Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
117s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
04/03/2024, 14:15
Static task
static1
Behavioral task
behavioral1
Sample
b255bfb165207c91bc333eadf7dc5191.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
b255bfb165207c91bc333eadf7dc5191.exe
Resource
win10v2004-20240226-en
General
-
Target
b255bfb165207c91bc333eadf7dc5191.exe
-
Size
42KB
-
MD5
b255bfb165207c91bc333eadf7dc5191
-
SHA1
4c6310f0bb5b361e02f74ed4d97d34cea1f9f6d7
-
SHA256
81f8cf0d14c183be6928e42e7ec558fb39bd592b300890037c8ca19c183b5b8e
-
SHA512
03cbdeb88ec5c77d5d03f24666dd63880d80dc7d9255d74d35b272498effcfa5e995ed1166d823bfb4170747e766fe069e8038e03d34c29e961e6e7821ee1575
-
SSDEEP
768:pGkEywiIYBAnUtj5erD6r5KVApvtC0hQlaOOIbA3xg4o+TM:tExfYBAnkIDEj1tCEQEOOIbD4o+TM
Malware Config
Signatures
-
Loads dropped DLL 2 IoCs
pid Process 1264 b255bfb165207c91bc333eadf7dc5191.exe 216 rundll32.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MSServer = "rundll32.exe C:\\Windows\\system32\\wvUkICtr.dll,#1" rundll32.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\rqRKAQIc.dll b255bfb165207c91bc333eadf7dc5191.exe File created C:\Windows\SysWOW64\rqRKAQIc.dll b255bfb165207c91bc333eadf7dc5191.exe File created C:\Windows\SysWOW64\wvUkICtr.dll b255bfb165207c91bc333eadf7dc5191.exe File opened for modification C:\Windows\SysWOW64\wvUkICtr.dll b255bfb165207c91bc333eadf7dc5191.exe -
Modifies registry class 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9DE6E729-3CBD-42A2-AE52-C99609B230D4}\InprocServer32\ThreadingModel = "Both" rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9DE6E729-3CBD-42A2-AE52-C99609B230D4} rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9DE6E729-3CBD-42A2-AE52-C99609B230D4}\InprocServer32 rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9DE6E729-3CBD-42A2-AE52-C99609B230D4}\InprocServer32\ = "C:\\Windows\\SysWow64\\wvUkICtr.dll" rundll32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1264 b255bfb165207c91bc333eadf7dc5191.exe 1264 b255bfb165207c91bc333eadf7dc5191.exe 216 rundll32.exe 216 rundll32.exe 216 rundll32.exe 216 rundll32.exe 216 rundll32.exe 216 rundll32.exe 216 rundll32.exe 216 rundll32.exe 216 rundll32.exe 216 rundll32.exe 216 rundll32.exe 216 rundll32.exe 216 rundll32.exe 216 rundll32.exe 216 rundll32.exe 216 rundll32.exe 216 rundll32.exe 216 rundll32.exe 216 rundll32.exe 216 rundll32.exe 216 rundll32.exe 216 rundll32.exe 216 rundll32.exe 216 rundll32.exe 216 rundll32.exe 216 rundll32.exe 216 rundll32.exe 216 rundll32.exe 216 rundll32.exe 216 rundll32.exe 216 rundll32.exe 216 rundll32.exe 216 rundll32.exe 216 rundll32.exe 216 rundll32.exe 216 rundll32.exe 216 rundll32.exe 216 rundll32.exe 216 rundll32.exe 216 rundll32.exe 216 rundll32.exe 216 rundll32.exe 216 rundll32.exe 216 rundll32.exe 216 rundll32.exe 216 rundll32.exe 216 rundll32.exe 216 rundll32.exe 216 rundll32.exe 216 rundll32.exe 216 rundll32.exe 216 rundll32.exe 216 rundll32.exe 216 rundll32.exe 216 rundll32.exe 216 rundll32.exe 216 rundll32.exe 216 rundll32.exe 216 rundll32.exe 216 rundll32.exe 216 rundll32.exe 216 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1264 b255bfb165207c91bc333eadf7dc5191.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1264 b255bfb165207c91bc333eadf7dc5191.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1264 wrote to memory of 612 1264 b255bfb165207c91bc333eadf7dc5191.exe 5 PID 1264 wrote to memory of 216 1264 b255bfb165207c91bc333eadf7dc5191.exe 94 PID 1264 wrote to memory of 216 1264 b255bfb165207c91bc333eadf7dc5191.exe 94 PID 1264 wrote to memory of 216 1264 b255bfb165207c91bc333eadf7dc5191.exe 94 PID 1264 wrote to memory of 5600 1264 b255bfb165207c91bc333eadf7dc5191.exe 95 PID 1264 wrote to memory of 5600 1264 b255bfb165207c91bc333eadf7dc5191.exe 95 PID 1264 wrote to memory of 5600 1264 b255bfb165207c91bc333eadf7dc5191.exe 95
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:612
-
C:\Users\Admin\AppData\Local\Temp\b255bfb165207c91bc333eadf7dc5191.exe"C:\Users\Admin\AppData\Local\Temp\b255bfb165207c91bc333eadf7dc5191.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Windows\system32\wvUkICtr.dll,a2⤵
- Loads dropped DLL
- Adds Run key to start application
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:216
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\removalfile.bat "C:\Users\Admin\AppData\Local\Temp\b255bfb165207c91bc333eadf7dc5191.exe"2⤵PID:5600
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
43B
MD59a7ef09167a6f4433681b94351509043
SHA1259b1375ed8e84943ca1d42646bb416325c89e12
SHA256d5739a0510d89da572eb0b0d394d4fb4dd361cd9ee0144b9b31c590df93c3be7
SHA51296b84cd88a0e4b7c1122af3ed6ce5edf0a9a4e9bf79575eadfac16b2c46f1278d57755d29f21d7c6dcb4403be24b7ac7da4837c6cc9c602342a8f2b8e54883df
-
Filesize
32KB
MD56c4faf2bee227999271ce23f74797b93
SHA1e66aaadfa53ac8dd8646475e4e94a39a44b756b6
SHA256471190ab85cc3ed0694758a972c54c8795429bc00a25cbe29f64296c2e4ce18d
SHA512baecb0a57a14918ca50126d29077916ec77602d47a85c41dedfc5796e645d03b97145c24dc523940b8de18fb1bb9ece1dabfe5c57a3a12741919d8151cfdfab8