Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
28/01/2024, 01:35
Behavioral task
behavioral1
Sample
7bd04633f8ccdaa8adf2c08ca5fb86a7.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
7bd04633f8ccdaa8adf2c08ca5fb86a7.exe
Resource
win10v2004-20231215-en
General
-
Target
7bd04633f8ccdaa8adf2c08ca5fb86a7.exe
-
Size
28KB
-
MD5
7bd04633f8ccdaa8adf2c08ca5fb86a7
-
SHA1
384a9c69f3ce0a87c45733dff8e5d6757af88a6c
-
SHA256
f27089e764a7cc4fc490dbc02986b759fb77a085e665b359aa49697e72c6ab6e
-
SHA512
6381bb439aeb5c49e9de041a03115f3a9a23f9bf437ac4631621412294e917b0b528dc41633ff38bc8a4f00ce9a0bc7c2f2df3fb24c1c407812ce8952e282cb1
-
SSDEEP
768:MC9IUHWc3YdxPJB65qf+wgGfwp3U1fZHfEO7CDrm:MCSUHWc3YdZJB/gNpk1BfDH
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 7bd04633f8ccdaa8adf2c08ca5fb86a7.exe -
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 1916 netsh.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Control Panel\International\Geo\Nation 7bd04633f8ccdaa8adf2c08ca5fb86a7.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mousedriver.exe 7bd04633f8ccdaa8adf2c08ca5fb86a7.exe -
resource yara_rule behavioral2/memory/1564-0-0x0000000000400000-0x0000000000418000-memory.dmp upx behavioral2/memory/1564-3-0x0000000000400000-0x0000000000418000-memory.dmp upx behavioral2/memory/1564-4-0x0000000000400000-0x0000000000418000-memory.dmp upx behavioral2/memory/1564-10-0x0000000000400000-0x0000000000418000-memory.dmp upx behavioral2/memory/1564-11-0x0000000000400000-0x0000000000418000-memory.dmp upx behavioral2/memory/1564-12-0x0000000000400000-0x0000000000418000-memory.dmp upx behavioral2/memory/1564-13-0x0000000000400000-0x0000000000418000-memory.dmp upx behavioral2/memory/1564-14-0x0000000000400000-0x0000000000418000-memory.dmp upx behavioral2/memory/1564-15-0x0000000000400000-0x0000000000418000-memory.dmp upx behavioral2/memory/1564-16-0x0000000000400000-0x0000000000418000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\engel = "C:\\Users\\Admin\\AppData\\Roaming\\updates\\updates.exe" 7bd04633f8ccdaa8adf2c08ca5fb86a7.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\engel = "C:\\Users\\Admin\\AppData\\Local\\Temp\\7bd04633f8ccdaa8adf2c08ca5fb86a7.exe" 7bd04633f8ccdaa8adf2c08ca5fb86a7.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Internet Explorer\Main\DHCP = "1130717" 7bd04633f8ccdaa8adf2c08ca5fb86a7.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Internet Explorer\Main\DNS 7bd04633f8ccdaa8adf2c08ca5fb86a7.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1564 wrote to memory of 1916 1564 7bd04633f8ccdaa8adf2c08ca5fb86a7.exe 95 PID 1564 wrote to memory of 1916 1564 7bd04633f8ccdaa8adf2c08ca5fb86a7.exe 95 PID 1564 wrote to memory of 1916 1564 7bd04633f8ccdaa8adf2c08ca5fb86a7.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\7bd04633f8ccdaa8adf2c08ca5fb86a7.exe"C:\Users\Admin\AppData\Local\Temp\7bd04633f8ccdaa8adf2c08ca5fb86a7.exe"1⤵
- Modifies firewall policy service
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="7bd04633f8ccdaa8adf2c08ca5fb86a7" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\7bd04633f8ccdaa8adf2c08ca5fb86a7.exe"2⤵
- Modifies Windows Firewall
PID:1916
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2