Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
05/03/2024, 06:26
Static task
static1
Behavioral task
behavioral1
Sample
b40399f6290ec009081bd86071c93a7a.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
b40399f6290ec009081bd86071c93a7a.exe
Resource
win10v2004-20240226-en
General
-
Target
b40399f6290ec009081bd86071c93a7a.exe
-
Size
451KB
-
MD5
b40399f6290ec009081bd86071c93a7a
-
SHA1
2e8968a738d40853ce96a7a98f001d9bc5a507b2
-
SHA256
1eb53c2e287c6d193b6842b689437219dc5907bd779be2ce3c1f957e0ced7766
-
SHA512
420e1d2794ffb8494b2cf2dad149b33948bf08b52ff09512f3e5c56dd05b4d2f79e56cbc72a2e4c574552c9c06b8363c64bae9b404fb5093115ce10a23643d9b
-
SSDEEP
6144:jP43u29BthZ7L6CqHx8A5aIJCxpmHZR1NAksNBfkvmYwU1dQGw2pCFdimAeqmwr:rE9vX88A5aI3HZ99sXMuYtv7pD3
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2352 dL06501LmFdF06501.exe -
Executes dropped EXE 1 IoCs
pid Process 2352 dL06501LmFdF06501.exe -
resource yara_rule behavioral2/memory/1464-1-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/1464-14-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/2352-24-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/2352-32-0x0000000000400000-0x00000000004C2000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\dL06501LmFdF06501 = "C:\\ProgramData\\dL06501LmFdF06501\\dL06501LmFdF06501.exe" dL06501LmFdF06501.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1464 b40399f6290ec009081bd86071c93a7a.exe 1464 b40399f6290ec009081bd86071c93a7a.exe 2352 dL06501LmFdF06501.exe 2352 dL06501LmFdF06501.exe 2352 dL06501LmFdF06501.exe 2352 dL06501LmFdF06501.exe 2352 dL06501LmFdF06501.exe 2352 dL06501LmFdF06501.exe 2352 dL06501LmFdF06501.exe 2352 dL06501LmFdF06501.exe 2352 dL06501LmFdF06501.exe 2352 dL06501LmFdF06501.exe 2352 dL06501LmFdF06501.exe 2352 dL06501LmFdF06501.exe 2352 dL06501LmFdF06501.exe 2352 dL06501LmFdF06501.exe 2352 dL06501LmFdF06501.exe 2352 dL06501LmFdF06501.exe 2352 dL06501LmFdF06501.exe 2352 dL06501LmFdF06501.exe 2352 dL06501LmFdF06501.exe 2352 dL06501LmFdF06501.exe 2352 dL06501LmFdF06501.exe 2352 dL06501LmFdF06501.exe 2352 dL06501LmFdF06501.exe 2352 dL06501LmFdF06501.exe 2352 dL06501LmFdF06501.exe 2352 dL06501LmFdF06501.exe 2352 dL06501LmFdF06501.exe 2352 dL06501LmFdF06501.exe 2352 dL06501LmFdF06501.exe 2352 dL06501LmFdF06501.exe 2352 dL06501LmFdF06501.exe 2352 dL06501LmFdF06501.exe 2352 dL06501LmFdF06501.exe 2352 dL06501LmFdF06501.exe 2352 dL06501LmFdF06501.exe 2352 dL06501LmFdF06501.exe 2352 dL06501LmFdF06501.exe 2352 dL06501LmFdF06501.exe 2352 dL06501LmFdF06501.exe 2352 dL06501LmFdF06501.exe 2352 dL06501LmFdF06501.exe 2352 dL06501LmFdF06501.exe 2352 dL06501LmFdF06501.exe 2352 dL06501LmFdF06501.exe 2352 dL06501LmFdF06501.exe 2352 dL06501LmFdF06501.exe 2352 dL06501LmFdF06501.exe 2352 dL06501LmFdF06501.exe 2352 dL06501LmFdF06501.exe 2352 dL06501LmFdF06501.exe 2352 dL06501LmFdF06501.exe 2352 dL06501LmFdF06501.exe 2352 dL06501LmFdF06501.exe 2352 dL06501LmFdF06501.exe 2352 dL06501LmFdF06501.exe 2352 dL06501LmFdF06501.exe 2352 dL06501LmFdF06501.exe 2352 dL06501LmFdF06501.exe 2352 dL06501LmFdF06501.exe 2352 dL06501LmFdF06501.exe 2352 dL06501LmFdF06501.exe 2352 dL06501LmFdF06501.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1464 b40399f6290ec009081bd86071c93a7a.exe Token: SeDebugPrivilege 2352 dL06501LmFdF06501.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2352 dL06501LmFdF06501.exe 2352 dL06501LmFdF06501.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 2352 dL06501LmFdF06501.exe 2352 dL06501LmFdF06501.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2352 dL06501LmFdF06501.exe 2352 dL06501LmFdF06501.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1464 wrote to memory of 2352 1464 b40399f6290ec009081bd86071c93a7a.exe 91 PID 1464 wrote to memory of 2352 1464 b40399f6290ec009081bd86071c93a7a.exe 91 PID 1464 wrote to memory of 2352 1464 b40399f6290ec009081bd86071c93a7a.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\b40399f6290ec009081bd86071c93a7a.exe"C:\Users\Admin\AppData\Local\Temp\b40399f6290ec009081bd86071c93a7a.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1464 -
C:\ProgramData\dL06501LmFdF06501\dL06501LmFdF06501.exe"C:\ProgramData\dL06501LmFdF06501\dL06501LmFdF06501.exe" "C:\Users\Admin\AppData\Local\Temp\b40399f6290ec009081bd86071c93a7a.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2352
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
451KB
MD59815a758000f8ded849e1f9fb64beddf
SHA16d1a25572f64bc77dde8b0186e5083b170f042df
SHA256355e36fa4322e9fbc6a0623a971a89cf7c7dc53313833a4b9e7e1f71faa364a8
SHA51273359d3de417e87b2168ed682b3df3a2756fcf359a5b6c97c6376408139ed87c7538726a31fc7c8761e60e5b5dab53eccb7ebf017db8e4516fca12b646f248fd