Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
13/02/2024, 05:32
Static task
static1
Behavioral task
behavioral1
Sample
d06324e91d5b7f81c9a144fb520c5896f82899271c1632ee0fbc0687a17cc4c5.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
d06324e91d5b7f81c9a144fb520c5896f82899271c1632ee0fbc0687a17cc4c5.exe
Resource
win10v2004-20231215-en
General
-
Target
d06324e91d5b7f81c9a144fb520c5896f82899271c1632ee0fbc0687a17cc4c5.exe
-
Size
949KB
-
MD5
3785efc90f48f4d73f80ac7c8a681cca
-
SHA1
e7bf26ad61392721a29b952794d72dc6f776e17d
-
SHA256
d06324e91d5b7f81c9a144fb520c5896f82899271c1632ee0fbc0687a17cc4c5
-
SHA512
249e4ddd349473f2469bf6a1e66c90c8478e94d2247c01f2d7338fb5caf6eec10560b88fdb850cc90de4ed3c70e24ff2bb09dce576f5b78940c682e13cae6f59
-
SSDEEP
24576:aRmJkcoQricOIQxiZY1iaK4hL8NzjA3xBJ4tgajm:/JZoQrbTFZY1iaKJlA3HSgaS
Malware Config
Signatures
-
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 4068 set thread context of 1500 4068 d06324e91d5b7f81c9a144fb520c5896f82899271c1632ee0fbc0687a17cc4c5.exe 80 PID 1500 set thread context of 3492 1500 svchost.exe 34 PID 1500 set thread context of 2312 1500 svchost.exe 89 PID 2312 set thread context of 3492 2312 regsvr32.exe 34 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Key created \Registry\User\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 regsvr32.exe -
Suspicious behavior: EnumeratesProcesses 62 IoCs
pid Process 1500 svchost.exe 1500 svchost.exe 1500 svchost.exe 1500 svchost.exe 1500 svchost.exe 1500 svchost.exe 1500 svchost.exe 1500 svchost.exe 1500 svchost.exe 1500 svchost.exe 1500 svchost.exe 1500 svchost.exe 1500 svchost.exe 1500 svchost.exe 1500 svchost.exe 1500 svchost.exe 2312 regsvr32.exe 2312 regsvr32.exe 2312 regsvr32.exe 2312 regsvr32.exe 2312 regsvr32.exe 2312 regsvr32.exe 2312 regsvr32.exe 2312 regsvr32.exe 2312 regsvr32.exe 2312 regsvr32.exe 2312 regsvr32.exe 2312 regsvr32.exe 2312 regsvr32.exe 2312 regsvr32.exe 2312 regsvr32.exe 2312 regsvr32.exe 2312 regsvr32.exe 2312 regsvr32.exe 2312 regsvr32.exe 2312 regsvr32.exe 2312 regsvr32.exe 2312 regsvr32.exe 2312 regsvr32.exe 2312 regsvr32.exe 2312 regsvr32.exe 2312 regsvr32.exe 2312 regsvr32.exe 2312 regsvr32.exe 2312 regsvr32.exe 2312 regsvr32.exe 2312 regsvr32.exe 2312 regsvr32.exe 2312 regsvr32.exe 2312 regsvr32.exe 2312 regsvr32.exe 2312 regsvr32.exe 2312 regsvr32.exe 2312 regsvr32.exe 2312 regsvr32.exe 2312 regsvr32.exe 2312 regsvr32.exe 2312 regsvr32.exe 2312 regsvr32.exe 2312 regsvr32.exe 2312 regsvr32.exe 2312 regsvr32.exe -
Suspicious behavior: MapViewOfSection 8 IoCs
pid Process 4068 d06324e91d5b7f81c9a144fb520c5896f82899271c1632ee0fbc0687a17cc4c5.exe 1500 svchost.exe 3492 Explorer.EXE 3492 Explorer.EXE 2312 regsvr32.exe 2312 regsvr32.exe 2312 regsvr32.exe 2312 regsvr32.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 4068 wrote to memory of 1500 4068 d06324e91d5b7f81c9a144fb520c5896f82899271c1632ee0fbc0687a17cc4c5.exe 80 PID 4068 wrote to memory of 1500 4068 d06324e91d5b7f81c9a144fb520c5896f82899271c1632ee0fbc0687a17cc4c5.exe 80 PID 4068 wrote to memory of 1500 4068 d06324e91d5b7f81c9a144fb520c5896f82899271c1632ee0fbc0687a17cc4c5.exe 80 PID 4068 wrote to memory of 1500 4068 d06324e91d5b7f81c9a144fb520c5896f82899271c1632ee0fbc0687a17cc4c5.exe 80 PID 3492 wrote to memory of 2312 3492 Explorer.EXE 89 PID 3492 wrote to memory of 2312 3492 Explorer.EXE 89 PID 3492 wrote to memory of 2312 3492 Explorer.EXE 89 PID 2312 wrote to memory of 1764 2312 regsvr32.exe 90 PID 2312 wrote to memory of 1764 2312 regsvr32.exe 90 PID 2312 wrote to memory of 1764 2312 regsvr32.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\d06324e91d5b7f81c9a144fb520c5896f82899271c1632ee0fbc0687a17cc4c5.exe"C:\Users\Admin\AppData\Local\Temp\d06324e91d5b7f81c9a144fb520c5896f82899271c1632ee0fbc0687a17cc4c5.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4068 -
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\d06324e91d5b7f81c9a144fb520c5896f82899271c1632ee0fbc0687a17cc4c5.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1500
-
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3492 -
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\SysWOW64\regsvr32.exe"2⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:1764
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
127KB
MD5e4a72793b040c9b7481de8f7afc06c12
SHA175c954cebce055a7f85ab3614824f3745571ef8f
SHA256a32b5271d6d3c756142f9f5c65a2994c8d4395ba91f9ecdb9adb090e12b0cb41
SHA51265ca7420f2290a25c424c078d901d750c11961fbc646c3d0be7a38b43a14d8f510680ee72f9d2f31d393cdbda375c0aab5bd154229cded400b30589bcea73d1b