Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
96s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
25/12/2023, 20:08
Static task
static1
Behavioral task
behavioral1
Sample
3a4509b9b97b571c302edcb211b38fbf.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
3a4509b9b97b571c302edcb211b38fbf.exe
Resource
win10v2004-20231222-en
General
-
Target
3a4509b9b97b571c302edcb211b38fbf.exe
-
Size
144KB
-
MD5
3a4509b9b97b571c302edcb211b38fbf
-
SHA1
186967981ddf2c93287a8b834027974ab146caf4
-
SHA256
5adbd37afeff1028ecea8a71ca31464461304d33f1220b80d99632c5a4453f91
-
SHA512
6862861210bedd986f1d77e03bd4afad29a930ec2bd9f7bb1178ca509afa2eb4d0bcb8407305ab6b574f48c6dd7fae10b4b1b2e9bbc94c05d3b06ff826ca0cec
-
SSDEEP
1536:RwkqP1/1yo0Wnchx/X+07DDpFlgYrhp7gX4XFv3AVrlFIS39/oLa:RvqPx1CmchE0PDvhp7i4VvQvFX39/b
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\system32\drivers\etc\host7 3a4509b9b97b571c302edcb211b38fbf.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation 3a4509b9b97b571c302edcb211b38fbf.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4884 set thread context of 2836 4884 3a4509b9b97b571c302edcb211b38fbf.exe 90 -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\pokoz.sys 3a4509b9b97b571c302edcb211b38fbf.exe File opened for modification C:\Windows\pokoz.sys 3a4509b9b97b571c302edcb211b38fbf.exe File created C:\Windows\sdel.bat 3a4509b9b97b571c302edcb211b38fbf.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2836 3a4509b9b97b571c302edcb211b38fbf.exe 2836 3a4509b9b97b571c302edcb211b38fbf.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 660 Process not Found -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 4884 wrote to memory of 2836 4884 3a4509b9b97b571c302edcb211b38fbf.exe 90 PID 4884 wrote to memory of 2836 4884 3a4509b9b97b571c302edcb211b38fbf.exe 90 PID 4884 wrote to memory of 2836 4884 3a4509b9b97b571c302edcb211b38fbf.exe 90 PID 4884 wrote to memory of 2836 4884 3a4509b9b97b571c302edcb211b38fbf.exe 90 PID 4884 wrote to memory of 2836 4884 3a4509b9b97b571c302edcb211b38fbf.exe 90 PID 4884 wrote to memory of 2836 4884 3a4509b9b97b571c302edcb211b38fbf.exe 90 PID 4884 wrote to memory of 2836 4884 3a4509b9b97b571c302edcb211b38fbf.exe 90 PID 4884 wrote to memory of 2836 4884 3a4509b9b97b571c302edcb211b38fbf.exe 90 PID 4884 wrote to memory of 2836 4884 3a4509b9b97b571c302edcb211b38fbf.exe 90 PID 2836 wrote to memory of 1328 2836 3a4509b9b97b571c302edcb211b38fbf.exe 92 PID 2836 wrote to memory of 1328 2836 3a4509b9b97b571c302edcb211b38fbf.exe 92 PID 2836 wrote to memory of 1328 2836 3a4509b9b97b571c302edcb211b38fbf.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\3a4509b9b97b571c302edcb211b38fbf.exe"C:\Users\Admin\AppData\Local\Temp\3a4509b9b97b571c302edcb211b38fbf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\3a4509b9b97b571c302edcb211b38fbf.exe"C:\Users\Admin\AppData\Local\Temp\3a4509b9b97b571c302edcb211b38fbf.exe"2⤵
- Drops file in Drivers directory
- Checks computer location settings
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Windows\sdel.bat" "C:\Users\Admin\AppData\Local\Temp\3a4509b9b97b571c302edcb211b38fbf.exe""3⤵PID:1328
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
87B
MD5c422f73e563f284c81c1a23aff9e3d57
SHA140a866138213d046c7982e2eef29349457ba0d76
SHA256735faf8fc874f00472cbb0abc08cb86390d44c737e77558c2b93bfeefc2c4d16
SHA512355fab1efd9f78ee8f8f9260c80634493fc7b4b2fcefa71bcb938ec89cb788b52ad2ffe3a24d0aa18af00db29102d365859c0635524ebc87638bda3f05b8444a