Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2023, 14:08
Behavioral task
behavioral1
Sample
1b03c438d9166a149a8d89d162de55ac.exe
Resource
win7-20231129-en
General
-
Target
1b03c438d9166a149a8d89d162de55ac.exe
-
Size
98KB
-
MD5
1b03c438d9166a149a8d89d162de55ac
-
SHA1
a95fcb133889bcacef05e9e8543c72a02d988d8a
-
SHA256
fc45b978ed9187c95982fba06da72c4477c514e95b69a17bd9b6cc2974dc789f
-
SHA512
bb5b0be6355af4fd81fac6b5219ac21a01a65967432f4a509904c927f10c68daa1ff622b524893abc9f1d385e9cf63ae366e01429193c847a62d6c0f4db874d1
-
SSDEEP
1536:V0iGPMjfdGc6wl8bFhuqit6GjJpwCqbbk4B7qZYnouy8BFvJ3/FK1SIz:RGkjlgwapuYCqPk4B7qZQout/G
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/2592-0-0x0000000000400000-0x0000000000523000-memory.dmp upx behavioral2/memory/2592-9-0x0000000000400000-0x0000000000523000-memory.dmp upx -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\R: 1b03c438d9166a149a8d89d162de55ac.exe File opened (read-only) \??\A: 1b03c438d9166a149a8d89d162de55ac.exe File opened (read-only) \??\E: 1b03c438d9166a149a8d89d162de55ac.exe File opened (read-only) \??\G: 1b03c438d9166a149a8d89d162de55ac.exe File opened (read-only) \??\M: 1b03c438d9166a149a8d89d162de55ac.exe File opened (read-only) \??\N: 1b03c438d9166a149a8d89d162de55ac.exe File opened (read-only) \??\P: 1b03c438d9166a149a8d89d162de55ac.exe File opened (read-only) \??\Q: 1b03c438d9166a149a8d89d162de55ac.exe File opened (read-only) \??\V: 1b03c438d9166a149a8d89d162de55ac.exe File opened (read-only) \??\Y: 1b03c438d9166a149a8d89d162de55ac.exe File opened (read-only) \??\H: 1b03c438d9166a149a8d89d162de55ac.exe File opened (read-only) \??\J: 1b03c438d9166a149a8d89d162de55ac.exe File opened (read-only) \??\L: 1b03c438d9166a149a8d89d162de55ac.exe File opened (read-only) \??\I: 1b03c438d9166a149a8d89d162de55ac.exe File opened (read-only) \??\K: 1b03c438d9166a149a8d89d162de55ac.exe File opened (read-only) \??\O: 1b03c438d9166a149a8d89d162de55ac.exe File opened (read-only) \??\W: 1b03c438d9166a149a8d89d162de55ac.exe File opened (read-only) \??\X: 1b03c438d9166a149a8d89d162de55ac.exe File opened (read-only) \??\B: 1b03c438d9166a149a8d89d162de55ac.exe File opened (read-only) \??\S: 1b03c438d9166a149a8d89d162de55ac.exe File opened (read-only) \??\T: 1b03c438d9166a149a8d89d162de55ac.exe File opened (read-only) \??\U: 1b03c438d9166a149a8d89d162de55ac.exe File opened (read-only) \??\Z: 1b03c438d9166a149a8d89d162de55ac.exe -
Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 1b03c438d9166a149a8d89d162de55ac.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName 1b03c438d9166a149a8d89d162de55ac.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 1b03c438d9166a149a8d89d162de55ac.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName 1b03c438d9166a149a8d89d162de55ac.exe -
Suspicious behavior: EnumeratesProcesses 16 IoCs
pid Process 2592 1b03c438d9166a149a8d89d162de55ac.exe 2592 1b03c438d9166a149a8d89d162de55ac.exe 2592 1b03c438d9166a149a8d89d162de55ac.exe 2592 1b03c438d9166a149a8d89d162de55ac.exe 2592 1b03c438d9166a149a8d89d162de55ac.exe 2592 1b03c438d9166a149a8d89d162de55ac.exe 2592 1b03c438d9166a149a8d89d162de55ac.exe 2592 1b03c438d9166a149a8d89d162de55ac.exe 2592 1b03c438d9166a149a8d89d162de55ac.exe 2592 1b03c438d9166a149a8d89d162de55ac.exe 2592 1b03c438d9166a149a8d89d162de55ac.exe 2592 1b03c438d9166a149a8d89d162de55ac.exe 2592 1b03c438d9166a149a8d89d162de55ac.exe 2592 1b03c438d9166a149a8d89d162de55ac.exe 2592 1b03c438d9166a149a8d89d162de55ac.exe 2592 1b03c438d9166a149a8d89d162de55ac.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2592 wrote to memory of 4908 2592 1b03c438d9166a149a8d89d162de55ac.exe 96 PID 2592 wrote to memory of 4908 2592 1b03c438d9166a149a8d89d162de55ac.exe 96 PID 2592 wrote to memory of 4908 2592 1b03c438d9166a149a8d89d162de55ac.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\1b03c438d9166a149a8d89d162de55ac.exe"C:\Users\Admin\AppData\Local\Temp\1b03c438d9166a149a8d89d162de55ac.exe"1⤵
- Enumerates connected drives
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Windows\SysWOW64\cmd.execmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\\uninste576aa1.bat" "C:\Users\Admin\AppData\Local\Temp\1b03c438d9166a149a8d89d162de55ac.exe""2⤵PID:4908
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
59B
MD52988b921fbed03f9c93c5d538932bbe3
SHA14b791b3d59ae76ff091c2cf201b40f5d1b432a3f
SHA256a1769979622d3d25829be12474ad32ccfdfcac59785dac2fc10ae49c300e4ea3
SHA5122920c6e9851973371dc238da1ee3c63d41c7820637856ee92c67e9489c1790e3fad287d229440d124e60b978f6819d04b47c40de9034cbd9de422aaafc2b07f9