Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
1s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
06/01/2024, 15:56
Static task
static1
Behavioral task
behavioral1
Sample
469f9680ca8fbec39203a01487f8407f.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
469f9680ca8fbec39203a01487f8407f.exe
Resource
win10v2004-20231222-en
General
-
Target
469f9680ca8fbec39203a01487f8407f.exe
-
Size
198KB
-
MD5
469f9680ca8fbec39203a01487f8407f
-
SHA1
fac1daf36a48d42174f79beefa26f4cc6afa0e74
-
SHA256
22751aa69266bf620afcc2ff8fb3e4a75d089093f8788c3f26d2c1d130ab85e2
-
SHA512
ad81f844cb653bd3c6ec9b1a56f4a77d5e735606af25cec013ca132214434eca8a67a03d2c7fc284298e57f0264f8700210ef55bf1ad1067296162b4b176f8ec
-
SSDEEP
3072:/cT9g8immW6Pozkk2eKs/CSr2nQ/E2S5ny+bF2u1I+ddDK7Hlq/g8NkgnYQ:o68i3odBiTl2+TCU/Bk8N
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft I Service = "C:\\Windows\\winhash_up.exe /REGstart" 469f9680ca8fbec39203a01487f8407f.exe -
Drops file in Windows directory 12 IoCs
description ioc Process File created C:\Windows\SHARE_TEMP\Icon2.ico 469f9680ca8fbec39203a01487f8407f.exe File created C:\Windows\SHARE_TEMP\Icon7.ico 469f9680ca8fbec39203a01487f8407f.exe File created C:\Windows\SHARE_TEMP\Icon10.ico 469f9680ca8fbec39203a01487f8407f.exe File created C:\Windows\SHARE_TEMP\Icon12.ico 469f9680ca8fbec39203a01487f8407f.exe File created C:\Windows\winhash_up.exe 469f9680ca8fbec39203a01487f8407f.exe File opened for modification C:\Windows\winhash_up.exez 469f9680ca8fbec39203a01487f8407f.exe File created C:\Windows\SHARE_TEMP\Icon3.ico 469f9680ca8fbec39203a01487f8407f.exe File created C:\Windows\SHARE_TEMP\Icon5.ico 469f9680ca8fbec39203a01487f8407f.exe File created C:\Windows\SHARE_TEMP\Icon6.ico 469f9680ca8fbec39203a01487f8407f.exe File created C:\Windows\SHARE_TEMP\Icon14.ico 469f9680ca8fbec39203a01487f8407f.exe File created C:\Windows\bugMAKER.bat 469f9680ca8fbec39203a01487f8407f.exe File created C:\Windows\winhash_up.exez 469f9680ca8fbec39203a01487f8407f.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4048 wrote to memory of 5052 4048 469f9680ca8fbec39203a01487f8407f.exe 28 PID 4048 wrote to memory of 5052 4048 469f9680ca8fbec39203a01487f8407f.exe 28 PID 4048 wrote to memory of 5052 4048 469f9680ca8fbec39203a01487f8407f.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\469f9680ca8fbec39203a01487f8407f.exe"C:\Users\Admin\AppData\Local\Temp\469f9680ca8fbec39203a01487f8407f.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4048 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\bugMAKER.bat2⤵PID:5052
-