Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
153s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
31/12/2023, 02:45
Static task
static1
Behavioral task
behavioral1
Sample
24fff70f83197065cfd011efcb18c471.exe
Resource
win7-20231215-en
General
-
Target
24fff70f83197065cfd011efcb18c471.exe
-
Size
3.3MB
-
MD5
24fff70f83197065cfd011efcb18c471
-
SHA1
aa7b959d9e71455c062c4d1c1d2069706c878e8a
-
SHA256
8644b5a1ecf282da0e8ad4ff465e7026c26f6d3266f56e71b53e7ea776b03e7f
-
SHA512
e39326653006966e3c5e274aa56d65cc3fc18ee6cd3f7e60083548f16b8ea9cea3809a925484d5615971f9c69f94e99b4c84176683446304c103a5ecc8a95109
-
SSDEEP
98304:7RS6nfSOQZOt+CW+7EELhF3gxpNOf2k2Y/l:7kj8NBFwxpNOuk2w
Malware Config
Signatures
-
Stops running service(s) 3 TTPs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Control Panel\International\Geo\Nation 24fff70f83197065cfd011efcb18c471.exe -
Deletes itself 1 IoCs
pid Process 4080 b7MKxrvS51kC3lh.exe -
Executes dropped EXE 1 IoCs
pid Process 4080 b7MKxrvS51kC3lh.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 1244 sc.exe 5032 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4944 24fff70f83197065cfd011efcb18c471.exe 4080 b7MKxrvS51kC3lh.exe 4080 b7MKxrvS51kC3lh.exe 4080 b7MKxrvS51kC3lh.exe 4080 b7MKxrvS51kC3lh.exe 4080 b7MKxrvS51kC3lh.exe 4080 b7MKxrvS51kC3lh.exe 4080 b7MKxrvS51kC3lh.exe 4080 b7MKxrvS51kC3lh.exe 4080 b7MKxrvS51kC3lh.exe 4080 b7MKxrvS51kC3lh.exe 4080 b7MKxrvS51kC3lh.exe 4080 b7MKxrvS51kC3lh.exe 4080 b7MKxrvS51kC3lh.exe 4080 b7MKxrvS51kC3lh.exe 4080 b7MKxrvS51kC3lh.exe 4080 b7MKxrvS51kC3lh.exe 4080 b7MKxrvS51kC3lh.exe 4080 b7MKxrvS51kC3lh.exe 4080 b7MKxrvS51kC3lh.exe 4080 b7MKxrvS51kC3lh.exe 4080 b7MKxrvS51kC3lh.exe 4080 b7MKxrvS51kC3lh.exe 4080 b7MKxrvS51kC3lh.exe 4080 b7MKxrvS51kC3lh.exe 4080 b7MKxrvS51kC3lh.exe 4080 b7MKxrvS51kC3lh.exe 4080 b7MKxrvS51kC3lh.exe 4080 b7MKxrvS51kC3lh.exe 4080 b7MKxrvS51kC3lh.exe 4080 b7MKxrvS51kC3lh.exe 4080 b7MKxrvS51kC3lh.exe 4080 b7MKxrvS51kC3lh.exe 4080 b7MKxrvS51kC3lh.exe 4080 b7MKxrvS51kC3lh.exe 4080 b7MKxrvS51kC3lh.exe 4080 b7MKxrvS51kC3lh.exe 4080 b7MKxrvS51kC3lh.exe 4080 b7MKxrvS51kC3lh.exe 4080 b7MKxrvS51kC3lh.exe 4080 b7MKxrvS51kC3lh.exe 4080 b7MKxrvS51kC3lh.exe 4080 b7MKxrvS51kC3lh.exe 4080 b7MKxrvS51kC3lh.exe 4080 b7MKxrvS51kC3lh.exe 4080 b7MKxrvS51kC3lh.exe 4080 b7MKxrvS51kC3lh.exe 4080 b7MKxrvS51kC3lh.exe 4080 b7MKxrvS51kC3lh.exe 4080 b7MKxrvS51kC3lh.exe 4080 b7MKxrvS51kC3lh.exe 4080 b7MKxrvS51kC3lh.exe 4080 b7MKxrvS51kC3lh.exe 4080 b7MKxrvS51kC3lh.exe 4080 b7MKxrvS51kC3lh.exe 4080 b7MKxrvS51kC3lh.exe 4080 b7MKxrvS51kC3lh.exe 4080 b7MKxrvS51kC3lh.exe 4080 b7MKxrvS51kC3lh.exe 4080 b7MKxrvS51kC3lh.exe 4080 b7MKxrvS51kC3lh.exe 4080 b7MKxrvS51kC3lh.exe 4080 b7MKxrvS51kC3lh.exe 4080 b7MKxrvS51kC3lh.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4944 24fff70f83197065cfd011efcb18c471.exe Token: SeDebugPrivilege 4080 b7MKxrvS51kC3lh.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4944 wrote to memory of 4080 4944 24fff70f83197065cfd011efcb18c471.exe 97 PID 4944 wrote to memory of 4080 4944 24fff70f83197065cfd011efcb18c471.exe 97 PID 4080 wrote to memory of 4652 4080 b7MKxrvS51kC3lh.exe 101 PID 4080 wrote to memory of 4652 4080 b7MKxrvS51kC3lh.exe 101 PID 4652 wrote to memory of 1244 4652 cmd.exe 103 PID 4652 wrote to memory of 1244 4652 cmd.exe 103 PID 4652 wrote to memory of 5032 4652 cmd.exe 104 PID 4652 wrote to memory of 5032 4652 cmd.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\24fff70f83197065cfd011efcb18c471.exe"C:\Users\Admin\AppData\Local\Temp\24fff70f83197065cfd011efcb18c471.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Users\Admin\AppData\Local\Temp\b7MKxrvS51kC3lh.exe"C:\Users\Admin\AppData\Local\Temp\b7MKxrvS51kC3lh.exe" QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxUZW1wXDI0ZmZmNzBmODMxOTcwNjVjZmQwMTFlZmNiMThjNDcxLmV4ZQ==2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4080 -
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C sc stop "SysMain" & sc config "SysMain" start=disabled3⤵
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Windows\system32\sc.exesc stop "SysMain"4⤵
- Launches sc.exe
PID:1244
-
-
C:\Windows\system32\sc.exesc config "SysMain" start=disabled4⤵
- Launches sc.exe
PID:5032
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.3MB
MD533babed188e22c2a1489333fae97d0b2
SHA100081383fc7b8aeb6d60c08f3aba4225c1e23c5c
SHA256caa58c5c9274cacb21ceaf371efdfb382c6939db3a21015456294f2d85864b48
SHA512a744cbc2bb3d7b6a5c36ec2c7cda43d3449579e6a52edcf4d07bd4c2c0715780bcea95dc63d89773678b2fc956671811074f4e273ea44e87cf218fbdb0eb8336
-
Filesize
3.2MB
MD5658c2159b0f24991968ebdab8a5b9831
SHA195b3e16f30d8d75046017b4ab37d28316458f8ea
SHA2560eab0e40994bf0a6347a1e2653cbc28fca7817d3352e42a08dc5c58db25dbe74
SHA512c9742bd071bc505418d3b2335cf10ae62b24a9c59a2e75576286dfb66c4a2170a67839c8208c3d6db527452f0dcf615e109045758dd4152eccef6ef997d664a8