Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
156s -
max time network
165s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2023, 05:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0ffbcee06e2f5040d464bcff95cd4d60.exe
Resource
win7-20231215-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
0ffbcee06e2f5040d464bcff95cd4d60.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
0ffbcee06e2f5040d464bcff95cd4d60.exe
-
Size
2.3MB
-
MD5
0ffbcee06e2f5040d464bcff95cd4d60
-
SHA1
ae3c65c54c602255359ba660a83545bcd94bda7a
-
SHA256
f9934e8e4104400baacd0b31891c3df7557a3283a443804c3cf6c43d3e378510
-
SHA512
631b9d251ed9477683e3406083cbe1fc27e0597f00788b7a127d2192bc727ca8b9cf5bc63ce6f6694710d7a7b254ce6fcb9b729e33472a62644e8c433be705ff
-
SSDEEP
49152:kuzFZ/0rAkC2Ct4BUZ3xu+JOkCw+VGtdrHJeKvgy:k+FerZC2CpZ3xu+BQSdjvz
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 1548 svchost.exe 5056 0ffbcee06e2f5040d464bcff95cd4d60.exe 3432 svchost.exe -
resource yara_rule behavioral2/files/0x0006000000023136-8.dat upx behavioral2/memory/5056-9-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/5056-14-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/5056-16-0x0000000000400000-0x000000000041E000-memory.dmp upx -
Drops file in Program Files directory 52 IoCs
description ioc Process File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe svchost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe svchost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe svchost.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE svchost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe svchost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe svchost.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe svchost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe svchost.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe svchost.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe svchost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe svchost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe svchost.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe svchost.exe File opened for modification C:\Program Files\dotnet\dotnet.exe svchost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe svchost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe svchost.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe svchost.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe svchost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe svchost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe svchost.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\createdump.exe svchost.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe svchost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe svchost.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe svchost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe svchost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe svchost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe svchost.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\createdump.exe svchost.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe svchost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe svchost.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe svchost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe svchost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe svchost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe svchost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe svchost.exe File opened for modification C:\Program Files\7-Zip\7z.exe svchost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe svchost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe svchost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe svchost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe svchost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe svchost.exe File opened for modification C:\Program Files\SyncConvertFrom.exe svchost.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe svchost.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE svchost.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe svchost.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe svchost.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe svchost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe svchost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe svchost.exe File opened for modification C:\Program Files\7-Zip\7zG.exe svchost.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe svchost.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe svchost.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\svchost.exe 0ffbcee06e2f5040d464bcff95cd4d60.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3576 wrote to memory of 1548 3576 0ffbcee06e2f5040d464bcff95cd4d60.exe 89 PID 3576 wrote to memory of 1548 3576 0ffbcee06e2f5040d464bcff95cd4d60.exe 89 PID 3576 wrote to memory of 1548 3576 0ffbcee06e2f5040d464bcff95cd4d60.exe 89 PID 1548 wrote to memory of 5056 1548 svchost.exe 90 PID 1548 wrote to memory of 5056 1548 svchost.exe 90 PID 1548 wrote to memory of 5056 1548 svchost.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\0ffbcee06e2f5040d464bcff95cd4d60.exe"C:\Users\Admin\AppData\Local\Temp\0ffbcee06e2f5040d464bcff95cd4d60.exe"1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3576 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe" "C:\Users\Admin\AppData\Local\Temp\0ffbcee06e2f5040d464bcff95cd4d60.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\0ffbcee06e2f5040d464bcff95cd4d60.exe"C:\Users\Admin\AppData\Local\Temp\0ffbcee06e2f5040d464bcff95cd4d60.exe"3⤵
- Executes dropped EXE
PID:5056
-
-
-
C:\Windows\svchost.exeC:\Windows\svchost.exe1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3432
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.3MB
MD5d72bd058af4225304c130ccc30472c67
SHA1654c3846145b4f4409e35f292bd883ef69730a58
SHA256bd1edcda1022456ab38c50e30104dc7ec744902048c80cbff317975eb54c48a2
SHA5127478491a03f561577e949bfb15d63dc6e918598cd277881dac0688717dbc4672f0732cf7f2348d9f9d4976fdd1a563d9727c3d99c74f8a263e72923e965b47a9
-
Filesize
35KB
MD59e3c13b6556d5636b745d3e466d47467
SHA12ac1c19e268c49bc508f83fe3d20f495deb3e538
SHA25620af03add533a6870d524a7c4753b42bfceb56cddd46016c051e23581ba743f8
SHA5125a07ba8a7fcb15f64b129fada2621252b8bc37eb34d4f614c075c064f8ac0d367301eba0c32c5e28b8aa633f6ab604f0dfcc363b34734ce0207ef0d4e8817c4b