Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
08/01/2024, 12:38
Static task
static1
Behavioral task
behavioral1
Sample
4b756be9e903baef104e049d4c49f6e9.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
4b756be9e903baef104e049d4c49f6e9.exe
Resource
win10v2004-20231215-en
General
-
Target
4b756be9e903baef104e049d4c49f6e9.exe
-
Size
184KB
-
MD5
4b756be9e903baef104e049d4c49f6e9
-
SHA1
d8f4ad1b91725d03cd438789ca611a4d0f1f49b3
-
SHA256
6da57a9782179f5f4b5e201ae6ff003b0079e23daa1a1d8a69c2d8cb608c838e
-
SHA512
76b2df275e9c41fa49ac33a0bf83afb0b8c82c174a7034a6b44e7fa3e53f7338d3eb6462c3a01565ef123102912c952943628970744b1a6c49649fdf155fd8dd
-
SSDEEP
3072:OSqAAKl3evu9YedcKspTigA9BT6ecfxiCSeWQBikbPfqmDfgmwGRVFGFbU:Hq9MWoDydpRGdY6QBikjqmDJVRW
Malware Config
Signatures
-
Modifies Shared Task Scheduler registry keys 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{AF0BE91A-D92D-44F5-9581-64F629762E5A} regsvr32.exe -
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x000700000002321f-1.dat acprotect -
Loads dropped DLL 1 IoCs
pid Process 1028 regsvr32.exe -
resource yara_rule behavioral2/files/0x000700000002321f-1.dat upx behavioral2/memory/1028-3-0x0000000000400000-0x000000000043A000-memory.dmp upx -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\ccc.dll 4b756be9e903baef104e049d4c49f6e9.exe -
Modifies registry class 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{AF0BE91A-D92D-44F5-9581-64F629762E5A} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AF0BE91A-D92D-44F5-9581-64F629762E5A}\ = "C:\\Windows\\SysWow64\\ccc.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AF0BE91A-D92D-44F5-9581-64F629762E5A}\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AF0BE91A-D92D-44F5-9581-64F629762E5A}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AF0BE91A-D92D-44F5-9581-64F629762E5A}\InprocServer32\ = "C:\\Windows\\SysWow64\\ccc.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AF0BE91A-D92D-44F5-9581-64F629762E5A}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3028 wrote to memory of 1028 3028 4b756be9e903baef104e049d4c49f6e9.exe 88 PID 3028 wrote to memory of 1028 3028 4b756be9e903baef104e049d4c49f6e9.exe 88 PID 3028 wrote to memory of 1028 3028 4b756be9e903baef104e049d4c49f6e9.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\4b756be9e903baef104e049d4c49f6e9.exe"C:\Users\Admin\AppData\Local\Temp\4b756be9e903baef104e049d4c49f6e9.exe"1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\ccc.dll2⤵
- Modifies Shared Task Scheduler registry keys
- Loads dropped DLL
- Modifies registry class
PID:1028
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
137KB
MD54153bf9b607acb9fc311dc2dd29dd122
SHA1bacc1cd9788c1f427e44000d9132294a1bd11ddc
SHA2560ffceae6ce1f3be79fcd69c8a30deaa10eb151399e556ab6351eb836fcce8ead
SHA512e312af8df6fc1474dd79143e0895bf2bd5989871b52a874d487e50bf3f9e62978c480d1ad9cafc5f87912ff65d46da21efed1f65b1ec99cfbdf0d858bf25179c