Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
20/02/2024, 02:31
Static task
static1
Behavioral task
behavioral1
Sample
71249c7234586da21d10b349be6b4044.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
71249c7234586da21d10b349be6b4044.exe
Resource
win10v2004-20231222-en
General
-
Target
71249c7234586da21d10b349be6b4044.exe
-
Size
327KB
-
MD5
71249c7234586da21d10b349be6b4044
-
SHA1
3fe0ce136436c8afa5a6fcdecbaf03d79ebb5701
-
SHA256
e38d3f5f725b87b072aa1a7cd772bafde24afed3a47b05be735a554a406da734
-
SHA512
fd47e8bf7ea234a2ef84865afa1b8609ce12d5fa60e4395e3bd43967d10ddd49b2f1971004936660506a840ace20308536ed52d4733429a5ea8f15fe0b8577f2
-
SSDEEP
6144:p2+JS2sFafI8U0obHCW/2a7XQcsPMjVWrG8KgbPzDh:p2TFafJiHCWBWPMjVWrXK0
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Control Panel\International\Geo\Nation 71249c7234586da21d10b349be6b4044.exe -
Executes dropped EXE 2 IoCs
pid Process 956 dwmsys.exe 2112 dwmsys.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 30 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000_Classes\systemui 71249c7234586da21d10b349be6b4044.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000_Classes\systemui\Content-Type = "application/x-msdownload" 71249c7234586da21d10b349be6b4044.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000_Classes\systemui\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\SysWOW_amd64\\dwmsys.exe\" /START \"%1\" %*" 71249c7234586da21d10b349be6b4044.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000_Classes\.exe\shell\runas\command\ = "\"%1\" %*" 71249c7234586da21d10b349be6b4044.exe Key created \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000_Classes\systemui\shell\open 71249c7234586da21d10b349be6b4044.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000_Classes\systemui\shell\runas\command\ = "\"%1\" %*" 71249c7234586da21d10b349be6b4044.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000_Classes\systemui\ = "Application" 71249c7234586da21d10b349be6b4044.exe Key created \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000_Classes\.exe 71249c7234586da21d10b349be6b4044.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000_Classes\.exe\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\SysWOW_amd64\\dwmsys.exe\" /START \"%1\" %*" 71249c7234586da21d10b349be6b4044.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 71249c7234586da21d10b349be6b4044.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000_Classes\systemui\DefaultIcon\ = "%1" 71249c7234586da21d10b349be6b4044.exe Key created \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000_Classes\systemui\shell\open\command 71249c7234586da21d10b349be6b4044.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000_Classes\.exe\Content-Type = "application/x-msdownload" 71249c7234586da21d10b349be6b4044.exe Key created \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000_Classes\.exe\DefaultIcon 71249c7234586da21d10b349be6b4044.exe Key created \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000_Classes\.exe\shell\runas\command 71249c7234586da21d10b349be6b4044.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000_Classes\systemui\shell\open\command\IsolatedCommand = "\"%1\" %*" 71249c7234586da21d10b349be6b4044.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000_Classes\.exe\ = "systemui" 71249c7234586da21d10b349be6b4044.exe Key created \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000_Classes\.exe\shell 71249c7234586da21d10b349be6b4044.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000_Classes\.exe\shell\runas\command\IsolatedCommand = "\"%1\" %*" 71249c7234586da21d10b349be6b4044.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000_Classes\systemui\shell\runas\command\IsolatedCommand = "\"%1\" %*" 71249c7234586da21d10b349be6b4044.exe Key created \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000_Classes\.exe\shell\open 71249c7234586da21d10b349be6b4044.exe Key created \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000_Classes\systemui\DefaultIcon 71249c7234586da21d10b349be6b4044.exe Key created \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000_Classes\systemui\shell 71249c7234586da21d10b349be6b4044.exe Key created \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000_Classes\.exe\shell\open\command 71249c7234586da21d10b349be6b4044.exe Key created \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000_Classes\Local Settings 71249c7234586da21d10b349be6b4044.exe Key created \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000_Classes\systemui\shell\runas\command 71249c7234586da21d10b349be6b4044.exe Key created \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000_Classes\systemui\shell\runas 71249c7234586da21d10b349be6b4044.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000_Classes\.exe\DefaultIcon\ = "%1" 71249c7234586da21d10b349be6b4044.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000_Classes\.exe\shell\open\command\IsolatedCommand = "\"%1\" %*" 71249c7234586da21d10b349be6b4044.exe Key created \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000_Classes\.exe\shell\runas 71249c7234586da21d10b349be6b4044.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 956 dwmsys.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 680 wrote to memory of 956 680 71249c7234586da21d10b349be6b4044.exe 84 PID 680 wrote to memory of 956 680 71249c7234586da21d10b349be6b4044.exe 84 PID 680 wrote to memory of 956 680 71249c7234586da21d10b349be6b4044.exe 84 PID 956 wrote to memory of 2112 956 dwmsys.exe 85 PID 956 wrote to memory of 2112 956 dwmsys.exe 85 PID 956 wrote to memory of 2112 956 dwmsys.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\71249c7234586da21d10b349be6b4044.exe"C:\Users\Admin\AppData\Local\Temp\71249c7234586da21d10b349be6b4044.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:680 -
C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_amd64\dwmsys.exe"C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_amd64\dwmsys.exe" /START "C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_amd64\dwmsys.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:956 -
C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_amd64\dwmsys.exe"C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_amd64\dwmsys.exe"3⤵
- Executes dropped EXE
PID:2112
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
327KB
MD59ff6989d5fb15c0b5d9517a328b871e8
SHA1304b05f5f75e4f2a7c67741becfa1199c315b7be
SHA256697167aa46b4b5cb0e73e7aacbe22d78df1b0417869adac1611094e61b3483d1
SHA512e07e42531fc82b1caaba5cd21a8f7653db284059cd9ff8c4523616d774abea681838225a73fb2040e6abe201b9db820fdfe67b70ef28ec60f63d5933a8e1edaf