Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
07/01/2024, 19:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a49924a6a0cfc4f55e5ddd505ce26aa1.exe
Resource
win7-20231215-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
a49924a6a0cfc4f55e5ddd505ce26aa1.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
a49924a6a0cfc4f55e5ddd505ce26aa1.exe
-
Size
268KB
-
MD5
a49924a6a0cfc4f55e5ddd505ce26aa1
-
SHA1
c9369e50820fdbf534849e7d6bae42b46286e0cd
-
SHA256
32b25aa41ee05167c9c5f842ee118722f9f562008f5619d88da3a8592021ae6e
-
SHA512
16b3eb880c8eaac013ab32de8a8c488b4e8d17346902dd24c0cf58e4aea391f036996934a661ab6990f9ca868fdd77f17dafbf28ea4eae93fef69236e75aabd8
-
SSDEEP
3072:NE4raqnywSksPUTVY7fhINP7JbfLBsyVEJ8Ixjtmkp44upWuTNgX8Tjee/L1pvQu:qMmsgfuNPp5VEVtmk4DAuTxeOx
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" a49924a6a0cfc4f55e5ddd505ce26aa1.exe Set value (int) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" tssib.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Control Panel\International\Geo\Nation a49924a6a0cfc4f55e5ddd505ce26aa1.exe -
Executes dropped EXE 1 IoCs
pid Process 1292 tssib.exe -
Adds Run key to start application 2 TTPs 27 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tssib = "C:\\Users\\Admin\\tssib.exe /w" tssib.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tssib = "C:\\Users\\Admin\\tssib.exe /v" tssib.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tssib = "C:\\Users\\Admin\\tssib.exe /y" tssib.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tssib = "C:\\Users\\Admin\\tssib.exe /x" tssib.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tssib = "C:\\Users\\Admin\\tssib.exe /k" tssib.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tssib = "C:\\Users\\Admin\\tssib.exe /a" tssib.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tssib = "C:\\Users\\Admin\\tssib.exe /c" tssib.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tssib = "C:\\Users\\Admin\\tssib.exe /n" tssib.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tssib = "C:\\Users\\Admin\\tssib.exe /j" tssib.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tssib = "C:\\Users\\Admin\\tssib.exe /h" tssib.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tssib = "C:\\Users\\Admin\\tssib.exe /f" tssib.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tssib = "C:\\Users\\Admin\\tssib.exe /i" tssib.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tssib = "C:\\Users\\Admin\\tssib.exe /t" tssib.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tssib = "C:\\Users\\Admin\\tssib.exe /g" tssib.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tssib = "C:\\Users\\Admin\\tssib.exe /r" tssib.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tssib = "C:\\Users\\Admin\\tssib.exe /d" tssib.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tssib = "C:\\Users\\Admin\\tssib.exe /b" tssib.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tssib = "C:\\Users\\Admin\\tssib.exe /l" tssib.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tssib = "C:\\Users\\Admin\\tssib.exe /o" tssib.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tssib = "C:\\Users\\Admin\\tssib.exe /p" tssib.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tssib = "C:\\Users\\Admin\\tssib.exe /x" a49924a6a0cfc4f55e5ddd505ce26aa1.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tssib = "C:\\Users\\Admin\\tssib.exe /u" tssib.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tssib = "C:\\Users\\Admin\\tssib.exe /q" tssib.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tssib = "C:\\Users\\Admin\\tssib.exe /z" tssib.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tssib = "C:\\Users\\Admin\\tssib.exe /s" tssib.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tssib = "C:\\Users\\Admin\\tssib.exe /m" tssib.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tssib = "C:\\Users\\Admin\\tssib.exe /e" tssib.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3632 a49924a6a0cfc4f55e5ddd505ce26aa1.exe 3632 a49924a6a0cfc4f55e5ddd505ce26aa1.exe 1292 tssib.exe 1292 tssib.exe 1292 tssib.exe 1292 tssib.exe 1292 tssib.exe 1292 tssib.exe 1292 tssib.exe 1292 tssib.exe 1292 tssib.exe 1292 tssib.exe 1292 tssib.exe 1292 tssib.exe 1292 tssib.exe 1292 tssib.exe 1292 tssib.exe 1292 tssib.exe 1292 tssib.exe 1292 tssib.exe 1292 tssib.exe 1292 tssib.exe 1292 tssib.exe 1292 tssib.exe 1292 tssib.exe 1292 tssib.exe 1292 tssib.exe 1292 tssib.exe 1292 tssib.exe 1292 tssib.exe 1292 tssib.exe 1292 tssib.exe 1292 tssib.exe 1292 tssib.exe 1292 tssib.exe 1292 tssib.exe 1292 tssib.exe 1292 tssib.exe 1292 tssib.exe 1292 tssib.exe 1292 tssib.exe 1292 tssib.exe 1292 tssib.exe 1292 tssib.exe 1292 tssib.exe 1292 tssib.exe 1292 tssib.exe 1292 tssib.exe 1292 tssib.exe 1292 tssib.exe 1292 tssib.exe 1292 tssib.exe 1292 tssib.exe 1292 tssib.exe 1292 tssib.exe 1292 tssib.exe 1292 tssib.exe 1292 tssib.exe 1292 tssib.exe 1292 tssib.exe 1292 tssib.exe 1292 tssib.exe 1292 tssib.exe 1292 tssib.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3632 a49924a6a0cfc4f55e5ddd505ce26aa1.exe 1292 tssib.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3632 wrote to memory of 1292 3632 a49924a6a0cfc4f55e5ddd505ce26aa1.exe 92 PID 3632 wrote to memory of 1292 3632 a49924a6a0cfc4f55e5ddd505ce26aa1.exe 92 PID 3632 wrote to memory of 1292 3632 a49924a6a0cfc4f55e5ddd505ce26aa1.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\a49924a6a0cfc4f55e5ddd505ce26aa1.exe"C:\Users\Admin\AppData\Local\Temp\a49924a6a0cfc4f55e5ddd505ce26aa1.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3632 -
C:\Users\Admin\tssib.exe"C:\Users\Admin\tssib.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1292
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
268KB
MD54350cda740998bb5217adc809084e894
SHA179b62fac3dd03ca88386f955d73be5691351e163
SHA256ea7af7b8e8fc1f0860e7a0d776719027a985fddf40c6be6f290cfb21c26da8ac
SHA512d26501067077b1e57a2e82ba6f6659741ff82a353389c4cc8daf90097f2338c0813850ce1eb5f08c7402a4034d4a3a442dc0c9ca5a7721cede3d4ee0ca8d0c89