Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
205s -
max time network
224s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
11/01/2024, 02:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5253f7a06c69c8bed0eee411a7e0bb55.exe
Resource
win7-20231129-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
5253f7a06c69c8bed0eee411a7e0bb55.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
12 signatures
150 seconds
General
-
Target
5253f7a06c69c8bed0eee411a7e0bb55.exe
-
Size
39KB
-
MD5
5253f7a06c69c8bed0eee411a7e0bb55
-
SHA1
3a3f36e94ad74a700bc6d48a498773de192bec17
-
SHA256
a6d0900830daa30ced5171f0c6863a235dc1b676c18924162758eb1baec8c605
-
SHA512
6a0869c21f89c392c96a64f5899a59904b3bc5239e6c6852b16143d852eccdc00eab147e68bdf5886ead6afeb1ec68534d018b9b4b5f28ef068a026d838c6bc2
-
SSDEEP
768:Rik+jTpwqPyR9qKARp1tgeWLikd0WwHj2c:RibCci9qXRrtgeWLikd62c
Score
7/10
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x000a00000002321c-3.dat acprotect -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Control Panel\International\Geo\Nation 5253f7a06c69c8bed0eee411a7e0bb55.exe -
Loads dropped DLL 1 IoCs
pid Process 3368 5253f7a06c69c8bed0eee411a7e0bb55.exe -
resource yara_rule behavioral2/memory/3368-6-0x0000000010000000-0x000000001000F000-memory.dmp upx behavioral2/files/0x000a00000002321c-3.dat upx behavioral2/memory/3368-7-0x0000000010000000-0x000000001000F000-memory.dmp upx behavioral2/memory/3368-9-0x0000000010000000-0x000000001000F000-memory.dmp upx -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\BMsg6pdMD4ht.dll 5253f7a06c69c8bed0eee411a7e0bb55.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\FOnts\MhaUKGazkr3fZZKp.ttf 5253f7a06c69c8bed0eee411a7e0bb55.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 7 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{737858A9-9AEA-4838-9B49-54DA731F7F37}\InprocServer32 5253f7a06c69c8bed0eee411a7e0bb55.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{737858A9-9AEA-4838-9B49-54DA731F7F37}\InprocServer32\ = "C:\\Windows\\SysWow64\\BMsg6pdMD4ht.dll" 5253f7a06c69c8bed0eee411a7e0bb55.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{737858A9-9AEA-4838-9B49-54DA731F7F37}\InprocServer32\ThreadingModel = "Apartment" 5253f7a06c69c8bed0eee411a7e0bb55.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLsID\{737858A9-9AEA-4838-9B49-54DA731F7F37}\InprocServer32 5253f7a06c69c8bed0eee411a7e0bb55.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node 5253f7a06c69c8bed0eee411a7e0bb55.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLsID 5253f7a06c69c8bed0eee411a7e0bb55.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{737858A9-9AEA-4838-9B49-54DA731F7F37} 5253f7a06c69c8bed0eee411a7e0bb55.exe -
Suspicious behavior: EnumeratesProcesses 16 IoCs
pid Process 3368 5253f7a06c69c8bed0eee411a7e0bb55.exe 3368 5253f7a06c69c8bed0eee411a7e0bb55.exe 3368 5253f7a06c69c8bed0eee411a7e0bb55.exe 3368 5253f7a06c69c8bed0eee411a7e0bb55.exe 3368 5253f7a06c69c8bed0eee411a7e0bb55.exe 3368 5253f7a06c69c8bed0eee411a7e0bb55.exe 3368 5253f7a06c69c8bed0eee411a7e0bb55.exe 3368 5253f7a06c69c8bed0eee411a7e0bb55.exe 3368 5253f7a06c69c8bed0eee411a7e0bb55.exe 3368 5253f7a06c69c8bed0eee411a7e0bb55.exe 3368 5253f7a06c69c8bed0eee411a7e0bb55.exe 3368 5253f7a06c69c8bed0eee411a7e0bb55.exe 3368 5253f7a06c69c8bed0eee411a7e0bb55.exe 3368 5253f7a06c69c8bed0eee411a7e0bb55.exe 3368 5253f7a06c69c8bed0eee411a7e0bb55.exe 3368 5253f7a06c69c8bed0eee411a7e0bb55.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3368 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 3368 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 3368 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 3368 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 3368 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 3368 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 3368 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 3368 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 3368 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 3368 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 3368 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 3368 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 3368 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 3368 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 3368 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 3368 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 3368 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 3368 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 3368 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 3368 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 3368 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 3368 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 3368 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 3368 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 3368 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 3368 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 3368 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 3368 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 3368 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 3368 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 3368 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 3368 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 3368 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 3368 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 3368 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 3368 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 3368 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 3368 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 3368 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 3368 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 3368 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 3368 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 3368 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 3368 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 3368 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 3368 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 3368 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 3368 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 3368 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 3368 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 3368 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 3368 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 3368 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 3368 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 3368 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 3368 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 3368 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 3368 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 3368 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 3368 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 3368 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 3368 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 3368 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 3368 5253f7a06c69c8bed0eee411a7e0bb55.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3368 5253f7a06c69c8bed0eee411a7e0bb55.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3368 wrote to memory of 388 3368 5253f7a06c69c8bed0eee411a7e0bb55.exe 93 PID 3368 wrote to memory of 388 3368 5253f7a06c69c8bed0eee411a7e0bb55.exe 93 PID 3368 wrote to memory of 388 3368 5253f7a06c69c8bed0eee411a7e0bb55.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\5253f7a06c69c8bed0eee411a7e0bb55.exe"C:\Users\Admin\AppData\Local\Temp\5253f7a06c69c8bed0eee411a7e0bb55.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3368 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\5253F7~1.EXE >> NUL2⤵PID:388
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
15KB
MD50409d324f5dd9137c96467de6acf9894
SHA1ab50bfce9c27429cbeac53846c43c8c5fe9bc51b
SHA256076376b4021704012c85639345597be70aa68b18af9216d85cb94d2fc95b5a80
SHA5129abb49be9c792e387b9b024c5ab3f85ea1242ceae6f462aefb221df824e62276d1e931a4fa9470f6c1885d308045b691d162830c630609273d264b7048e62bda