Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
175s -
max time network
180s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
31/12/2023, 02:46
Static task
static1
Behavioral task
behavioral1
Sample
250aaba5025b9816102428f38b0dab76.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
250aaba5025b9816102428f38b0dab76.exe
Resource
win10v2004-20231215-en
General
-
Target
250aaba5025b9816102428f38b0dab76.exe
-
Size
4.4MB
-
MD5
250aaba5025b9816102428f38b0dab76
-
SHA1
eafb9b9e6af20b2840bc0114bae97c009b1e78d8
-
SHA256
e8b9f0146845f1ce69381393c7c1493782975ad5aeebd22530d484a966caef0f
-
SHA512
9b67ad2cf91e3918ad2691d8f47a2ce33f420a70d805f39fe63dddd16137eadd6954c81018e4460adf3c6ca0cc2ae0ef336019c2546030c7702a8531929dfd03
-
SSDEEP
6144:FulxgF8z/o87OlzE5TKHpd3y0UKp0iNYL+Mov7:oH8Hpd3uKp0iNYLZov
Malware Config
Signatures
-
Modifies Windows Firewall 1 TTPs 1 IoCs
pid Process 4544 netsh.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicrosoftUpgrade = "C:\\WINDOWS\\inetinfx.exe" 250aaba5025b9816102428f38b0dab76.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\WINDOWS\inetinfx.exe 250aaba5025b9816102428f38b0dab76.exe File created C:\Windows\inidirx.ini 250aaba5025b9816102428f38b0dab76.exe File created C:\WINDOWS\inetinfx.exe 250aaba5025b9816102428f38b0dab76.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4636 250aaba5025b9816102428f38b0dab76.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4636 wrote to memory of 4544 4636 250aaba5025b9816102428f38b0dab76.exe 91 PID 4636 wrote to memory of 4544 4636 250aaba5025b9816102428f38b0dab76.exe 91 PID 4636 wrote to memory of 4544 4636 250aaba5025b9816102428f38b0dab76.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\250aaba5025b9816102428f38b0dab76.exe"C:\Users\Admin\AppData\Local\Temp\250aaba5025b9816102428f38b0dab76.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Windows\SysWOW64\netsh.exenetsh firewall set opmode mode=disable2⤵
- Modifies Windows Firewall
PID:4544
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1