Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
04/03/2024, 14:09
Static task
static1
Behavioral task
behavioral1
Sample
b2537bd00585ae2d60c717c6712be8eb.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
b2537bd00585ae2d60c717c6712be8eb.exe
Resource
win10v2004-20240226-en
General
-
Target
b2537bd00585ae2d60c717c6712be8eb.exe
-
Size
36KB
-
MD5
b2537bd00585ae2d60c717c6712be8eb
-
SHA1
f5e499f7559e59c76e6a83a691b1e65965fb1aa4
-
SHA256
b5efa74506a9cc9aa6f2f7234989edac808ffbcb35eb196815bc88bb1e8c7716
-
SHA512
36d346de5aab25c3c3399dd647527991e01e6bceeb255c4b1f1b38045daa9039033d4e5e034d9d9b33bc70766279bab8f5e5d2b3bc4a1cea78d4b2d2430b09c5
-
SSDEEP
768:WxjWWrXbIDTLPTQGGAnGGXkDGGeGGGGGNGGRHJARGGGGGGGGGGGGGGGGGGGGGGGK:Wxj9bsTPQGGeGGXkDGGeGGGGGNGGRHJm
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = ",C:\\Users\\Admin\\AppData\\Local\\Temp\\init.exe" b2537bd00585ae2d60c717c6712be8eb.exe -
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 1968 netsh.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation b2537bd00585ae2d60c717c6712be8eb.exe -
Executes dropped EXE 1 IoCs
pid Process 1280 init.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
pid Process 3024 PING.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1880 wrote to memory of 1280 1880 b2537bd00585ae2d60c717c6712be8eb.exe 90 PID 1880 wrote to memory of 1280 1880 b2537bd00585ae2d60c717c6712be8eb.exe 90 PID 1880 wrote to memory of 1280 1880 b2537bd00585ae2d60c717c6712be8eb.exe 90 PID 1880 wrote to memory of 4660 1880 b2537bd00585ae2d60c717c6712be8eb.exe 91 PID 1880 wrote to memory of 4660 1880 b2537bd00585ae2d60c717c6712be8eb.exe 91 PID 1880 wrote to memory of 4660 1880 b2537bd00585ae2d60c717c6712be8eb.exe 91 PID 4660 wrote to memory of 3024 4660 cmd.exe 93 PID 4660 wrote to memory of 3024 4660 cmd.exe 93 PID 4660 wrote to memory of 3024 4660 cmd.exe 93 PID 1280 wrote to memory of 1968 1280 init.exe 94 PID 1280 wrote to memory of 1968 1280 init.exe 94 PID 1280 wrote to memory of 1968 1280 init.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\b2537bd00585ae2d60c717c6712be8eb.exe"C:\Users\Admin\AppData\Local\Temp\b2537bd00585ae2d60c717c6712be8eb.exe"1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\Users\Admin\AppData\Local\Temp\init.exe"C:\Users\Admin\AppData\Local\Temp\init.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Windows\SysWOW64\netsh.exenetsh firewall set allowedprogram "C:\Users\Admin\AppData\Local\Temp\init.exe" ENABLE3⤵
- Modifies Windows Firewall
PID:1968
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\99.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\Windows\SysWOW64\PING.EXEping -n 1 0.0.0.03⤵
- Runs ping.exe
PID:3024
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
212B
MD5c605c627b6ffc15f055661b815307035
SHA1e6c42264df0fcc11a4e6d843e86fc8f5f8181356
SHA2568e1218e686e2a5b486a20f0ac6e0f095ff3f0f0c84fc53a90313dc4861e0f944
SHA51281367079398ccd88bb84e30b1bba064e67859f271ae0237a649a0cfed4923d81dec039d2e6699182bddd2bd82afc7ccb643c7cadac8ebd3cbb55fd0cbb45a95f
-
Filesize
36KB
MD5b2537bd00585ae2d60c717c6712be8eb
SHA1f5e499f7559e59c76e6a83a691b1e65965fb1aa4
SHA256b5efa74506a9cc9aa6f2f7234989edac808ffbcb35eb196815bc88bb1e8c7716
SHA51236d346de5aab25c3c3399dd647527991e01e6bceeb255c4b1f1b38045daa9039033d4e5e034d9d9b33bc70766279bab8f5e5d2b3bc4a1cea78d4b2d2430b09c5