Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2023, 03:28
Static task
static1
Behavioral task
behavioral1
Sample
0cf97b5fe3133c0bdc8100a13972dbbd.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
0cf97b5fe3133c0bdc8100a13972dbbd.exe
Resource
win10v2004-20231215-en
General
-
Target
0cf97b5fe3133c0bdc8100a13972dbbd.exe
-
Size
12KB
-
MD5
0cf97b5fe3133c0bdc8100a13972dbbd
-
SHA1
c1e4ee58268912aa625c8afb3e38806e61cd5730
-
SHA256
969ff1524e50f532b272cee748b30da63c6892608986705e34a89efcc3ea40d4
-
SHA512
0a14414bd40f9e3432eb177fdd7bbb51918aba35f2018e4f8445e807b346dbd164741a24d403ccbf59fd12134628a9403d28a828b93096a4bd6d30c8703d772f
-
SSDEEP
384:8no7NccDdj9T9AicZA6Foap8fVxTz8VanCj:ePgt9ZOFoap8fVxUVaCj
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\adsntzt.dll = "{E0F3526A-4165-4589-80CD-50B6FBAC3BDA}" 0cf97b5fe3133c0bdc8100a13972dbbd.exe -
Loads dropped DLL 1 IoCs
pid Process 4004 0cf97b5fe3133c0bdc8100a13972dbbd.exe -
Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\adsntzt.tmp 0cf97b5fe3133c0bdc8100a13972dbbd.exe File opened for modification C:\Windows\SysWOW64\adsntzt.tmp 0cf97b5fe3133c0bdc8100a13972dbbd.exe File opened for modification C:\Windows\SysWOW64\adsntzt.nls 0cf97b5fe3133c0bdc8100a13972dbbd.exe -
Modifies registry class 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E0F3526A-4165-4589-80CD-50B6FBAC3BDA}\InProcServer32 0cf97b5fe3133c0bdc8100a13972dbbd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E0F3526A-4165-4589-80CD-50B6FBAC3BDA}\InProcServer32\ = "C:\\Windows\\SysWow64\\adsntzt.dll" 0cf97b5fe3133c0bdc8100a13972dbbd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E0F3526A-4165-4589-80CD-50B6FBAC3BDA}\InProcServer32\ThreadingModel = "Apartment" 0cf97b5fe3133c0bdc8100a13972dbbd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E0F3526A-4165-4589-80CD-50B6FBAC3BDA} 0cf97b5fe3133c0bdc8100a13972dbbd.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4004 0cf97b5fe3133c0bdc8100a13972dbbd.exe 4004 0cf97b5fe3133c0bdc8100a13972dbbd.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4004 0cf97b5fe3133c0bdc8100a13972dbbd.exe 4004 0cf97b5fe3133c0bdc8100a13972dbbd.exe 4004 0cf97b5fe3133c0bdc8100a13972dbbd.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4004 wrote to memory of 2412 4004 0cf97b5fe3133c0bdc8100a13972dbbd.exe 103 PID 4004 wrote to memory of 2412 4004 0cf97b5fe3133c0bdc8100a13972dbbd.exe 103 PID 4004 wrote to memory of 2412 4004 0cf97b5fe3133c0bdc8100a13972dbbd.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\0cf97b5fe3133c0bdc8100a13972dbbd.exe"C:\Users\Admin\AppData\Local\Temp\0cf97b5fe3133c0bdc8100a13972dbbd.exe"1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4004 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\B7A7.tmp.bat2⤵PID:2412
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
179B
MD55e24d501dab38e43f1bcc2cfef3429e2
SHA111e125ad6a1d2c0c0fdb1535be534a88024f07db
SHA256a44a97646b668937cd4db1ca76389d334c47a540665a4eb7f3bdd3bc39b7a20b
SHA51251e4ca5802b12b1952e0345242072f8f4f7a0906819a158dc8e122fa377f225dd2901290a365c7fe694c5090a83cbd637579b70deb8352ea6e315536f92b2bfe
-
Filesize
555KB
MD54d06242dffd17d9b50895a3606b0e65e
SHA1d936d2d92c3336b60f4ecdac17db98c9776f59b2
SHA256cb4f9687fd8aaa09dc3ee140754b158fa9b2440364a16135cf4bf5b1e6dcb098
SHA512a5606162429681431022019e8980f8d514bc813444192f03faba6c1957dab3110b6c56c746094b70331c945013d477c645cd52a0b6de720183eb33be36447555