e089\SMDiagnostics.resources.dll AE 0124 BE.exe File opened for modification C:\Windows\Speech AE 0124 BE.exe File opened for modification C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.SmartTag AE 0124 BE.exe File opened for modification C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.Common.v9.0\9.0.0.0__b03f5f7f11d50a3a AE 0124 BE.exe File opened for modification C:\Windows\assembly\GAC_MSIL\MMCEx.Resources\3.0.0.0_fr_31bf3856ad364e35 AE 0124 BE.exe File opened for modification C:\Windows\assembly\GAC_MSIL\System.IdentityModel.Resources\3.0.0.0_de_b77a5c561934e089\System.IdentityModel.Resources.dll AE 0124 BE.exe File opened for modification C:\Windows\assembly\GAC_MSIL\System.Data.Resources AE 0124 BE.exe File opened for modification C:\Windows\assembly\GAC_MSIL\IEHost\2.0.0.0__b03f5f7f11d50a3a\IEHost.dll AE 0124 BE.exe File opened for modification C:\Windows\assembly\GAC_MSIL\MMCFxCommon.Resources\3.0.0.0_es_31bf3856ad364e35 AE 0124 BE.exe File opened for modification C:\Windows\assembly\GAC_MSIL\System.Data.SqlXml.Resources\2.0.0.0_it_b77a5c561934e089\system.data.sqlxml.resources.dll AE 0124 BE.exe File opened for modification C:\Windows\System AE 0124 BE.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe AE 0124 BE.exe File opened for modification C:\Windows\assembly\GAC_MSIL\System.Data.Services.Design.Resources\3.5.0.0_de_b77a5c561934e089 AE 0124 BE.exe File opened for modification C:\Windows\assembly\GAC_MSIL\System.Data.Services.Resources\3.5.0.0_ja_b77a5c561934e089\System.Data.Services.resources.dll AE 0124 BE.exe File opened for modification C:\Windows\assembly\GAC_MSIL\System.Configuration AE 0124 BE.exe File opened for modification C:\Windows\assembly\GAC_MSIL\Microsoft.Transactions.Bridge.Dtc.Resources\3.0.0.0_fr_b03f5f7f11d50a3a AE 0124 BE.exe File opened for modification C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine.Resources\2.0.0.0_it_b03f5f7f11d50a3a\Microsoft.Build.Engine.resources.dll AE 0124 BE.exe File opened for modification C:\Windows\assembly\GAC_MSIL\MMCFxCommon\3.0.0.0__31bf3856ad364e35 AE 0124 BE.exe File opened for modification C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Vbe.Interop\15.0.0.0__71e9bce111e9429c AE 0124 BE.exe File opened for modification C:\Windows\PrintDialog AE 0124 BE.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64 AE 0124 BE.exe File opened for modification C:\Windows\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\ISymWrapper.dll AE 0124 BE.exe File opened for modification C:\Windows\assembly\GAC_64\CustomMarshalers AE 0124 BE.exe File opened for modification C:\Windows\assembly\GAC_MSIL\System.Web.Abstractions.Resources AE 0124 BE.exe File opened for modification C:\Windows\assembly\GAC_MSIL\System.Data.Services.Client.Resources\3.5.0.0_de_b77a5c561934e089 AE 0124 BE.exe File opened for modification C:\Windows\assembly\GAC_MSIL\System.IdentityModel\3.0.0.0__b77a5c561934e089 AE 0124 BE.exe File opened for modification C:\Windows\assembly\GAC_64 AE 0124 BE.exe File opened for modification C:\Windows\assembly\GAC\stdole\7.0.3300.0__b03f5f7f11d50a3a AE 0124 BE.exe File opened for modification C:\Windows\assembly\GAC_MSIL\AspNetMMCExt AE 0124 BE.exe File opened for modification C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.Interop.Access.Dao AE 0124 BE.exe File opened for modification C:\Windows\assembly\GAC_MSIL\System.Design.Resources\2.0.0.0_ja_b03f5f7f11d50a3a AE 0124 BE.exe File opened for modification C:\Windows\assembly\GAC_MSIL\System.DirectoryServices.Protocols\2.0.0.0__b03f5f7f11d50a3a AE 0124 BE.exe File opened for modification C:\Windows\assembly\GAC_32\srmlib\1.0.0.0__31bf3856ad364e35 AE 0124 BE.exe File opened for modification C:\Windows\assembly\GAC_MSIL\System.Web.Mobile AE 0124 BE.exe File opened for modification C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Conversion.v3.5\3.5.0.0__b03f5f7f11d50a3a\Microsoft.Build.Conversion.v3.5.dll AE 0124 BE.exe File opened for modification C:\Windows\assembly\GAC_MSIL\System.Design\2.0.0.0__b03f5f7f11d50a3a AE 0124 BE.exe File opened for modification C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0\10.0.0.0__b03f5f7f11d50a3a AE 0124 BE.exe File opened for modification C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll AE 0124 BE.exe File opened for modification C:\Windows\assembly\GAC_MSIL\Microsoft_VsaVb\8.0.0.0__b03f5f7f11d50a3a AE 0124 BE.exe File opened for modification C:\Windows\assembly\GAC_MSIL\mscorlib.Resources\2.0.0.0_ja_b77a5c561934e089 AE 0124 BE.