Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2023, 00:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
09104d1e60e897712568dbca8c54cace.exe
Resource
win7-20231215-en
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
09104d1e60e897712568dbca8c54cace.exe
Resource
win10v2004-20231215-en
7 signatures
150 seconds
General
-
Target
09104d1e60e897712568dbca8c54cace.exe
-
Size
629KB
-
MD5
09104d1e60e897712568dbca8c54cace
-
SHA1
75ac14370f0a94b57b28a21cf23b15785c31700b
-
SHA256
757e8e0d877c4f6e3ee83dcfb19b03871b2a11592db3fd2e930d6020d5a1422b
-
SHA512
72b553d55ad6195ef36df133f6b6da4fa36da25c41f786235d898cb1ea0368b1d7fb53cd9bfa1699303ed1eb6fb8dd43a7f45642508345eab5d3ee8af87b9e99
-
SSDEEP
12288:MlIFreXlWDAFWGijeZZICG5l1gx41c2obY7rwtN5yfMe:MSAO5GijeZXG5PgxqocwkUe
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 264 03VMP~1.EXE 4676 windows.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 09104d1e60e897712568dbca8c54cace.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\windows.exe 03VMP~1.EXE File opened for modification C:\Windows\windows.exe 03VMP~1.EXE File created C:\Windows\DELME.BAT 03VMP~1.EXE -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ windows.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" windows.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" windows.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" windows.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" windows.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 264 03VMP~1.EXE Token: SeDebugPrivilege 4676 windows.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4676 windows.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1636 wrote to memory of 264 1636 09104d1e60e897712568dbca8c54cace.exe 13 PID 1636 wrote to memory of 264 1636 09104d1e60e897712568dbca8c54cace.exe 13 PID 1636 wrote to memory of 264 1636 09104d1e60e897712568dbca8c54cace.exe 13 PID 4676 wrote to memory of 1932 4676 windows.exe 48 PID 4676 wrote to memory of 1932 4676 windows.exe 48 PID 264 wrote to memory of 3804 264 03VMP~1.EXE 92 PID 264 wrote to memory of 3804 264 03VMP~1.EXE 92 PID 264 wrote to memory of 3804 264 03VMP~1.EXE 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\09104d1e60e897712568dbca8c54cace.exe"C:\Users\Admin\AppData\Local\Temp\09104d1e60e897712568dbca8c54cace.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\03VMP~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\03VMP~1.EXE2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:264 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\DELME.BAT3⤵PID:3804
-
-
-
C:\Windows\windows.exeC:\Windows\windows.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE"2⤵PID:1932
-