Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
28/02/2024, 19:31
Static task
static1
Behavioral task
behavioral1
Sample
acabed941479768651f6fe6a9fac201c.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
acabed941479768651f6fe6a9fac201c.exe
Resource
win10v2004-20240226-en
General
-
Target
acabed941479768651f6fe6a9fac201c.exe
-
Size
458KB
-
MD5
acabed941479768651f6fe6a9fac201c
-
SHA1
3da8663a6aa45480d86ff451634a00d5aed76917
-
SHA256
a3d86c5177e6aca6bdb99b52c0e0424645a362ccd31c4c1698581cfc4fc41160
-
SHA512
68e15101718478e7be568b33c23bcbe5dc6319ffc21dc1256e089ad8023c93f33515ac4570d0338c177fccd5c6d666a5ce496cc677b571c7dd313ffdeda76f78
-
SSDEEP
6144:2YWGHdSkJdlTQm2PdLFeV4H3T9rOOQM48rA8H74rHYaWqiqTAFVDsCXvxUt:pIyqm+lFtH3BzlA+KUq0LDsavat
Malware Config
Signatures
-
Disables Task Manager via registry modification
-
Executes dropped EXE 1 IoCs
pid Process 1284 BgBkaFsuthfOK.exe -
Loads dropped DLL 2 IoCs
pid Process 2220 acabed941479768651f6fe6a9fac201c.exe 2220 acabed941479768651f6fe6a9fac201c.exe -
resource yara_rule behavioral1/memory/2220-1-0x0000000000600000-0x0000000000680000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\BgBkaFsuthfOK = "C:\\ProgramData\\BgBkaFsuthfOK.exe" acabed941479768651f6fe6a9fac201c.exe -
Maps connected drives based on registry 3 TTPs 4 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum acabed941479768651f6fe6a9fac201c.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 acabed941479768651f6fe6a9fac201c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum BgBkaFsuthfOK.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 BgBkaFsuthfOK.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Download acabed941479768651f6fe6a9fac201c.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Download\CheckExeSignatures = "no" acabed941479768651f6fe6a9fac201c.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2220 acabed941479768651f6fe6a9fac201c.exe 2220 acabed941479768651f6fe6a9fac201c.exe 2220 acabed941479768651f6fe6a9fac201c.exe 1284 BgBkaFsuthfOK.exe 2220 acabed941479768651f6fe6a9fac201c.exe 1284 BgBkaFsuthfOK.exe 2220 acabed941479768651f6fe6a9fac201c.exe 1284 BgBkaFsuthfOK.exe 2220 acabed941479768651f6fe6a9fac201c.exe 1284 BgBkaFsuthfOK.exe 1284 BgBkaFsuthfOK.exe 1284 BgBkaFsuthfOK.exe 1284 BgBkaFsuthfOK.exe 1284 BgBkaFsuthfOK.exe 1284 BgBkaFsuthfOK.exe 1284 BgBkaFsuthfOK.exe 1284 BgBkaFsuthfOK.exe 1284 BgBkaFsuthfOK.exe 1284 BgBkaFsuthfOK.exe 1284 BgBkaFsuthfOK.exe 1284 BgBkaFsuthfOK.exe 1284 BgBkaFsuthfOK.exe 1284 BgBkaFsuthfOK.exe 1284 BgBkaFsuthfOK.exe 1284 BgBkaFsuthfOK.exe 1284 BgBkaFsuthfOK.exe 1284 BgBkaFsuthfOK.exe 1284 BgBkaFsuthfOK.exe 1284 BgBkaFsuthfOK.exe 1284 BgBkaFsuthfOK.exe 1284 BgBkaFsuthfOK.exe 1284 BgBkaFsuthfOK.exe 1284 BgBkaFsuthfOK.exe 1284 BgBkaFsuthfOK.exe 1284 BgBkaFsuthfOK.exe 1284 BgBkaFsuthfOK.exe 1284 BgBkaFsuthfOK.exe 1284 BgBkaFsuthfOK.exe 1284 BgBkaFsuthfOK.exe 1284 BgBkaFsuthfOK.exe 1284 BgBkaFsuthfOK.exe 1284 BgBkaFsuthfOK.exe 1284 BgBkaFsuthfOK.exe 1284 BgBkaFsuthfOK.exe 1284 BgBkaFsuthfOK.exe 1284 BgBkaFsuthfOK.exe 1284 BgBkaFsuthfOK.exe 1284 BgBkaFsuthfOK.exe 1284 BgBkaFsuthfOK.exe 1284 BgBkaFsuthfOK.exe 1284 BgBkaFsuthfOK.exe 1284 BgBkaFsuthfOK.exe 1284 BgBkaFsuthfOK.exe 1284 BgBkaFsuthfOK.exe 1284 BgBkaFsuthfOK.exe 1284 BgBkaFsuthfOK.exe 1284 BgBkaFsuthfOK.exe 1284 BgBkaFsuthfOK.exe 1284 BgBkaFsuthfOK.exe 1284 BgBkaFsuthfOK.exe 1284 BgBkaFsuthfOK.exe 1284 BgBkaFsuthfOK.exe 1284 BgBkaFsuthfOK.exe 1284 BgBkaFsuthfOK.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2220 acabed941479768651f6fe6a9fac201c.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2220 wrote to memory of 1284 2220 acabed941479768651f6fe6a9fac201c.exe 28 PID 2220 wrote to memory of 1284 2220 acabed941479768651f6fe6a9fac201c.exe 28 PID 2220 wrote to memory of 1284 2220 acabed941479768651f6fe6a9fac201c.exe 28 PID 2220 wrote to memory of 1284 2220 acabed941479768651f6fe6a9fac201c.exe 28 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System acabed941479768651f6fe6a9fac201c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1" acabed941479768651f6fe6a9fac201c.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\acabed941479768651f6fe6a9fac201c.exe"C:\Users\Admin\AppData\Local\Temp\acabed941479768651f6fe6a9fac201c.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Maps connected drives based on registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2220 -
C:\ProgramData\BgBkaFsuthfOK.exe"C:\ProgramData\BgBkaFsuthfOK.exe"2⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
PID:1284
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
458KB
MD5acabed941479768651f6fe6a9fac201c
SHA13da8663a6aa45480d86ff451634a00d5aed76917
SHA256a3d86c5177e6aca6bdb99b52c0e0424645a362ccd31c4c1698581cfc4fc41160
SHA51268e15101718478e7be568b33c23bcbe5dc6319ffc21dc1256e089ad8023c93f33515ac4570d0338c177fccd5c6d666a5ce496cc677b571c7dd313ffdeda76f78