Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
60s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
11/01/2024, 00:19
Static task
static1
Behavioral task
behavioral1
Sample
52074adb63e057ca2e90c3466b06682e.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
52074adb63e057ca2e90c3466b06682e.exe
Resource
win10v2004-20231215-en
General
-
Target
52074adb63e057ca2e90c3466b06682e.exe
-
Size
430KB
-
MD5
52074adb63e057ca2e90c3466b06682e
-
SHA1
44c334efad32eb9c28d4a99051ae0f63e00082b9
-
SHA256
c294dd58c069b8047e6a35836407a3ac4724629413205c3cc2061f59ed8fb770
-
SHA512
be7364030b8918541b1c5b1e7ef8b7e6e23b0da1e51c43fc4af1b0c5be8631f3e274f74d7fb2428722c6c0f8ae71a8a2a24b8cdbefb8f66c889f7ebb5b8998d9
-
SSDEEP
12288:ibee0PGl89WazvzkmMxM+ltxQMAn0Iv1b70ZSf2P:2edGBazvZMHltxtIv1bUS+P
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Control Panel\International\Geo\Nation 52074adb63e057ca2e90c3466b06682e.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Winder.lnk 52074adb63e057ca2e90c3466b06682e.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\52074adb63e057ca2e90c3466b06682e.exe = "C:\\System32\\52074adb63e057ca2e90c3466b06682e.exe" 52074adb63e057ca2e90c3466b06682e.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\Local Settings 52074adb63e057ca2e90c3466b06682e.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 780 52074adb63e057ca2e90c3466b06682e.exe 780 52074adb63e057ca2e90c3466b06682e.exe 780 52074adb63e057ca2e90c3466b06682e.exe 780 52074adb63e057ca2e90c3466b06682e.exe 780 52074adb63e057ca2e90c3466b06682e.exe 780 52074adb63e057ca2e90c3466b06682e.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 780 52074adb63e057ca2e90c3466b06682e.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 780 52074adb63e057ca2e90c3466b06682e.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 780 52074adb63e057ca2e90c3466b06682e.exe 780 52074adb63e057ca2e90c3466b06682e.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 780 wrote to memory of 1188 780 52074adb63e057ca2e90c3466b06682e.exe 91 PID 780 wrote to memory of 1188 780 52074adb63e057ca2e90c3466b06682e.exe 91 PID 780 wrote to memory of 1188 780 52074adb63e057ca2e90c3466b06682e.exe 91 PID 780 wrote to memory of 660 780 52074adb63e057ca2e90c3466b06682e.exe 92 PID 780 wrote to memory of 660 780 52074adb63e057ca2e90c3466b06682e.exe 92 PID 780 wrote to memory of 660 780 52074adb63e057ca2e90c3466b06682e.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\52074adb63e057ca2e90c3466b06682e.exe"C:\Users\Admin\AppData\Local\Temp\52074adb63e057ca2e90c3466b06682e.exe"1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:780 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS1.vbs"2⤵PID:1188
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS1.vbs"2⤵PID:660
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
653B
MD5d313c6fedba8c5b8c912eafc2f44af6b
SHA11bdbd575d7a27fc810d617a89c8c8858efb1860c
SHA25681bc0f010aefe41422cc1b6c9bcf9061a0084b43d4e0ae26450336b849a5a566
SHA51272a5898755ff397d88bc99ca20f2836667154f4e2b6ac00d92f66ae9ba323360b19afa84bcaf6e866109b2b438ee7609044a97074c7fd8781219df1ee25161a4