Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2023, 12:21
Static task
static1
Behavioral task
behavioral1
Sample
185a2ca1884de3983a525cdd7104daa0.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
185a2ca1884de3983a525cdd7104daa0.exe
Resource
win10v2004-20231222-en
General
-
Target
185a2ca1884de3983a525cdd7104daa0.exe
-
Size
267KB
-
MD5
185a2ca1884de3983a525cdd7104daa0
-
SHA1
131969f13c3e141e660aa219e90a78a07d390151
-
SHA256
c7cc67bd019e049c62342206f2d2a7af46fc58a950d1ff1db958d7c09290b6df
-
SHA512
eaa875e55522050870bb2742ee261f3efbb46448c5d3c8cb63c4ad60748bf17d6fa16e9f841d92a4c78f90c2b9f5bf6dcd7be232c07b7d753cd29c8baadd48e5
-
SSDEEP
6144:KxZaCYILHJne0fIJQsSWUhM8CBesCbYE/o/G+O:K9YILH9yQLBhJCdKzg/G7
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 3356 BlCPliQ5D.exe -
Executes dropped EXE 2 IoCs
pid Process 4336 BlCPliQ5D.exe 3356 BlCPliQ5D.exe -
Loads dropped DLL 4 IoCs
pid Process 2320 185a2ca1884de3983a525cdd7104daa0.exe 2320 185a2ca1884de3983a525cdd7104daa0.exe 3356 BlCPliQ5D.exe 3356 BlCPliQ5D.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\P1qXnHnCpL7nsqi = "C:\\ProgramData\\WUOoTIbrGlRiZ\\BlCPliQ5D.exe" 185a2ca1884de3983a525cdd7104daa0.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 4580 set thread context of 2320 4580 185a2ca1884de3983a525cdd7104daa0.exe 89 PID 4336 set thread context of 3356 4336 BlCPliQ5D.exe 93 PID 3356 set thread context of 1360 3356 BlCPliQ5D.exe 95 -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 4580 wrote to memory of 2320 4580 185a2ca1884de3983a525cdd7104daa0.exe 89 PID 4580 wrote to memory of 2320 4580 185a2ca1884de3983a525cdd7104daa0.exe 89 PID 4580 wrote to memory of 2320 4580 185a2ca1884de3983a525cdd7104daa0.exe 89 PID 4580 wrote to memory of 2320 4580 185a2ca1884de3983a525cdd7104daa0.exe 89 PID 4580 wrote to memory of 2320 4580 185a2ca1884de3983a525cdd7104daa0.exe 89 PID 2320 wrote to memory of 4336 2320 185a2ca1884de3983a525cdd7104daa0.exe 94 PID 2320 wrote to memory of 4336 2320 185a2ca1884de3983a525cdd7104daa0.exe 94 PID 2320 wrote to memory of 4336 2320 185a2ca1884de3983a525cdd7104daa0.exe 94 PID 4336 wrote to memory of 3356 4336 BlCPliQ5D.exe 93 PID 4336 wrote to memory of 3356 4336 BlCPliQ5D.exe 93 PID 4336 wrote to memory of 3356 4336 BlCPliQ5D.exe 93 PID 4336 wrote to memory of 3356 4336 BlCPliQ5D.exe 93 PID 4336 wrote to memory of 3356 4336 BlCPliQ5D.exe 93 PID 3356 wrote to memory of 1360 3356 BlCPliQ5D.exe 95 PID 3356 wrote to memory of 1360 3356 BlCPliQ5D.exe 95 PID 3356 wrote to memory of 1360 3356 BlCPliQ5D.exe 95 PID 3356 wrote to memory of 1360 3356 BlCPliQ5D.exe 95 PID 3356 wrote to memory of 1360 3356 BlCPliQ5D.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\185a2ca1884de3983a525cdd7104daa0.exe"C:\Users\Admin\AppData\Local\Temp\185a2ca1884de3983a525cdd7104daa0.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\Users\Admin\AppData\Local\Temp\185a2ca1884de3983a525cdd7104daa0.exe"C:\Users\Admin\AppData\Local\Temp\185a2ca1884de3983a525cdd7104daa0.exe"2⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\ProgramData\WUOoTIbrGlRiZ\BlCPliQ5D.exe"C:\ProgramData\WUOoTIbrGlRiZ\BlCPliQ5D.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4336
-
-
-
C:\ProgramData\WUOoTIbrGlRiZ\BlCPliQ5D.exe"C:\ProgramData\WUOoTIbrGlRiZ\BlCPliQ5D.exe"1⤵
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3356 -
C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe"C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe" /i:33562⤵PID:1360
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
267KB
MD5185a2ca1884de3983a525cdd7104daa0
SHA1131969f13c3e141e660aa219e90a78a07d390151
SHA256c7cc67bd019e049c62342206f2d2a7af46fc58a950d1ff1db958d7c09290b6df
SHA512eaa875e55522050870bb2742ee261f3efbb46448c5d3c8cb63c4ad60748bf17d6fa16e9f841d92a4c78f90c2b9f5bf6dcd7be232c07b7d753cd29c8baadd48e5
-
Filesize
267KB
MD5010433dde6ba48d2964d6cd30530c04d
SHA19680c2252ecb5fffae1747304206a3db1fa59426
SHA2561117a2d1be29d064eb9b6a96af9489b8f6ca6d5fa0d74dced2505f5593835f68
SHA5125a8c5c3f12871d35f8268655a039d2c52b471bd9e404b4af92597f142e051839240b5364af71dce53a53f67d5d9011c484c31195577fc3f0d7b1bf67efbcaa0e