Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
05/03/2024, 09:13
Static task
static1
Behavioral task
behavioral1
Sample
b455e96c363ef74667a35263e1fdfa90.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
b455e96c363ef74667a35263e1fdfa90.exe
Resource
win10v2004-20240226-en
General
-
Target
b455e96c363ef74667a35263e1fdfa90.exe
-
Size
82KB
-
MD5
b455e96c363ef74667a35263e1fdfa90
-
SHA1
bc36f6f034bbc50c9c119ff2de938c1a98d4bebc
-
SHA256
1815df2402a9fd0388c8e6f633d50f05ae0614337311c3d7d6a4bf052e903adc
-
SHA512
7b38a07d79be0e1fe3790de419c9aa0de7dc93d394281351b898f99f65cb46556f01bb196de22344111b0b9ee5a873bd422a6a0a8da3d96bda89b625f991f93f
-
SSDEEP
768:cvQ5qDLHRdw2iPSMEk/6KMvu571xuEMs96cyX1869bYpYyTSY/YjvK0fdeeeD11y:cvQoLHjw2iWPKMvw71sMLyXuHr0Veee2
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation b455e96c363ef74667a35263e1fdfa90.exe -
Executes dropped EXE 1 IoCs
pid Process 2120 vewhost.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Debug\vewhost.exe b455e96c363ef74667a35263e1fdfa90.exe File opened for modification C:\Windows\Debug\vewhost.exe b455e96c363ef74667a35263e1fdfa90.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2408 b455e96c363ef74667a35263e1fdfa90.exe Token: SeManageVolumePrivilege 5076 svchost.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2408 wrote to memory of 3448 2408 b455e96c363ef74667a35263e1fdfa90.exe 92 PID 2408 wrote to memory of 3448 2408 b455e96c363ef74667a35263e1fdfa90.exe 92 PID 2408 wrote to memory of 3448 2408 b455e96c363ef74667a35263e1fdfa90.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\b455e96c363ef74667a35263e1fdfa90.exe"C:\Users\Admin\AppData\Local\Temp\b455e96c363ef74667a35263e1fdfa90.exe"1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\B455E9~1.EXE > nul2⤵PID:3448
-
-
C:\Windows\Debug\vewhost.exeC:\Windows\Debug\vewhost.exe1⤵
- Executes dropped EXE
PID:2120
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵PID:3924
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5076
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
82KB
MD5f2b60fb36ae6fc8bfecc6fd9248e203f
SHA1fbe5d0691007643ced8a4b2e5263731cee96cde1
SHA256b3f14a8e33d44c37ae880760362896b3bad3b5ca7a17aa59eaf8070e54d4bbbd
SHA512ee10aed18fcb89144b8e1734a2234e2359154d0d30278f3dd28da33d0480f646747998560465052e56bcbf5e0eac019e06661f7fa82fbaeef0a623e2a5abe644