Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
157s -
max time network
176s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2023, 01:13
Static task
static1
Behavioral task
behavioral1
Sample
09b4ea7dc4b3b2673f95343f88b03018.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
09b4ea7dc4b3b2673f95343f88b03018.exe
Resource
win10v2004-20231215-en
General
-
Target
09b4ea7dc4b3b2673f95343f88b03018.exe
-
Size
20KB
-
MD5
09b4ea7dc4b3b2673f95343f88b03018
-
SHA1
76e98ed1bd23f05b16f5e1b347af7c9d464030b9
-
SHA256
7afec4488ee587cefcfc10c3040edb80c3a94566acc4c5e32872ff7a723ad7c3
-
SHA512
fbe05e422168656d423c4d7d4cf309987a794148431135d2150eda679d6c66ba0a1e4dc992b432baf8c9b3b250a625f9b5aa03f771e6426dda7fdead551488ea
-
SSDEEP
384:m+WlGJGOuLcRcE/DyNBfpx1mLFDo+NMvAGwER4rZ0TtHV2WF05I:XJ9vyHIDoEWwt0TtHoWee
Malware Config
Signatures
-
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\1D231FAA\ImagePath = "C:\\Windows\\system32\\8977E857.EXE -g" 09b4ea7dc4b3b2673f95343f88b03018.exe -
Executes dropped EXE 1 IoCs
pid Process 4616 8977E857.EXE -
Drops file in System32 directory 34 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_1280.db 8977E857.EXE File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\thumbcache_32.db 8977E857.EXE File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\thumbcache_wide.db 8977E857.EXE File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\thumbcache_custom_stream.db 8977E857.EXE File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\thumbcache_96.db 8977E857.EXE File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_32.db 8977E857.EXE File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_96.db 8977E857.EXE File created C:\Windows\SysWOW64\del.bat 09b4ea7dc4b3b2673f95343f88b03018.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\thumbcache_1280.db 8977E857.EXE File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\thumbcache_sr.db 8977E857.EXE File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_custom_stream.db 8977E857.EXE File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide.db 8977E857.EXE File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_16.db 8977E857.EXE File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_2560.db 8977E857.EXE File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_sr.db 8977E857.EXE File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\thumbcache_2560.db 8977E857.EXE File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\thumbcache_exif.db 8977E857.EXE File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db 8977E857.EXE File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide_alternate.db 8977E857.EXE File created C:\Windows\SysWOW64\8977E857.EXE 8977E857.EXE File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\thumbcache_48.db 8977E857.EXE File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\thumbcache_768.db 8977E857.EXE File opened for modification C:\Windows\SysWOW64\8977E857.EXE 09b4ea7dc4b3b2673f95343f88b03018.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\thumbcache_256.db 8977E857.EXE File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_exif.db 8977E857.EXE File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_1920.db 8977E857.EXE File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\thumbcache_1920.db 8977E857.EXE File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db 8977E857.EXE File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_256.db 8977E857.EXE File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\thumbcache_wide_alternate.db 8977E857.EXE File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_768.db 8977E857.EXE File created C:\Windows\SysWOW64\8977E857.EXE 09b4ea7dc4b3b2673f95343f88b03018.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db 8977E857.EXE File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\thumbcache_16.db 8977E857.EXE -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64 8977E857.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies data under HKEY_USERS 12 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Sequence = "1" 8977E857.EXE Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c00570069006e0064006f00770073005c00530079007300740065006d003300320000000000 8977E857.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer 8977E857.EXE Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\TelemetrySalt = "2" 8977E857.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000 8977E857.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager 8977E857.EXE Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Owner = 08120000f712e6a7913bda01 8977E857.EXE Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 17f30533c3bbd538bda5e0a2cdcd99122e1d38f3f95d6e48ea929ae4b79a7bb7 8977E857.EXE Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000 8977E857.EXE Key created \REGISTRY\USER\.DEFAULT\Software 8977E857.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft 8977E857.EXE Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = 4fc9430e5dd1ea86fd1de42eba5a32d016bda85fb52d35829f870075ac6c3596 8977E857.EXE -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4072 09b4ea7dc4b3b2673f95343f88b03018.exe 4072 09b4ea7dc4b3b2673f95343f88b03018.exe 4616 8977E857.EXE 4616 8977E857.EXE -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 4072 09b4ea7dc4b3b2673f95343f88b03018.exe 4616 8977E857.EXE 4616 8977E857.EXE 4616 8977E857.EXE -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4072 wrote to memory of 2268 4072 09b4ea7dc4b3b2673f95343f88b03018.exe 97 PID 4072 wrote to memory of 2268 4072 09b4ea7dc4b3b2673f95343f88b03018.exe 97 PID 4072 wrote to memory of 2268 4072 09b4ea7dc4b3b2673f95343f88b03018.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\09b4ea7dc4b3b2673f95343f88b03018.exe"C:\Users\Admin\AppData\Local\Temp\09b4ea7dc4b3b2673f95343f88b03018.exe"1⤵
- Sets service image path in registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4072 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\system32\del.bat2⤵PID:2268
-
-
C:\Windows\SysWOW64\8977E857.EXEC:\Windows\SysWOW64\8977E857.EXE -g1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:4616
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
20KB
MD509b4ea7dc4b3b2673f95343f88b03018
SHA176e98ed1bd23f05b16f5e1b347af7c9d464030b9
SHA2567afec4488ee587cefcfc10c3040edb80c3a94566acc4c5e32872ff7a723ad7c3
SHA512fbe05e422168656d423c4d7d4cf309987a794148431135d2150eda679d6c66ba0a1e4dc992b432baf8c9b3b250a625f9b5aa03f771e6426dda7fdead551488ea
-
Filesize
211B
MD592a8cf5691456eb6c973e9259ffba473
SHA185373a5214dbf30c870288a680ac3ea649f728ea
SHA25637d817e9e64d5043deaa80706ae1bbfb1585396e5fb9d3380e7110938be24db9
SHA51227ecad831be103087f58eff901e43ca0fc74394ee7c4bfb39d5bc0ee476d35a99dc3facc4103784e0f085c2f2c64fb12e8bae1a78c85f6484569b4d3d5881d33