Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
104s -
max time network
130s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
08/01/2024, 14:06
Static task
static1
Behavioral task
behavioral1
Sample
97c2d5b8641875634156368989ff410bb6b5cab67c2c5430b73cb47d51982012.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
97c2d5b8641875634156368989ff410bb6b5cab67c2c5430b73cb47d51982012.exe
Resource
win10v2004-20231222-en
General
-
Target
97c2d5b8641875634156368989ff410bb6b5cab67c2c5430b73cb47d51982012.exe
-
Size
1.4MB
-
MD5
2f0d1effca8e06f489035a1e1facc192
-
SHA1
fd96f6c801e4791c82d2c7cf44c7a829d95a946b
-
SHA256
97c2d5b8641875634156368989ff410bb6b5cab67c2c5430b73cb47d51982012
-
SHA512
a8deb4a624d5d83c1c5aa98aa986dd9ae0b261a9e57066853e2187fc9ea25308e1d1e072efe80d76e569ff93734a75447566c9a31f5b0536fae532383075166f
-
SSDEEP
24576:Y4U6dqpfTTGiyfhy584ihQuL87Etqq6vOSpd57vwvN4j6Ii3Vke3u:Y4XwppyU+87jd57v243akj
Malware Config
Signatures
-
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 3504 set thread context of 4936 3504 97c2d5b8641875634156368989ff410bb6b5cab67c2c5430b73cb47d51982012.exe 31 PID 4936 set thread context of 3420 4936 ping.exe 49 PID 4936 set thread context of 3612 4936 ping.exe 105 PID 3612 set thread context of 3420 3612 wextract.exe 49 -
description ioc Process Key created \Registry\User\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 wextract.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 4936 ping.exe -
Suspicious behavior: EnumeratesProcesses 55 IoCs
pid Process 3504 97c2d5b8641875634156368989ff410bb6b5cab67c2c5430b73cb47d51982012.exe 3504 97c2d5b8641875634156368989ff410bb6b5cab67c2c5430b73cb47d51982012.exe 4936 ping.exe 4936 ping.exe 4936 ping.exe 4936 ping.exe 4936 ping.exe 4936 ping.exe 4936 ping.exe 4936 ping.exe 4936 ping.exe 4936 ping.exe 4936 ping.exe 4936 ping.exe 4936 ping.exe 4936 ping.exe 4936 ping.exe 4936 ping.exe 4936 ping.exe 4936 ping.exe 4936 ping.exe 4936 ping.exe 4936 ping.exe 3612 wextract.exe 3612 wextract.exe 3612 wextract.exe 3612 wextract.exe 3612 wextract.exe 3612 wextract.exe 3612 wextract.exe 3612 wextract.exe 3612 wextract.exe 3612 wextract.exe 3612 wextract.exe 3612 wextract.exe 3612 wextract.exe 3612 wextract.exe 3612 wextract.exe 3612 wextract.exe 3612 wextract.exe 3612 wextract.exe 3612 wextract.exe 3612 wextract.exe 3612 wextract.exe 3612 wextract.exe 3612 wextract.exe 3612 wextract.exe 3612 wextract.exe 3612 wextract.exe 3612 wextract.exe 3612 wextract.exe 3612 wextract.exe 3612 wextract.exe 3612 wextract.exe 3612 wextract.exe -
Suspicious behavior: MapViewOfSection 7 IoCs
pid Process 4936 ping.exe 3420 Explorer.EXE 3420 Explorer.EXE 3612 wextract.exe 3612 wextract.exe 3612 wextract.exe 3612 wextract.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3504 97c2d5b8641875634156368989ff410bb6b5cab67c2c5430b73cb47d51982012.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 3504 wrote to memory of 1572 3504 97c2d5b8641875634156368989ff410bb6b5cab67c2c5430b73cb47d51982012.exe 32 PID 3504 wrote to memory of 1572 3504 97c2d5b8641875634156368989ff410bb6b5cab67c2c5430b73cb47d51982012.exe 32 PID 3504 wrote to memory of 1572 3504 97c2d5b8641875634156368989ff410bb6b5cab67c2c5430b73cb47d51982012.exe 32 PID 3504 wrote to memory of 4936 3504 97c2d5b8641875634156368989ff410bb6b5cab67c2c5430b73cb47d51982012.exe 31 PID 3504 wrote to memory of 4936 3504 97c2d5b8641875634156368989ff410bb6b5cab67c2c5430b73cb47d51982012.exe 31 PID 3504 wrote to memory of 4936 3504 97c2d5b8641875634156368989ff410bb6b5cab67c2c5430b73cb47d51982012.exe 31 PID 3504 wrote to memory of 4936 3504 97c2d5b8641875634156368989ff410bb6b5cab67c2c5430b73cb47d51982012.exe 31 PID 3504 wrote to memory of 4936 3504 97c2d5b8641875634156368989ff410bb6b5cab67c2c5430b73cb47d51982012.exe 31 PID 3504 wrote to memory of 4936 3504 97c2d5b8641875634156368989ff410bb6b5cab67c2c5430b73cb47d51982012.exe 31 PID 3420 wrote to memory of 3612 3420 Explorer.EXE 105 PID 3420 wrote to memory of 3612 3420 Explorer.EXE 105 PID 3420 wrote to memory of 3612 3420 Explorer.EXE 105 PID 3612 wrote to memory of 4324 3612 wextract.exe 108 PID 3612 wrote to memory of 4324 3612 wextract.exe 108 PID 3612 wrote to memory of 4324 3612 wextract.exe 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\97c2d5b8641875634156368989ff410bb6b5cab67c2c5430b73cb47d51982012.exe"C:\Users\Admin\AppData\Local\Temp\97c2d5b8641875634156368989ff410bb6b5cab67c2c5430b73cb47d51982012.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3504 -
C:\Windows\SysWOW64\ping.exe"C:\Windows\SYSWOW64\ping.exe"2⤵
- Suspicious use of SetThreadContext
- Runs ping.exe
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4936
-
-
C:\Windows\SysWOW64\calc.exe"C:\Windows\SYSWOW64\calc.exe"2⤵PID:1572
-
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3420 -
C:\Windows\SysWOW64\wextract.exe"C:\Windows\SysWOW64\wextract.exe"2⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3612 -
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:4324
-
-