Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
05/03/2024, 08:05
Static task
static1
Behavioral task
behavioral1
Sample
b4367c1e20abec503e3e029349219ff1.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
b4367c1e20abec503e3e029349219ff1.exe
Resource
win10v2004-20240226-en
General
-
Target
b4367c1e20abec503e3e029349219ff1.exe
-
Size
196KB
-
MD5
b4367c1e20abec503e3e029349219ff1
-
SHA1
dc405b55fbe5244b78e3510a49366502d3f4c640
-
SHA256
09a11b820f5e99d2d3e6341a175b193735a5f2a24ded2c5c4c5e883b68a7fbfd
-
SHA512
092ce38e30588e32fcbceddb2b37eec639a75d3665d65ee9413b6ae471a02f735063ccec7b49cec3945e0d0f13953fda715295cfee3e569d92bac242490b3d58
-
SSDEEP
1536:DL1blQbEYPHbAQ69ECYUSvQktGj2Dee4d6Iis4MmDm2xB/Sbigu4gjLKCS7+t:CQ6DS/peMmnu5u4gjqQ
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "3" svchost.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" svchost.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UACDisableNotify = "1" svchost.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation b4367c1e20abec503e3e029349219ff1.exe -
Executes dropped EXE 1 IoCs
pid Process 696 winlogon.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NVIDIA Media Center Library = "C:\\Users\\Admin\\Admin1\\winlogon.exe" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NVIDIA Media Center Library = "C:\\Users\\Admin\\Admin1\\winlogon.exe" svchost.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 696 set thread context of 2272 696 winlogon.exe 93 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Software\Microsoft\Internet Explorer\Main svchost.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Local Page = "http://9-8-9-z-w-f-9-a-l-3-o-e-8-s-.a-l-v-d-z-o0-n-x-6-v-0-q-q-m-7-g-d-z-7-7-o-b-m-7-z-4-a-q-0.info" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Search Page = "http://k-5-e-7-h-2-3-4-r-3-k-q-6-9-2-4-7-r-m-q-m-e-9-4-m-6-1-n-.u-l-c-6-e-p-a-a-0-z-m-s-m-00-v-2-i-7-5-f-l-7-7-l-t-j-h-h-9.info" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Default_Search_URL = "http://k-6-7-8-l-z-j-5-w-l-w-3-r-7-o-.u-l-c-6-e-p-a-a-0-z-m-s-m-00-v-2-i-7-5-f-l-7-7-l-t-j-h-h-9.info" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Default_Search_URL = "http://9-r-c-l-p-7-9-c-7-d-q-z-l-1-4-k-0-t-i-f-5-3-c-l-h-1-e-.j-z-0-3-0-u-u-x-f-1l-3-l-h-w-b-q-z-u-5-n-l-l-m-s-5-v-s-z-g.info" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Default_Page_URL = "http://h-3-6-7-l-5-g-7-k-e-y-a-2-9-2-1-5-1-4-9-.u-l-c-6-e-p-a-a-0-z-m-s-m-00-v-2-i-7-5-f-l-7-7-l-t-j-h-h-9.info" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Local Page = "http://4-6-q-u-d-g-l-6-e-3-3-0-3-n-5-w-u-q-r-s-4-s-6-n-.5-b-e-n-t-f-p-p-7-1-1-0-7-c-q-0-3-00-6-u-7-t-1-n-y-q-u-f-u.info" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Search Page = "http://m-7-0-0-2-9-l-6-o-z-j-r-5-t-s-i-5-.j-z-0-3-0-u-u-x-f-1l-3-l-h-w-b-q-z-u-5-n-l-l-m-s-5-v-s-z-g.info" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Default_Page_URL = "http://8-h-q-1-7-3-7-f-6-3-2-i-d-j-9-2-0-l-a-8-2-9-8-5-4-1-z-c-p-.a-l-v-d-z-o0-n-x-6-v-0-q-q-m-7-g-d-z-7-7-o-b-m-7-z-4-a-q-0.info" svchost.exe -
Modifies Internet Explorer start page 1 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://f-.5-b-e-n-t-f-p-p-7-1-1-0-7-c-q-0-3-00-6-u-7-t-1-n-y-q-u-f-u.info" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Start Page = "http://4-7-m-3-3-9-k-2-1-l-8-b-a-5-2-a-b-t-u-h-p-s-5-8-p-1-2-6-.a-l-v-d-z-o0-n-x-6-v-0-q-q-m-7-g-d-z-7-7-o-b-m-7-z-4-a-q-0.info" svchost.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeBackupPrivilege 2272 svchost.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 5028 b4367c1e20abec503e3e029349219ff1.exe 696 winlogon.exe 2272 svchost.exe 2272 svchost.exe 2272 svchost.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 5028 wrote to memory of 696 5028 b4367c1e20abec503e3e029349219ff1.exe 92 PID 5028 wrote to memory of 696 5028 b4367c1e20abec503e3e029349219ff1.exe 92 PID 5028 wrote to memory of 696 5028 b4367c1e20abec503e3e029349219ff1.exe 92 PID 696 wrote to memory of 2272 696 winlogon.exe 93 PID 696 wrote to memory of 2272 696 winlogon.exe 93 PID 696 wrote to memory of 2272 696 winlogon.exe 93 PID 696 wrote to memory of 2272 696 winlogon.exe 93 PID 696 wrote to memory of 2272 696 winlogon.exe 93 PID 696 wrote to memory of 2272 696 winlogon.exe 93 PID 696 wrote to memory of 2272 696 winlogon.exe 93 PID 696 wrote to memory of 2272 696 winlogon.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\b4367c1e20abec503e3e029349219ff1.exe"C:\Users\Admin\AppData\Local\Temp\b4367c1e20abec503e3e029349219ff1.exe"1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5028 -
C:\Users\Admin\Admin1\winlogon.exe"C:\Users\Admin\Admin1\winlogon.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:696 -
C:\Windows\SysWOW64\svchost.exe03⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Windows security bypass
- Adds Run key to start application
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2272
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
196KB
MD5b4367c1e20abec503e3e029349219ff1
SHA1dc405b55fbe5244b78e3510a49366502d3f4c640
SHA25609a11b820f5e99d2d3e6341a175b193735a5f2a24ded2c5c4c5e883b68a7fbfd
SHA512092ce38e30588e32fcbceddb2b37eec639a75d3665d65ee9413b6ae471a02f735063ccec7b49cec3945e0d0f13953fda715295cfee3e569d92bac242490b3d58