Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
82s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
28/12/2023, 20:38
Behavioral task
behavioral1
Sample
f68ecfd28fabcd411e76e01f01b016b8.exe
Resource
win7-20231215-en
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
f68ecfd28fabcd411e76e01f01b016b8.exe
Resource
win10v2004-20231222-en
7 signatures
150 seconds
General
-
Target
f68ecfd28fabcd411e76e01f01b016b8.exe
-
Size
1.0MB
-
MD5
f68ecfd28fabcd411e76e01f01b016b8
-
SHA1
d613f01414a673501cf6657d7486723ff4f58b23
-
SHA256
bbe4303c76c52f7393ac21152e95e08735f27ddd070818c76179031e61e6e485
-
SHA512
34ba0b2c69a77c31145505357a648fd849da0f5875ace1da599c01c1ab9243c732bf0f55b204591f11b19458b0bf97a10e46276e58631a26f2b1c4513f8c810b
-
SSDEEP
24576:kfgFO6nxTySzq3hVNeWY1ANvMALubRDCk/ivJFnz5KU:+g46nxTyeq3hiONUp2kqvJFn
Score
7/10
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 4480 f68ecfd28fabcd411e76e01f01b016b8.exe -
resource yara_rule behavioral2/memory/4480-0-0x0000000000400000-0x0000000000777000-memory.dmp vmprotect behavioral2/memory/4480-2-0x0000000000400000-0x0000000000777000-memory.dmp vmprotect behavioral2/memory/4480-1-0x0000000000400000-0x0000000000777000-memory.dmp vmprotect behavioral2/memory/4480-14-0x0000000000400000-0x0000000000777000-memory.dmp vmprotect -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Kin = "C:\\Program Files\\helps\\svchos.exe" f68ecfd28fabcd411e76e01f01b016b8.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files\helps\svchos.exe f68ecfd28fabcd411e76e01f01b016b8.exe File opened for modification C:\Program Files\helps\svchos.exe f68ecfd28fabcd411e76e01f01b016b8.exe -
Kills process with taskkill 1 IoCs
pid Process 4624 taskkill.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 4480 f68ecfd28fabcd411e76e01f01b016b8.exe 4480 f68ecfd28fabcd411e76e01f01b016b8.exe 4480 f68ecfd28fabcd411e76e01f01b016b8.exe 4480 f68ecfd28fabcd411e76e01f01b016b8.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4480 wrote to memory of 2628 4480 f68ecfd28fabcd411e76e01f01b016b8.exe 106 PID 4480 wrote to memory of 2628 4480 f68ecfd28fabcd411e76e01f01b016b8.exe 106 PID 4480 wrote to memory of 2628 4480 f68ecfd28fabcd411e76e01f01b016b8.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\f68ecfd28fabcd411e76e01f01b016b8.exe"C:\Users\Admin\AppData\Local\Temp\f68ecfd28fabcd411e76e01f01b016b8.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\Windows\SysWOW64\cmd.execmd /c taskkill /F /IM "f68ecfd28fabcd411e76e01f01b016b8.exe"&"C:\Program Files\helps\svchos.exe"2⤵PID:2628
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM "f68ecfd28fabcd411e76e01f01b016b8.exe"1⤵
- Kills process with taskkill
PID:4624
-
C:\Program Files\helps\svchos.exe"C:\Program Files\helps\svchos.exe"1⤵PID:1812