Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
29/12/2023, 21:42
Static task
static1
Behavioral task
behavioral1
Sample
04b66998158d55722562b37875128cad.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
04b66998158d55722562b37875128cad.exe
Resource
win10v2004-20231215-en
General
-
Target
04b66998158d55722562b37875128cad.exe
-
Size
5.3MB
-
MD5
04b66998158d55722562b37875128cad
-
SHA1
f2034598921528f96b8f9e5059e17b384d887049
-
SHA256
91842fb7fa1c1ff89ccbf7f22013609ecdf520bd4fc5e9e382c0c8615d22b784
-
SHA512
bd9cec1f5088a93f69dcb0f0bda721bdd006bd4ccdba0eb1f5239291f246528d7a44550790af6f631d99114999f9f6c31b18dea3732dbc41e5aefc8629600c4b
-
SSDEEP
98304:0fR9XUg1XGTOq/pDi2mgJtNI3ykcKKpvIl8jb+S2bSF9kyIeROE7VO2qxuXHukvy:0fUOqxDNVUyuuv5bF2ODRvVLy/3vum2s
Malware Config
Signatures
-
Stops running service(s) 3 TTPs
-
Uses Session Manager for persistence 2 TTPs 3 IoCs
Creates Session Manager registry key to run executable early in system boot.
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet002\Control\Session manager\BootExecute = 6100750074006f0063006800650063006b0020006100750074006f00630068006b0020002a0000000000 reg.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Session Manager\BootExecute = 6100750074006f0063006800650063006b0020006100750074006f00630068006b0020002a0000000000 reg.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Session Manager\BootExecute = 6100750074006f0063006800650063006b0020006100750074006f00630068006b0020002a0000000000 reg.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows32 = "C:\\Arquivos de programas\\Windows32.exe" 04b66998158d55722562b37875128cad.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2076 sc.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4036 schtasks.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 3692 wrote to memory of 4036 3692 04b66998158d55722562b37875128cad.exe 21 PID 3692 wrote to memory of 4036 3692 04b66998158d55722562b37875128cad.exe 21 PID 3692 wrote to memory of 4036 3692 04b66998158d55722562b37875128cad.exe 21 PID 3692 wrote to memory of 2076 3692 04b66998158d55722562b37875128cad.exe 29 PID 3692 wrote to memory of 2076 3692 04b66998158d55722562b37875128cad.exe 29 PID 3692 wrote to memory of 2076 3692 04b66998158d55722562b37875128cad.exe 29 PID 3692 wrote to memory of 4528 3692 04b66998158d55722562b37875128cad.exe 28 PID 3692 wrote to memory of 4528 3692 04b66998158d55722562b37875128cad.exe 28 PID 3692 wrote to memory of 4528 3692 04b66998158d55722562b37875128cad.exe 28 PID 3692 wrote to memory of 4288 3692 04b66998158d55722562b37875128cad.exe 27 PID 3692 wrote to memory of 4288 3692 04b66998158d55722562b37875128cad.exe 27 PID 3692 wrote to memory of 4288 3692 04b66998158d55722562b37875128cad.exe 27 PID 3692 wrote to memory of 2756 3692 04b66998158d55722562b37875128cad.exe 26 PID 3692 wrote to memory of 2756 3692 04b66998158d55722562b37875128cad.exe 26 PID 3692 wrote to memory of 2756 3692 04b66998158d55722562b37875128cad.exe 26
Processes
-
C:\Users\Admin\AppData\Local\Temp\04b66998158d55722562b37875128cad.exe"C:\Users\Admin\AppData\Local\Temp\04b66998158d55722562b37875128cad.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3692 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn startt /tr c:\autoexec.bat /sc onstart /ru system2⤵
- Creates scheduled task(s)
PID:4036
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\SYSTEM\CurrentControlSet\Control\Session manager" /v BootExecute /t REG_MULTI_SZ /d "autocheck autochk *" /f2⤵
- Uses Session Manager for persistence
PID:2756
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\SYSTEM\ControlSet002\Control\Session manager" /v BootExecute /t REG_MULTI_SZ /d "autocheck autochk *" /f2⤵
- Uses Session Manager for persistence
PID:4288
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\SYSTEM\ControlSet001\Control\Session manager" /v BootExecute /t REG_MULTI_SZ /d "autocheck autochk *" /f2⤵
- Uses Session Manager for persistence
PID:4528
-
-
C:\Windows\SysWOW64\sc.exesc delete GbpSv2⤵
- Launches sc.exe
PID:2076
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1