Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
163s -
max time network
174s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
10/01/2024, 16:13
Behavioral task
behavioral1
Sample
0cdc51b0ae3ef491b1accd29f64167b498257de9a4d99e68a127caf06cbb4cbe.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
0cdc51b0ae3ef491b1accd29f64167b498257de9a4d99e68a127caf06cbb4cbe.exe
Resource
win10v2004-20231215-en
General
-
Target
0cdc51b0ae3ef491b1accd29f64167b498257de9a4d99e68a127caf06cbb4cbe.exe
-
Size
536KB
-
MD5
a831fd292adec253ceb03089ae56e1aa
-
SHA1
1b13b93e1baa4be6813a2001ca75276891e07a48
-
SHA256
0cdc51b0ae3ef491b1accd29f64167b498257de9a4d99e68a127caf06cbb4cbe
-
SHA512
cecd1ed8872a384342b8fb88d0e456ef013ee0f8aa364c0ca82735626e638aa111c10bf4b138c0128f34eb71fb203f722a6327d12d1d06846ea11754e24b625f
-
SSDEEP
12288:lhf0Bs9bDDq9huzJgIJzgXaEw9Stu/aB9a/Okx2LIa:ldQyDLzJTveuK0/Okx2LF
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/1076-0-0x0000000000320000-0x0000000000422000-memory.dmp upx behavioral2/memory/1076-3-0x0000000000320000-0x0000000000422000-memory.dmp upx behavioral2/memory/1076-15-0x0000000000320000-0x0000000000422000-memory.dmp upx behavioral2/memory/1076-20-0x0000000000320000-0x0000000000422000-memory.dmp upx behavioral2/memory/1076-29-0x0000000000320000-0x0000000000422000-memory.dmp upx behavioral2/memory/1076-33-0x0000000000320000-0x0000000000422000-memory.dmp upx behavioral2/memory/1076-43-0x0000000000320000-0x0000000000422000-memory.dmp upx -
Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 114.114.114.114 Destination IP 223.5.5.5 Destination IP 114.114.114.114 Destination IP 223.5.5.5 -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\126be8 0cdc51b0ae3ef491b1accd29f64167b498257de9a4d99e68a127caf06cbb4cbe.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 1076 0cdc51b0ae3ef491b1accd29f64167b498257de9a4d99e68a127caf06cbb4cbe.exe 1076 0cdc51b0ae3ef491b1accd29f64167b498257de9a4d99e68a127caf06cbb4cbe.exe 1076 0cdc51b0ae3ef491b1accd29f64167b498257de9a4d99e68a127caf06cbb4cbe.exe 1076 0cdc51b0ae3ef491b1accd29f64167b498257de9a4d99e68a127caf06cbb4cbe.exe 1076 0cdc51b0ae3ef491b1accd29f64167b498257de9a4d99e68a127caf06cbb4cbe.exe 1076 0cdc51b0ae3ef491b1accd29f64167b498257de9a4d99e68a127caf06cbb4cbe.exe 1076 0cdc51b0ae3ef491b1accd29f64167b498257de9a4d99e68a127caf06cbb4cbe.exe 1076 0cdc51b0ae3ef491b1accd29f64167b498257de9a4d99e68a127caf06cbb4cbe.exe 3444 Explorer.EXE 3444 Explorer.EXE 3444 Explorer.EXE 3444 Explorer.EXE -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 1076 0cdc51b0ae3ef491b1accd29f64167b498257de9a4d99e68a127caf06cbb4cbe.exe Token: SeTcbPrivilege 1076 0cdc51b0ae3ef491b1accd29f64167b498257de9a4d99e68a127caf06cbb4cbe.exe Token: SeDebugPrivilege 1076 0cdc51b0ae3ef491b1accd29f64167b498257de9a4d99e68a127caf06cbb4cbe.exe Token: SeDebugPrivilege 3444 Explorer.EXE Token: SeTcbPrivilege 3444 Explorer.EXE -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 3444 Explorer.EXE -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1076 wrote to memory of 3444 1076 0cdc51b0ae3ef491b1accd29f64167b498257de9a4d99e68a127caf06cbb4cbe.exe 41 PID 1076 wrote to memory of 3444 1076 0cdc51b0ae3ef491b1accd29f64167b498257de9a4d99e68a127caf06cbb4cbe.exe 41 PID 1076 wrote to memory of 3444 1076 0cdc51b0ae3ef491b1accd29f64167b498257de9a4d99e68a127caf06cbb4cbe.exe 41
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
PID:3444 -
C:\Users\Admin\AppData\Local\Temp\0cdc51b0ae3ef491b1accd29f64167b498257de9a4d99e68a127caf06cbb4cbe.exe"C:\Users\Admin\AppData\Local\Temp\0cdc51b0ae3ef491b1accd29f64167b498257de9a4d99e68a127caf06cbb4cbe.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1076
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046
Filesize1KB
MD57c32c9bf6649f6c80d4933af187cbac9
SHA1964d4ad3410bf9a143eb15e86ca5738995de809c
SHA25691ba921ae3bdae1096b112fe3e053ed0c074cdc982db647a3236d1ada5a81eb5
SHA512e8daa557698181f11cdaa4d18edcd0c7b4a7d3b2b7950f90f5173831ce6bc1dc8de762cbeb238c5156cf173d77034c49fbbc184a0e9f2abfb83c67f9367ecd5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_3AF0FDC80EA858911339035786739FF3
Filesize938B
MD51df463ff7596107c9f8d9d640d50c58a
SHA13f30f19bdb20d064c12b933325ce1c03b775f4a2
SHA256c1edf2279c8f750b92cfacafa86c5639a231b3648c15d270b0cdf3f983bfc0d0
SHA5129c5e7a1c3e6d3acadc1be21620dc12d48d19260121e6551425265d8bf7bf7d08691a8c62ccedfea3e0ef67aca7cec3c1bd39cfb05b05d1705a46634bcd38f4cb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046
Filesize502B
MD58751d6738fe1db3331a6addb93ebffd4
SHA169aac176c9eea05abcf1b5bb4c0e629ce111d37a
SHA2566e539f45c77d75a101f2f35d90554a1aac944e7f6c95702588df900942c3fd0d
SHA512202539d73c1ee8c61f02ea9b0a074cd7bdf8d0f64338795e303eb8e6f762870bdd7b84486b2d7d91d11ccbd86e62fce8a5bb5807c3c3bcea2f5ab9baedd747f9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_3AF0FDC80EA858911339035786739FF3
Filesize520B
MD593e3d5c825d97cfc2adec7ef85dfe18d
SHA1ff3dc7985b18cea0e5ae13ea32a72a4215f7120b
SHA2565dd6d8a017c5068c19e4efff6a79e6c08f3a1a315dce9446269e0af3559766fd
SHA5128e5b886209055eec5fd1be04151035a82286a8c3d9e7ea99d2f0ad7c403d7d09bab3b604e3ae62e200bde89a0646282e43f693ad2c79775b54574b64df6736b4