Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
168s -
max time network
177s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2023, 11:51
Static task
static1
Behavioral task
behavioral1
Sample
1796279f87df5f4d66030525b7e8e39c.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
1796279f87df5f4d66030525b7e8e39c.exe
Resource
win10v2004-20231215-en
General
-
Target
1796279f87df5f4d66030525b7e8e39c.exe
-
Size
13.8MB
-
MD5
1796279f87df5f4d66030525b7e8e39c
-
SHA1
a45b65e9060ca0d28fd2875b22b8540067db6832
-
SHA256
00a414b5c275653c18a3cc06ae1d1d9de9e07144f0a6091fa46f51e482a0dae6
-
SHA512
8b381fd38d8a538a408a29c70d2532403e36caadae46bf20b2f1786cbe1942c67ca310a4faab777b5c576062cd2ecf57c4edac5526cbf96a6e6dd413f2950b06
-
SSDEEP
3072:8kAgDr/XSqon0LUwWQ2UHxqms7/7btm52yls2LC5J8ZWwoQSwgeb7hiOiPg0tGif:8khDr/+0LUdbKhsMs268UoSwrb7SpG
Malware Config
Extracted
tofsee
defeatwax.ru
refabyd.info
Signatures
-
Creates new service(s) 1 TTPs
-
Modifies Windows Firewall 1 TTPs 1 IoCs
pid Process 4552 netsh.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\nezolfwl\ImagePath = "C:\\Windows\\SysWOW64\\nezolfwl\\zzwrulcu.exe" svchost.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation 1796279f87df5f4d66030525b7e8e39c.exe -
Deletes itself 1 IoCs
pid Process 4700 svchost.exe -
Executes dropped EXE 1 IoCs
pid Process 4404 zzwrulcu.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4404 set thread context of 4700 4404 zzwrulcu.exe 110 -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 4488 sc.exe 2640 sc.exe 5088 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
pid pid_target Process procid_target 3048 4720 WerFault.exe 90 4140 4404 WerFault.exe 108 -
Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 4720 wrote to memory of 2936 4720 1796279f87df5f4d66030525b7e8e39c.exe 95 PID 4720 wrote to memory of 2936 4720 1796279f87df5f4d66030525b7e8e39c.exe 95 PID 4720 wrote to memory of 2936 4720 1796279f87df5f4d66030525b7e8e39c.exe 95 PID 4720 wrote to memory of 1932 4720 1796279f87df5f4d66030525b7e8e39c.exe 97 PID 4720 wrote to memory of 1932 4720 1796279f87df5f4d66030525b7e8e39c.exe 97 PID 4720 wrote to memory of 1932 4720 1796279f87df5f4d66030525b7e8e39c.exe 97 PID 4720 wrote to memory of 2640 4720 1796279f87df5f4d66030525b7e8e39c.exe 99 PID 4720 wrote to memory of 2640 4720 1796279f87df5f4d66030525b7e8e39c.exe 99 PID 4720 wrote to memory of 2640 4720 1796279f87df5f4d66030525b7e8e39c.exe 99 PID 4720 wrote to memory of 5088 4720 1796279f87df5f4d66030525b7e8e39c.exe 101 PID 4720 wrote to memory of 5088 4720 1796279f87df5f4d66030525b7e8e39c.exe 101 PID 4720 wrote to memory of 5088 4720 1796279f87df5f4d66030525b7e8e39c.exe 101 PID 4720 wrote to memory of 4488 4720 1796279f87df5f4d66030525b7e8e39c.exe 103 PID 4720 wrote to memory of 4488 4720 1796279f87df5f4d66030525b7e8e39c.exe 103 PID 4720 wrote to memory of 4488 4720 1796279f87df5f4d66030525b7e8e39c.exe 103 PID 4720 wrote to memory of 4552 4720 1796279f87df5f4d66030525b7e8e39c.exe 105 PID 4720 wrote to memory of 4552 4720 1796279f87df5f4d66030525b7e8e39c.exe 105 PID 4720 wrote to memory of 4552 4720 1796279f87df5f4d66030525b7e8e39c.exe 105 PID 4404 wrote to memory of 4700 4404 zzwrulcu.exe 110 PID 4404 wrote to memory of 4700 4404 zzwrulcu.exe 110 PID 4404 wrote to memory of 4700 4404 zzwrulcu.exe 110 PID 4404 wrote to memory of 4700 4404 zzwrulcu.exe 110 PID 4404 wrote to memory of 4700 4404 zzwrulcu.exe 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\1796279f87df5f4d66030525b7e8e39c.exe"C:\Users\Admin\AppData\Local\Temp\1796279f87df5f4d66030525b7e8e39c.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\nezolfwl\2⤵PID:2936
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\zzwrulcu.exe" C:\Windows\SysWOW64\nezolfwl\2⤵PID:1932
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create nezolfwl binPath= "C:\Windows\SysWOW64\nezolfwl\zzwrulcu.exe /d\"C:\Users\Admin\AppData\Local\Temp\1796279f87df5f4d66030525b7e8e39c.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
- Launches sc.exe
PID:2640
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description nezolfwl "wifi internet conection"2⤵
- Launches sc.exe
PID:5088
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start nezolfwl2⤵
- Launches sc.exe
PID:4488
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
- Modifies Windows Firewall
PID:4552
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4720 -s 7882⤵
- Program crash
PID:3048
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4720 -ip 47201⤵PID:1636
-
C:\Windows\SysWOW64\nezolfwl\zzwrulcu.exeC:\Windows\SysWOW64\nezolfwl\zzwrulcu.exe /d"C:\Users\Admin\AppData\Local\Temp\1796279f87df5f4d66030525b7e8e39c.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Sets service image path in registry
- Deletes itself
PID:4700
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4404 -s 5242⤵
- Program crash
PID:4140
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4404 -ip 44041⤵PID:752
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10.0MB
MD5a3c8e29623ba0dac25812f64483836ab
SHA11ccf199642f399bc8090c803586b1c2273a1d9f3
SHA2563b94146017099c425daaf5c2e6ee748fe58d41c36f078b72920a0f8d85a642d3
SHA51212bb5f87bb99f64d34fecee90d3f873d0c51b2dd8cb67fc9b0ef7152e1110b367de4d7601dd6bbd485036be05d3f1b10356eb4f3cfe8654654a8c80857078239