Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
12/01/2024, 20:33
Static task
static1
Behavioral task
behavioral1
Sample
6f7535d0d70cf0527b4fe687d31e534aa537073a2865bd1181c32d09b092a685.lnk
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
6f7535d0d70cf0527b4fe687d31e534aa537073a2865bd1181c32d09b092a685.lnk
Resource
win10v2004-20231215-en
General
-
Target
6f7535d0d70cf0527b4fe687d31e534aa537073a2865bd1181c32d09b092a685.lnk
-
Size
2KB
-
MD5
358d952e52f642d2ca0621093628fbc9
-
SHA1
8d7b505f597801197f197abaa7ffc10c4ccc4f8a
-
SHA256
6f7535d0d70cf0527b4fe687d31e534aa537073a2865bd1181c32d09b092a685
-
SHA512
ffcb43003413141fb8f11e773fbf2e7bf15104f372b6389c8d28b1c45ecbd0cd77cdee6a41012782b17e3f50299dc47c91394d7d79a3bff1926a7257d7a22b0a
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2356 powershell.exe 2356 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2356 powershell.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1196 wrote to memory of 1948 1196 cmd.exe 89 PID 1196 wrote to memory of 1948 1196 cmd.exe 89 PID 1948 wrote to memory of 2356 1948 cmd.exe 92 PID 1948 wrote to memory of 2356 1948 cmd.exe 92
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\6f7535d0d70cf0527b4fe687d31e534aa537073a2865bd1181c32d09b092a685.lnk1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /k set COMPLUS_ApplicationMigrationRuntimeActivationConfigPath=C:\Program Files\AppFabric 1.1 for Windows Server\&powershell.exe -noexit -command "Import-Module DistributedCacheAdministration;Use-CacheCluster"2⤵
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -noexit -command "Import-Module DistributedCacheAdministration;Use-CacheCluster"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2356
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82