Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2023, 10:44
Static task
static1
Behavioral task
behavioral1
Sample
164d6a636417f34658a3cff67ad526f3.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
164d6a636417f34658a3cff67ad526f3.exe
Resource
win10v2004-20231215-en
General
-
Target
164d6a636417f34658a3cff67ad526f3.exe
-
Size
1.1MB
-
MD5
164d6a636417f34658a3cff67ad526f3
-
SHA1
60f906ca657cac46b34d903ffd0127c42130c42c
-
SHA256
1c760857e861e7a69e3a01cdc1bd3cd5fe8d4de8b5027025a59888ae713b71bf
-
SHA512
d3298fd9ce701214ff450590ad9a131dcb699025394c2e0769958151e9be77395bf0d68b2451a32041e75b83eedc54d8aa84dfab123577fa9c6d82bf011946eb
-
SSDEEP
24576:Dr2fMLQ6gSy8Q7BiNL+VElHA1dHdQ0aKMrzws1Ztf3vw:v2EUOQdiNiElHAbdoKUwsVf3vw
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Control Panel\International\Geo\Nation 164d6a636417f34658a3cff67ad526f3.exe -
Executes dropped EXE 2 IoCs
pid Process 4356 starter.exe 1996 ArcadeYum.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ArcadeYum.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier ArcadeYum.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ArcadeYum.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS ArcadeYum.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct ArcadeYum.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 3500 164d6a636417f34658a3cff67ad526f3.exe 3500 164d6a636417f34658a3cff67ad526f3.exe 1996 ArcadeYum.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1996 ArcadeYum.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1996 ArcadeYum.exe 1996 ArcadeYum.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3500 wrote to memory of 4356 3500 164d6a636417f34658a3cff67ad526f3.exe 91 PID 3500 wrote to memory of 4356 3500 164d6a636417f34658a3cff67ad526f3.exe 91 PID 3500 wrote to memory of 4356 3500 164d6a636417f34658a3cff67ad526f3.exe 91 PID 3500 wrote to memory of 1996 3500 164d6a636417f34658a3cff67ad526f3.exe 94 PID 3500 wrote to memory of 1996 3500 164d6a636417f34658a3cff67ad526f3.exe 94 PID 3500 wrote to memory of 1996 3500 164d6a636417f34658a3cff67ad526f3.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\164d6a636417f34658a3cff67ad526f3.exe"C:\Users\Admin\AppData\Local\Temp\164d6a636417f34658a3cff67ad526f3.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\Users\Public\Documents\{8C1A49E6-2F7F-40E3-923F-5DE549CAF021}\starter.exe"C:\Users\Public\Documents\{8C1A49E6-2F7F-40E3-923F-5DE549CAF021}\starter.exe" boAPg04Yheavj8SmXRBU 9622⤵
- Executes dropped EXE
PID:4356
-
-
C:\Users\Public\Documents\{8C1A49E6-2F7F-40E3-923F-5DE549CAF021}\ArcadeYum.exe"C:\Users\Public\Documents\{8C1A49E6-2F7F-40E3-923F-5DE549CAF021}\ArcadeYum.exe" IC9UaWNrZXQ9Ym9BUGcwNFloZWF2ajhTbVhSQlUgL0J1bmRsZXM9MTYzfDE0NXwxMzR8MTYyIC9PYmVyb249MCAvQnJvd3Nlcj0zIC9BZExvYz05NjIgL3RwZD1odHRwOi8vZDEuYXJjYWRleXVtLmNvbS9hai9idW5kbGUvOTYyLz9wPU9UWXdNalE0TURjNU1YamNkenpXbTJHNUlITk9GaHo1TWd3bnpubnp5aHZ6UmRFTFFvbiUyQiUyQjJ6OWZPV00wTiUyRnpCdk00R3g5bXpTcUVVY0JzcG5aMnMlMkI0WiUyQmhZTGNTN1dhWlklM0QgL29wdGltaXplR0M9MCAvdXNlck5hbWU9QWRtaW4gL3VzZXJTSUQ9Uy0xLTUtMjEtMzMzNjMwNDIyMy0yOTc4NzQwNjg4LTM2NDUxOTQ0MTAtMTAwMAo=2⤵
- Executes dropped EXE
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1996
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
92KB
MD5c1ac43638dd3ec0e785e955e9917be10
SHA13f9868afb6ae139ccad5671e57f528cd5a2be366
SHA25663273107837c247ecf34d28e9fcd63c03d192e7b0fd15f26395a23b8f3b00e15
SHA512b4b3871c7d2e569d89bb8f47de49a9b4be35ed7f5137f01108818fc83ecd9e6b9daa78a6aab04e953cf7d29cddbad0623838e52eb346051888794dc3dd7ed440
-
Filesize
883KB
MD51df9cb2785075f2738d8bdb876831731
SHA14a3048ba67f8b2529846e51cd0e7793f63f20ae3
SHA2568459860387ea51a7d83e817f72d46f4eeaade8ec4414c89843676dc29d4496d9
SHA5129209c7aac280b00905432be6d1f592c8fa99b6bbbc112297a0273d761d5c75d90e836bb66823181cf563df645b34e022f755e865f5d07b5588e1688d8476d330
-
Filesize
231B
MD5ae437dea18c61477cc2f17f46fb11d01
SHA194afba8148c6072ad60c6899ed717005681e9da5
SHA256d8966d4c96ba3c910f86c44d6d7b6c298cc70cc3c5c61bb975861eed846b0754
SHA51261ad33f07fbb65863f1eb02a14230c38766fbb5e1fe4263433ecd32375249e7af71e49f054e5f919884f5250dccf95fb6791ceeadf3c2d4cb468ba5af3e8902b
-
Filesize
74B
MD5804c977f832e531755b22cd3ffba4e1a
SHA1837a84db1a9032cd85d35a4e6ae8b8e4b138bc6b
SHA2561391e7376eff4b7a8a01e163c1b36335b9faca356dc1c62c5defaacc2e044c7d
SHA512f244b3854f702a180da17176d4d8d1308a48734229e5ae4a1edd45cbd723b7c5301a9c8318e218b0e8becde38381ad641915a87ad171f9817bc29940e18d2222
-
Filesize
149KB
MD5e82c1804533f9321af31fc44fdc138aa
SHA1ed2dccd7116304d04d075bf91c0f79252bed6aa4
SHA256a0f95644570a23fbc8482756eb85b92c34a77927ee66551cc0db37b8d7e181ee
SHA512994c32676f7a8c14c7121199573db25fd906200c3f1869fb60615db63f60c9b653844ae43ae7e6e77d2dcf725491ad9691a9f6beeddec5fd8c517cf37d874477
-
Filesize
1007KB
MD5a0865a8429851042ede865187a5d6eeb
SHA11a71a4301d305a1cdacfd4c18acd6a057bd4cf44
SHA256ebb4713a230340735681433fc87be0e46ab2db19ef395276a573086e45a631c2
SHA512e20e286ca064ef84ac2f18450894c46d162af00c263b25a19f1d685769e1780a48961faf1397ff819bca2f2880759f7a7e86dc3d5b080b91e8afe164409bda42