Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
173s -
max time network
190s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
02/01/2024, 11:52
Behavioral task
behavioral1
Sample
6f40bc1d868ddc2cc3cc0bc6aa3e61115dbd1e0b5e7cdb05d970d73cb2e92c97.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
6f40bc1d868ddc2cc3cc0bc6aa3e61115dbd1e0b5e7cdb05d970d73cb2e92c97.exe
Resource
win10v2004-20231215-en
General
-
Target
6f40bc1d868ddc2cc3cc0bc6aa3e61115dbd1e0b5e7cdb05d970d73cb2e92c97.exe
-
Size
274KB
-
MD5
642636ef75c52a44d3db2f3a947c826a
-
SHA1
1688459a0cf299aa696ea698ba1766ceb4746139
-
SHA256
6f40bc1d868ddc2cc3cc0bc6aa3e61115dbd1e0b5e7cdb05d970d73cb2e92c97
-
SHA512
a7865497b3cb8dc701683e00a35956c737a4398359808281c3071831a90f45e3e249b8c57cbd1084a72c3ac15a00fe2277103595aed28a6e46ee9b051a9cce3a
-
SSDEEP
6144:tbTirrfykiiUjh6QH/cEOkCybEaQRXr9HNdvOa:tPcrfR6ZnOkx2LIa
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/680-0-0x0000000000630000-0x00000000006BC000-memory.dmp upx behavioral2/memory/680-1-0x0000000000630000-0x00000000006BC000-memory.dmp upx behavioral2/memory/680-4-0x0000000000630000-0x00000000006BC000-memory.dmp upx behavioral2/memory/680-5-0x0000000000630000-0x00000000006BC000-memory.dmp upx behavioral2/memory/680-10-0x0000000000630000-0x00000000006BC000-memory.dmp upx behavioral2/memory/680-18-0x0000000000630000-0x00000000006BC000-memory.dmp upx behavioral2/memory/680-22-0x0000000000630000-0x00000000006BC000-memory.dmp upx behavioral2/memory/680-26-0x0000000000630000-0x00000000006BC000-memory.dmp upx behavioral2/memory/680-33-0x0000000000630000-0x00000000006BC000-memory.dmp upx behavioral2/memory/680-34-0x0000000000630000-0x00000000006BC000-memory.dmp upx -
Unexpected DNS network traffic destination 6 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 114.114.114.114 Destination IP 114.114.114.114 Destination IP 114.114.114.114 Destination IP 223.5.5.5 Destination IP 114.114.114.114 Destination IP 223.5.5.5 -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\err_680.log 6f40bc1d868ddc2cc3cc0bc6aa3e61115dbd1e0b5e7cdb05d970d73cb2e92c97.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 680 6f40bc1d868ddc2cc3cc0bc6aa3e61115dbd1e0b5e7cdb05d970d73cb2e92c97.exe 680 6f40bc1d868ddc2cc3cc0bc6aa3e61115dbd1e0b5e7cdb05d970d73cb2e92c97.exe 680 6f40bc1d868ddc2cc3cc0bc6aa3e61115dbd1e0b5e7cdb05d970d73cb2e92c97.exe 680 6f40bc1d868ddc2cc3cc0bc6aa3e61115dbd1e0b5e7cdb05d970d73cb2e92c97.exe 680 6f40bc1d868ddc2cc3cc0bc6aa3e61115dbd1e0b5e7cdb05d970d73cb2e92c97.exe 680 6f40bc1d868ddc2cc3cc0bc6aa3e61115dbd1e0b5e7cdb05d970d73cb2e92c97.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 680 6f40bc1d868ddc2cc3cc0bc6aa3e61115dbd1e0b5e7cdb05d970d73cb2e92c97.exe Token: SeTcbPrivilege 680 6f40bc1d868ddc2cc3cc0bc6aa3e61115dbd1e0b5e7cdb05d970d73cb2e92c97.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6f40bc1d868ddc2cc3cc0bc6aa3e61115dbd1e0b5e7cdb05d970d73cb2e92c97.exe"C:\Users\Admin\AppData\Local\Temp\6f40bc1d868ddc2cc3cc0bc6aa3e61115dbd1e0b5e7cdb05d970d73cb2e92c97.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:680