Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    145s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/02/2024, 17:40

General

  • Target

    8fc24407671c79b675c98492ace8f104.exe

  • Size

    14KB

  • MD5

    8fc24407671c79b675c98492ace8f104

  • SHA1

    ba12301c575c94aec20f5986d0550eb9c8825979

  • SHA256

    d98aab09f963cdc05a6c8e77bd0a75ab45075998b423c67b5edf59ee6371ae1b

  • SHA512

    b8f1e6369ab625d3540aeb40be0714637c674e5cb7bacde49d24b263f8dd10f78de20b690eaeebe1a67af47f2ae3975f502bc7fb6df79bdc3ceee0f4340749cc

  • SSDEEP

    384:AZGxEZ5FT3Ntxk3Bj93qmmuxBxVppBYklN18ilvHM9QrTUU3WZ0zrze:DOZ5Bq3qm3xbpBYklL8iJkwIS/zne

Score
10/10

Malware Config

Signatures

  • Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Drops file in System32 directory 1 IoCs
  • Modifies registry class 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8fc24407671c79b675c98492ace8f104.exe
    "C:\Users\Admin\AppData\Local\Temp\8fc24407671c79b675c98492ace8f104.exe"
    1⤵
    • Adds autorun key to be loaded by Explorer.exe on startup
    • Loads dropped DLL
    • Drops file in System32 directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3636
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\BC1C.tmp.bat
      2⤵
        PID:1316

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\BC1C.tmp.bat

      Filesize

      179B

      MD5

      de42ab264bf73f41d7b9ef3240c5f4ea

      SHA1

      79888c22ed30916cc13a4ab2d3cfc08ad1cfa98a

      SHA256

      0c72e28d7b1ef785b379037053fb48cc299f8230ee22de2347d7f8485a477871

      SHA512

      5b2bd34aec956f27d6f665a565a57bfaa8ac5bcf1a3bbf1868565ada4e81279c4073fc57fe03995b06779f782226a059d42b5a432e1d4e5589dc507d58f8587b

    • C:\Users\Admin\AppData\Local\Temp\zxeoddrq.tmp

      Filesize

      2.2MB

      MD5

      a739ecabba6d6d1c1e6a6d832cde9cac

      SHA1

      d92068a1c25ab517d1705bc3e8b2d852de768f3e

      SHA256

      4eaf1b25b28a0c47b285bf389de0e4bfc235d8594402c08887846dd13fdfe83b

      SHA512

      f5921dbb565f70a096b946117afc88baf102b3ac934191c41cd5a468876569bf11d9079a141254907380bc83e3c0d46edf3e59369b3a475c0e07b61cffa8d3d8

    • C:\Windows\SysWOW64\zxeoddrq.nls

      Filesize

      428B

      MD5

      7e0c77eb9b53559c85289cc0490213f0

      SHA1

      ed052fcaa5fdd4770650882c289f68908fccc287

      SHA256

      0fb3c6508bbdbb6416f4b709204d666387acc7583c1eef488bbd87eb400bd426

      SHA512

      70896a7ab3317aa7838a4843cf2390f12e7ea7caea49eb62161a3dbd709688a1865a0f560bc527335d7aa2033bfd2ce33088daef2b7114e20f3a43ed8d3427c7

    • memory/3636-17-0x0000000010000000-0x000000001006C000-memory.dmp

      Filesize

      432KB

    • memory/3636-21-0x0000000010000000-0x000000001006C000-memory.dmp

      Filesize

      432KB