Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
93s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
02/02/2024, 02:38
Static task
static1
Behavioral task
behavioral1
Sample
88559e34bef2095e07c56426e3421395.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
88559e34bef2095e07c56426e3421395.exe
Resource
win10v2004-20231222-en
General
-
Target
88559e34bef2095e07c56426e3421395.exe
-
Size
192KB
-
MD5
88559e34bef2095e07c56426e3421395
-
SHA1
8789a395de5270e18b11f46448e99d4cbd2d2b94
-
SHA256
d60e5ca6eeb2192106beb658d64f7feaa07e2bab339dfd7dd08de114c2d42067
-
SHA512
cbf505a080c397561d1b9d39cd692f145a9d25e993577dcd6fe64cc88ad7d2c3d756a48f3080cdb2d3d406269cc18482c8b629907cebe3b241e8e0f9be3fd93a
-
SSDEEP
3072:LaVEAooXUK9AKYkk4/1V15JobX6oklBu+hSPNBz+uTUNO+3akX72WMRDP6GPtCzs:+aAhl10bX6okCOSPzjCP72TD60czB
Malware Config
Signatures
-
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\found.exe 88559e34bef2095e07c56426e3421395.exe File opened for modification C:\Windows\SysWOW64\found.exe 88559e34bef2095e07c56426e3421395.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Debug\found32.dll 88559e34bef2095e07c56426e3421395.exe -
Modifies registry class 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{18EDD7A0-87EF-45B7-85CF-6A7E1341E2BB}\InProcServer32\ = "C:\\Windows\\Debug\\found32.dll" regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{18EDD7A0-87EF-45B7-85CF-6A7E1341E2BB}\InProcServer32\ThreadingModel = "Apartment" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{18EDD7A0-87EF-45B7-85CF-6A7E1341E2BB} regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{18EDD7A0-87EF-45B7-85CF-6A7E1341E2BB}\ = "url" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{18EDD7A0-87EF-45B7-85CF-6A7E1341E2BB}\InProcServer32 regedit.exe -
Runs .reg file with regedit 1 IoCs
pid Process 1064 regedit.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1856 wrote to memory of 2444 1856 88559e34bef2095e07c56426e3421395.exe 85 PID 1856 wrote to memory of 2444 1856 88559e34bef2095e07c56426e3421395.exe 85 PID 1856 wrote to memory of 2444 1856 88559e34bef2095e07c56426e3421395.exe 85 PID 1856 wrote to memory of 816 1856 88559e34bef2095e07c56426e3421395.exe 86 PID 1856 wrote to memory of 816 1856 88559e34bef2095e07c56426e3421395.exe 86 PID 1856 wrote to memory of 816 1856 88559e34bef2095e07c56426e3421395.exe 86 PID 2444 wrote to memory of 1064 2444 cmd.exe 89 PID 2444 wrote to memory of 1064 2444 cmd.exe 89 PID 2444 wrote to memory of 1064 2444 cmd.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\88559e34bef2095e07c56426e3421395.exe"C:\Users\Admin\AppData\Local\Temp\88559e34bef2095e07c56426e3421395.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\fnous.bat2⤵
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Windows\SysWOW64\regedit.exeregedit /s C:\Users\Admin\AppData\Local\Temp\nothks.reg3⤵
- Modifies registry class
- Runs .reg file with regedit
PID:1064
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c erase /F "C:\Users\Admin\AppData\Local\Temp\88559e34bef2095e07c56426e3421395.exe"2⤵PID:816
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
126B
MD57ab275c1bc8750fe49119429e12ab856
SHA1ea556c59c5d3f2be584d2e208ba42a1540f46986
SHA2568d96bacc0e4651d7b8c27613f3f721bb89ca9fb9430bab66b2ef90bfe8cb5bb3
SHA5127fe4bce942523a6adde6d83fc2f63302283f3e0642db4f9f650d50ba8f6f2b7b587229736521615d54b596f24a23146ab7aecb512c145b8dc4b81050ac3576c1
-
Filesize
403B
MD5e1db5e72383ca2535cc04d98efb0f6e6
SHA1b3407d394658ad2d4ef59179fd2ddd419a1dc1d7
SHA25652a9ba0c766a4da941eb674797f1770712e64e2d2104271b4ff6368a45ba5c31
SHA5126ac5c144d0103b722a7203b04f79b3c691ff1393b59555a7ccd454a10a64e2c60111e9e45dc1fdaa3fdf180fac2b0416250aa0180a946c772bd3f1225c15c095