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ AE 0124 BE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 3975ff2aa7b5d7b9e15c411bf1501c8c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ winlogon.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 4420 3975ff2aa7b5d7b9e15c411bf1501c8c.exe 2484 winlogon.exe 3136 AE 0124 BE.exe 1504 winlogon.exe 3644 winlogon.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 4420 wrote to memory of 2484 4420 3975ff2aa7b5d7b9e15c411bf1501c8c.exe 91 PID 4420 wrote to memory of 2484 4420 3975ff2aa7b5d7b9e15c411bf1501c8c.exe 91 PID 4420 wrote to memory of 2484 4420 3975ff2aa7b5d7b9e15c411bf1501c8c.exe 91 PID 2484 wrote to memory of 3136 2484 winlogon.exe 92 PID 2484 wrote to memory of 3136 2484 winlogon.exe 92 PID 2484 wrote to memory of 3136 2484 winlogon.exe 92 PID 2484 wrote to memory of 3644 2484 winlogon.exe 93 PID 2484 wrote to memory of 3644 2484 winlogon.exe 93 PID 2484 wrote to memory of 3644 2484 winlogon.exe 93 PID 3136 wrote to memory of 1504 3136 AE 0124 BE.exe 94 PID 3136 wrote to memory of 1504 3136 AE 0124 BE.exe 94 PID 3136 wrote to memory of 1504 3136 AE 0124 BE.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\3975ff2aa7b5d7b9e15c411bf1501c8c.exe"C:\Users\Admin\AppData\Local\Temp\3975ff2aa7b5d7b9e15c411bf1501c8c.exe"1⤵
- Drops file in Drivers directory
- Checks computer location settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4420 -
C:\Windows\SysWOW64\drivers\winlogon.exe"C:\Windows\System32\drivers\winlogon.exe"2⤵
- Drops file in Drivers directory
- Checks computer location settings
- Executes dropped EXE
- Drops autorun.inf file
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Windows\AE 0124 BE.exe"C:\Windows\AE 0124 BE.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3136 -
C:\Windows\SysWOW64\drivers\winlogon.exe"C:\Windows\System32\drivers\winlogon.exe"4⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1504
-
-
-
C:\Windows\SysWOW64\drivers\winlogon.exe"C:\Windows\System32\drivers\winlogon.exe"3⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:3644
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD525f62c02619174b35851b0e0455b3d94
SHA14e8ee85157f1769f6e3f61c0acbe59072209da71
SHA256898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2
SHA512f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a
-
Filesize
40KB
MD5a405021b3ba543277f46cdfdb23ee51b
SHA12a325fc37598c4518453157123db355b4ad240b9
SHA256eecaea8f93c3ad88053d6f7435bdc477a3d571de879d06b94c6108f11b05ed6c
SHA512b3a28318540579ae26a50b1fdacd8aecb1a12f956b3c6713ba4ecdac68634a2db51a86db7aac0d89a000851f3e90e141e20797e4ad46dd19798e2819c813f77d
-
Filesize
1.2MB
MD55078666bc51a7d8e49a2666b0228c075
SHA11eda2fdba0d5d70170ae9f5f8e4831bf383568fb
SHA256dfbb8e4860e5c4d0da00621bcc97c63fbdf50aabc7843f77739f3b50de3bf36c
SHA5121646ff8af7bc9301571bfed26a5cc3dbc64334c989072a3e76bcc025a420248fa641627b607562f96e3601bba8cff79f63b0e439e615ba2a3aa4036153a0a113
-
Filesize
40KB
MD5b4eb44cef0dac9767ea5077c089e331c
SHA16de110c656f61278df3657d897e1187d014aa2c3
SHA2566ce7d15fbc50c4add0582ca47b5ce8ffe53ad5ea347c345ad7e3f9d668b342fa
SHA512f21c4733a7a8e67abf95a573660c5822b3a5382db692162bde399fef3438ff685a8e9d9fdd009fd0a5d6cc007f7e4dd0a024a2d1e78b9de5800df8caa27219b3
-
Filesize
25B
MD5589b6886a49054d03b739309a1de9fcc
SHA10ec1dff7a03f13dea28eea5e754d5b0e5e1dc308
SHA256564815feb9c5bdadb145cd0d16738c4e5fbc6a46cf65c62ac6a985c43d1939e8
SHA5124b6f567398863aba39eec00e9f071364b79d5c29867b93fb968725e10e33a9bfff60f8ab6acceae44e715a35ec7139d12da06c33fa074b6be02ff5357c53c0eb