Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
174s -
max time network
187s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
29/12/2023, 23:21
Behavioral task
behavioral1
Sample
06c6660d4fd004b01023b32364c1082c.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
06c6660d4fd004b01023b32364c1082c.exe
Resource
win10v2004-20231215-en
General
-
Target
06c6660d4fd004b01023b32364c1082c.exe
-
Size
17KB
-
MD5
06c6660d4fd004b01023b32364c1082c
-
SHA1
fdbbdaf5df0e0deda1ccdf8734180c0ca2f26256
-
SHA256
86b5dc538603c5f40164e7a70b1605fbcbd274f7ae8d6b5d774b0c49a568a015
-
SHA512
2703a208103f307dd15412d8af7753b70bb5ad0eeca3b31ca4bea3ec013a51ee4c24507d011c337169e78a62b607a524a8e1dfe873ff6fe98442ba243a7fd15d
-
SSDEEP
384:njb2KK8qY5m2en32YKzWk0J0TXRasQDj77:jw8Dne32YKzWkOKXXC7
Malware Config
Signatures
-
Drops file in Drivers directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\drivers\PCIDump.sys WinHelp32.exe File opened for modification C:\Windows\SysWOW64\drivers\PCIDump.sys 06c6660d4fd004b01023b32364c1082c.exe -
Executes dropped EXE 1 IoCs
pid Process 2716 WinHelp32.exe -
resource yara_rule behavioral2/memory/3492-0-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral2/files/0x000600000002320c-5.dat upx behavioral2/memory/3492-9-0x0000000000400000-0x000000000040E000-memory.dmp upx -
Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\WinHelp32.exe 06c6660d4fd004b01023b32364c1082c.exe File opened for modification C:\Windows\SysWOW64\WinHelp32.exe 06c6660d4fd004b01023b32364c1082c.exe File created C:\Windows\SysWOW64\WinHelp32.exe WinHelp32.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 3492 06c6660d4fd004b01023b32364c1082c.exe Token: SeIncBasePriorityPrivilege 2716 WinHelp32.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 3492 wrote to memory of 2716 3492 06c6660d4fd004b01023b32364c1082c.exe 90 PID 3492 wrote to memory of 2716 3492 06c6660d4fd004b01023b32364c1082c.exe 90 PID 3492 wrote to memory of 2716 3492 06c6660d4fd004b01023b32364c1082c.exe 90 PID 3492 wrote to memory of 4920 3492 06c6660d4fd004b01023b32364c1082c.exe 91 PID 3492 wrote to memory of 4920 3492 06c6660d4fd004b01023b32364c1082c.exe 91 PID 3492 wrote to memory of 4920 3492 06c6660d4fd004b01023b32364c1082c.exe 91 PID 2716 wrote to memory of 3384 2716 WinHelp32.exe 93 PID 2716 wrote to memory of 3384 2716 WinHelp32.exe 93 PID 2716 wrote to memory of 3384 2716 WinHelp32.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\06c6660d4fd004b01023b32364c1082c.exe"C:\Users\Admin\AppData\Local\Temp\06c6660d4fd004b01023b32364c1082c.exe"1⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3492 -
C:\Windows\SysWOW64\WinHelp32.exe"C:\Windows\system32\WinHelp32.exe"2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C del C:\Windows\SysWOW64\WINHEL~1.EXE > nul3⤵PID:3384
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C del C:\Users\Admin\AppData\Local\Temp\06C666~1.EXE > nul2⤵PID:4920
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
17KB
MD506c6660d4fd004b01023b32364c1082c
SHA1fdbbdaf5df0e0deda1ccdf8734180c0ca2f26256
SHA25686b5dc538603c5f40164e7a70b1605fbcbd274f7ae8d6b5d774b0c49a568a015
SHA5122703a208103f307dd15412d8af7753b70bb5ad0eeca3b31ca4bea3ec013a51ee4c24507d011c337169e78a62b607a524a8e1dfe873ff6fe98442ba243a7fd15d
-
Filesize
4KB
MD5d058dd1757e857d2cf1afcadce95a521
SHA13d5563ce8e7a11110d238b25711a176a63bfb703
SHA256a0cd51ff93d087654b5ceccc279df8eb5e9783a530a3bca83a06c7f82025885d
SHA512748937d6ae01ddbe97470754b73563c04e492d7980a8e0bbb9ed7838e85c8cff912d087204325664c3051aeba15606d23b9b507b211a6369e7ecc7bda175da44