Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2023, 04:09
Static task
static1
Behavioral task
behavioral1
Sample
0df60ecef7b4f3526fe7b427dcc46836.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
0df60ecef7b4f3526fe7b427dcc46836.exe
Resource
win10v2004-20231215-en
General
-
Target
0df60ecef7b4f3526fe7b427dcc46836.exe
-
Size
38KB
-
MD5
0df60ecef7b4f3526fe7b427dcc46836
-
SHA1
9fb401eb29264599c77d7903716c2c5a3bd89cd7
-
SHA256
e584a51d924f18f443c677e92c0c75f7c701ad1d2d0a79b2c4d35b3c25b469b2
-
SHA512
78f666d879a4eea8af8caa6455808af3fff29bf1e197e316c8ac898f403293263f7993aef22a549e6f192f29ad30b2a9cd69e0c87cb43b04397b1d4edb17894c
-
SSDEEP
768:EoGBwgQ9xh7miRJsKue84EZ43eX/rUI/w9bbVAAtFPoIlan86:EoGBwgc7miL85ZGWQIohZAAfm86
Malware Config
Signatures
-
Unexpected DNS network traffic destination 5 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 178.162.181.106 Destination IP 178.162.181.106 Destination IP 178.162.181.106 Destination IP 178.162.181.106 Destination IP 178.162.181.106 -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2940 set thread context of 4712 2940 0df60ecef7b4f3526fe7b427dcc46836.exe 91 -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Fonts\YG18C3lr.exe 0df60ecef7b4f3526fe7b427dcc46836.exe File opened for modification C:\Windows\Fonts\YG18C3lr.exe 0df60ecef7b4f3526fe7b427dcc46836.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings 0df60ecef7b4f3526fe7b427dcc46836.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4712 0df60ecef7b4f3526fe7b427dcc46836.exe 4712 0df60ecef7b4f3526fe7b427dcc46836.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2940 wrote to memory of 4712 2940 0df60ecef7b4f3526fe7b427dcc46836.exe 91 PID 2940 wrote to memory of 4712 2940 0df60ecef7b4f3526fe7b427dcc46836.exe 91 PID 2940 wrote to memory of 4712 2940 0df60ecef7b4f3526fe7b427dcc46836.exe 91 PID 2940 wrote to memory of 4712 2940 0df60ecef7b4f3526fe7b427dcc46836.exe 91 PID 2940 wrote to memory of 4712 2940 0df60ecef7b4f3526fe7b427dcc46836.exe 91 PID 2940 wrote to memory of 4712 2940 0df60ecef7b4f3526fe7b427dcc46836.exe 91 PID 2940 wrote to memory of 4712 2940 0df60ecef7b4f3526fe7b427dcc46836.exe 91 PID 2940 wrote to memory of 4712 2940 0df60ecef7b4f3526fe7b427dcc46836.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\0df60ecef7b4f3526fe7b427dcc46836.exe"C:\Users\Admin\AppData\Local\Temp\0df60ecef7b4f3526fe7b427dcc46836.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\0df60ecef7b4f3526fe7b427dcc46836.exeC:\Users\Admin\AppData\Local\Temp\0df60ecef7b4f3526fe7b427dcc46836.exe2⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4712
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2300