Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
26/01/2024, 21:32
Static task
static1
Behavioral task
behavioral1
Sample
53ce817342e44184bc016b52add09c9fb9a2562643aed63fb227f8acaf982a96.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
53ce817342e44184bc016b52add09c9fb9a2562643aed63fb227f8acaf982a96.exe
Resource
win10v2004-20231215-en
General
-
Target
53ce817342e44184bc016b52add09c9fb9a2562643aed63fb227f8acaf982a96.exe
-
Size
196KB
-
MD5
d43ae4ce9cdb22793d56ad7798a8eb66
-
SHA1
df5dd918c7f9b352ab2cc1a75e216f6f0bdba7da
-
SHA256
53ce817342e44184bc016b52add09c9fb9a2562643aed63fb227f8acaf982a96
-
SHA512
636fe71b8f4146e8c545cc8ffe02aeec8d0047fb862be184e83654615823e4e11f572fbecf167b4d7b24531a7565879f7ba399dd1cdf0b2900782ac7d04d003a
-
SSDEEP
6144:rBs27MMLyX5HXXXDTXXXOGqIII+pXXX5AYjKXXXDoXXXG6XXXxXXXLIIIEAkOCO3:rK20HXXX/XXXFqIIIcXXX5j2XXXcXXXq
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation 53ce817342e44184bc016b52add09c9fb9a2562643aed63fb227f8acaf982a96.exe -
Executes dropped EXE 1 IoCs
pid Process 384 vgkhost.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Debug\vgkhost.exe 53ce817342e44184bc016b52add09c9fb9a2562643aed63fb227f8acaf982a96.exe File opened for modification C:\Windows\Debug\vgkhost.exe 53ce817342e44184bc016b52add09c9fb9a2562643aed63fb227f8acaf982a96.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 vgkhost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz vgkhost.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2748 53ce817342e44184bc016b52add09c9fb9a2562643aed63fb227f8acaf982a96.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2748 wrote to memory of 1168 2748 53ce817342e44184bc016b52add09c9fb9a2562643aed63fb227f8acaf982a96.exe 89 PID 2748 wrote to memory of 1168 2748 53ce817342e44184bc016b52add09c9fb9a2562643aed63fb227f8acaf982a96.exe 89 PID 2748 wrote to memory of 1168 2748 53ce817342e44184bc016b52add09c9fb9a2562643aed63fb227f8acaf982a96.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\53ce817342e44184bc016b52add09c9fb9a2562643aed63fb227f8acaf982a96.exe"C:\Users\Admin\AppData\Local\Temp\53ce817342e44184bc016b52add09c9fb9a2562643aed63fb227f8acaf982a96.exe"1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\53CE81~1.EXE > nul2⤵PID:1168
-
-
C:\Windows\Debug\vgkhost.exeC:\Windows\Debug\vgkhost.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
PID:384
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
196KB
MD5dd3001cfc0969afc298697c241063746
SHA1ef57e1a7e35a937762c9df68cbf475cef24a2999
SHA25633fcb93ff7fedd557640ae1fbb83012706ebda9a120fb389871d228f6d3a8fe6
SHA51277506e1f6c4389de4f6bad0960635206d677696461ada60a93efe0b57b5822d18dc24822f8d5fb24fa2fba396849321dade9339c45d09999c3648af624631c94