Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
36s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
01/01/2024, 15:14
Static task
static1
Behavioral task
behavioral1
Sample
3d2fd5d2f5f40ded6f7862e292c4f0b7.exe
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral2
Sample
3d2fd5d2f5f40ded6f7862e292c4f0b7.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
General
-
Target
3d2fd5d2f5f40ded6f7862e292c4f0b7.exe
-
Size
183KB
-
MD5
3d2fd5d2f5f40ded6f7862e292c4f0b7
-
SHA1
b0f49e9f767f9ab49858274c25adbba8d5cd0631
-
SHA256
394dea564eda85365e036a7bdea5b955791088b6ef83e21a34ba5eb8bb0efef7
-
SHA512
92bd27b0b90b55dc365bd76db1c721e45010c38f070211fa140d05330d22c6fe444df580fa336d3aa9fca5426de241b2832ca9c83d0e14572fde1fc3fee6fbe7
-
SSDEEP
3072:hhHE7rc7bPIaHHqAfRtk969a+b8Pn33oDCjNozgCDNlcUtpxXPpIrCNSqSF/:rHE7KIeqA5m89heoDGNozZRlLtptKrOE
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 920 services.exe -
Loads dropped DLL 1 IoCs
pid Process 920 services.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\360.dll 3d2fd5d2f5f40ded6f7862e292c4f0b7.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\WINDOWS\services.exe 3d2fd5d2f5f40ded6f7862e292c4f0b7.exe File opened for modification C:\WINDOWS\services.exe 3d2fd5d2f5f40ded6f7862e292c4f0b7.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.\Shell services.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.\Shell\open services.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.\Shell\open\command services.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.\Shell\open\command\ = "C:\\WINDOWS\\services.exe 360,bmp" services.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\. services.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4600 3d2fd5d2f5f40ded6f7862e292c4f0b7.exe 4600 3d2fd5d2f5f40ded6f7862e292c4f0b7.exe 920 services.exe 920 services.exe 920 services.exe 920 services.exe 920 services.exe 920 services.exe 920 services.exe 920 services.exe 920 services.exe 920 services.exe 920 services.exe 920 services.exe 920 services.exe 920 services.exe 920 services.exe 920 services.exe 920 services.exe 920 services.exe 920 services.exe 920 services.exe 920 services.exe 920 services.exe 920 services.exe 920 services.exe 920 services.exe 920 services.exe 920 services.exe 920 services.exe 920 services.exe 920 services.exe 920 services.exe 920 services.exe 920 services.exe 920 services.exe 920 services.exe 920 services.exe 920 services.exe 920 services.exe 920 services.exe 920 services.exe 920 services.exe 920 services.exe 920 services.exe 920 services.exe 920 services.exe 920 services.exe 920 services.exe 920 services.exe 920 services.exe 920 services.exe 920 services.exe 920 services.exe 920 services.exe 920 services.exe 920 services.exe 920 services.exe 920 services.exe 920 services.exe 920 services.exe 920 services.exe 920 services.exe 920 services.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4600 wrote to memory of 920 4600 3d2fd5d2f5f40ded6f7862e292c4f0b7.exe 79 PID 4600 wrote to memory of 920 4600 3d2fd5d2f5f40ded6f7862e292c4f0b7.exe 79 PID 4600 wrote to memory of 920 4600 3d2fd5d2f5f40ded6f7862e292c4f0b7.exe 79
Processes
-
C:\Users\Admin\AppData\Local\Temp\3d2fd5d2f5f40ded6f7862e292c4f0b7.exe"C:\Users\Admin\AppData\Local\Temp\3d2fd5d2f5f40ded6f7862e292c4f0b7.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\WINDOWS\services.exeC:\WINDOWS\services.exe 360,bmp2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:920
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
MD53979ea0dcb649de30b5ec2b547793371
SHA17586b68bcece70ec86dfa651b50e413ff19a6aa1
SHA256a3b325e29ec0be2ca75a5ee69d593f861b4b6cf8f4913c2aa622e05cdc4869b1
SHA512a599662d854d3c23f479ac714d3db29b9ff4c80b96a0dd565aaffa2bc5c2df4cfef29d20b9686235820b925f4b8b1529dc26983119205024f775af1b16f2dcce
-
Filesize
60KB
MD5889b99c52a60dd49227c5e485a016679
SHA18fa889e456aa646a4d0a4349977430ce5fa5e2d7
SHA2566cbe0e1f046b13b29bfa26f8b368281d2dda7eb9b718651d5856f22cc3e02910
SHA51208933106eaf338dd119c45cbf1f83e723aff77cc0f8d3fc84e36253b1eb31557a54211d1d5d1cb58958188e32064d451f6c66a24b3963cccd3de07299ab90641