Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2023, 02:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0b10c93a5ac7fd2e1f74fbd857010153.exe
Resource
win7-20231129-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
0b10c93a5ac7fd2e1f74fbd857010153.exe
Resource
win10v2004-20231215-en
5 signatures
150 seconds
General
-
Target
0b10c93a5ac7fd2e1f74fbd857010153.exe
-
Size
19KB
-
MD5
0b10c93a5ac7fd2e1f74fbd857010153
-
SHA1
ef5054721856f40a9a5ccca137ff03d2a18512d3
-
SHA256
77f169cee182b027c2c6d94523033f6035b15ba557e2904a641fe1290143b8be
-
SHA512
e5147247dfa87ba49d0c65c157d60d778910bd04cd5c12511e4cc5db8771023a62d6724cbd6a52acafe4734eeff813e86e33f1984c6699601790345fa3d06264
-
SSDEEP
384:mTW/WRX7GOur0cwHwhF0JD2oOJfG/dl6NR6LDaJug4VaDP:ieg0F0JbHj6NRXJugywP
Score
8/10
Malware Config
Signatures
-
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\86780AF0\ImagePath = "C:\\Windows\\system32\\86780AF0.EXE -p" 0b10c93a5ac7fd2e1f74fbd857010153.exe -
Executes dropped EXE 1 IoCs
pid Process 4400 86780AF0.EXE -
Drops file in System32 directory 5 IoCs
description ioc Process File created C:\Windows\SysWOW64\delme.bat 0b10c93a5ac7fd2e1f74fbd857010153.exe File created C:\Windows\SysWOW64\86780AF0.EXE 0b10c93a5ac7fd2e1f74fbd857010153.exe File opened for modification C:\Windows\SysWOW64\86780AF0.EXE 0b10c93a5ac7fd2e1f74fbd857010153.exe File created C:\Windows\SysWOW64\86780AF0.EXE 86780AF0.EXE File created C:\Windows\SysWOW64\86780AF0.DLL 86780AF0.EXE -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1848 0b10c93a5ac7fd2e1f74fbd857010153.exe 1848 0b10c93a5ac7fd2e1f74fbd857010153.exe 4400 86780AF0.EXE 4400 86780AF0.EXE 4400 86780AF0.EXE 4400 86780AF0.EXE -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1848 wrote to memory of 1196 1848 0b10c93a5ac7fd2e1f74fbd857010153.exe 18 PID 1848 wrote to memory of 1196 1848 0b10c93a5ac7fd2e1f74fbd857010153.exe 18 PID 1848 wrote to memory of 1196 1848 0b10c93a5ac7fd2e1f74fbd857010153.exe 18
Processes
-
C:\Users\Admin\AppData\Local\Temp\0b10c93a5ac7fd2e1f74fbd857010153.exe"C:\Users\Admin\AppData\Local\Temp\0b10c93a5ac7fd2e1f74fbd857010153.exe"1⤵
- Sets service image path in registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\system32\delme.bat2⤵PID:1196
-
-
C:\Windows\SysWOW64\86780AF0.EXEC:\Windows\SysWOW64\86780AF0.EXE -p1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:4400