Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
13/02/2024, 02:30
Static task
static1
Behavioral task
behavioral1
Sample
1a922971e8d5fa8744a85a508a90d81b5d7fa6b024400af40ca29433dc2da43b.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
1a922971e8d5fa8744a85a508a90d81b5d7fa6b024400af40ca29433dc2da43b.exe
Resource
win10v2004-20231215-en
General
-
Target
1a922971e8d5fa8744a85a508a90d81b5d7fa6b024400af40ca29433dc2da43b.exe
-
Size
843KB
-
MD5
a194de24dfbba6afe8153b8a7d593e7e
-
SHA1
dd9e65550462722c10a07a6018ddc3fade4b1406
-
SHA256
1a922971e8d5fa8744a85a508a90d81b5d7fa6b024400af40ca29433dc2da43b
-
SHA512
4f702036655b07112ccd9effc1602b92e1ec08edfe32a3ff649423a0ee6cc9a7897fb1404c13a3569e1bf1cd3d9d341d5f179038bb4c3f769c4472feb5567e20
-
SSDEEP
24576:yxYS04YNEMuExDiU6E5R9s8xY/2l/dqLc83oIbt+ri:yxA4auS+UjfU2TAt3oIbt+r
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Control Panel\International\Geo\Nation 1a922971e8d5fa8744a85a508a90d81b5d7fa6b024400af40ca29433dc2da43b.exe -
Executes dropped EXE 1 IoCs
pid Process 3392 AudioDriver.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 39 IoCs
pid Process 3392 AudioDriver.exe 3392 AudioDriver.exe 3392 AudioDriver.exe 3392 AudioDriver.exe 3392 AudioDriver.exe 3392 AudioDriver.exe 3392 AudioDriver.exe 3392 AudioDriver.exe 3392 AudioDriver.exe 3392 AudioDriver.exe 3392 AudioDriver.exe 3392 AudioDriver.exe 3392 AudioDriver.exe 3392 AudioDriver.exe 3392 AudioDriver.exe 3392 AudioDriver.exe 3392 AudioDriver.exe 3392 AudioDriver.exe 3392 AudioDriver.exe 3392 AudioDriver.exe 3392 AudioDriver.exe 3392 AudioDriver.exe 3392 AudioDriver.exe 3392 AudioDriver.exe 3392 AudioDriver.exe 3392 AudioDriver.exe 3392 AudioDriver.exe 3392 AudioDriver.exe 3392 AudioDriver.exe 3392 AudioDriver.exe 3392 AudioDriver.exe 3392 AudioDriver.exe 3392 AudioDriver.exe 3392 AudioDriver.exe 3392 AudioDriver.exe 3392 AudioDriver.exe 3392 AudioDriver.exe 3392 AudioDriver.exe 3392 AudioDriver.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3392 AudioDriver.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3392 AudioDriver.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 3392 AudioDriver.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4540 wrote to memory of 3392 4540 1a922971e8d5fa8744a85a508a90d81b5d7fa6b024400af40ca29433dc2da43b.exe 86 PID 4540 wrote to memory of 3392 4540 1a922971e8d5fa8744a85a508a90d81b5d7fa6b024400af40ca29433dc2da43b.exe 86 PID 4540 wrote to memory of 3392 4540 1a922971e8d5fa8744a85a508a90d81b5d7fa6b024400af40ca29433dc2da43b.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\1a922971e8d5fa8744a85a508a90d81b5d7fa6b024400af40ca29433dc2da43b.exe"C:\Users\Admin\AppData\Local\Temp\1a922971e8d5fa8744a85a508a90d81b5d7fa6b024400af40ca29433dc2da43b.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\Users\Admin\AppData\Roaming\Microsoft\Speech\AudioDriver.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Speech\AudioDriver.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3392
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
507KB
MD568b1736ab8392cee92f10ba3ab685be0
SHA108d6cfe494fad26dadc8993811ad55a4bc80d89e
SHA2569a12b935d625e6bf97a1117c666e7610612f199e39b1aab2cd81917c3917bf16
SHA51272dc81cba3fe82b6dbbbeb6717e1d353d4d792a18d8373033d34cd15cd78bdae2194b8b728ede74e10ae043c8fe73d9ab179b778fb039fd8d855d23421ffdfd5
-
Filesize
257KB
MD53e53abf7e68cb4d640977d492349531d
SHA15aaf341109ebd893d6e256c7c71a34dc7d38a16c
SHA256ec0c656288ca86f2ce40e3d3c08c777f3ab3e4a4f6bb284986327dedd496b62e
SHA512d4d18989882179344bef3f41f0e4d642e5c26e4df32313be6a1303e7d12f1054ac2e89b7f5bbc76eb17706ffeefbd57dc8a2f65a176e762687bd162c8e6b89dc
-
Filesize
315KB
MD59062fc4a7afb2a087a75963b7d6dbf3c
SHA12fa9d8350b101dd1ac97ff428bbae446d96435e9
SHA25689fc2cd40109f55c166dfe270feac8cb27ce33c86ac2e35fc5e3262e121266b8
SHA512fbc9ab4319929add9599a3c0b6580dcf50d8be889066b21b295e8bcb54919e51a745314477c43528e060a11038dc715f979abd077f9fb7939f7a5d930f21a41c