Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
05/03/2024, 14:46
Behavioral task
behavioral1
Sample
b4f52848c48aea663e5344e33a1b087a.exe
Resource
win7-20240221-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
b4f52848c48aea663e5344e33a1b087a.exe
Resource
win10v2004-20240226-en
8 signatures
150 seconds
General
-
Target
b4f52848c48aea663e5344e33a1b087a.exe
-
Size
609KB
-
MD5
b4f52848c48aea663e5344e33a1b087a
-
SHA1
952e076be5498fcbb41123070c5a297c329e2395
-
SHA256
25510d20b983dbfc0443684dd1674192cb32b9ab06a2ab9e67e2db6f99ead154
-
SHA512
5e78c19e2084ae3c9f90be86e4458ded13cea66f2185bc26637a2b00f8ff57d5d1da09ed99f47b981e59815ef63ee7d10ffb506157b178e95fa56356e8dc997e
-
SSDEEP
12288:BLcKp2Adls/rnjs7RLKslAmJSv4KMwUU9d8Kb6a:CK2GsD4RLTlzJSv4sGKGa
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit = "C:\\Windows\\system32\\sdra64.exe," b4f52848c48aea663e5344e33a1b087a.exe -
resource yara_rule behavioral2/memory/5008-0-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/5008-6-0x0000000000400000-0x0000000000437000-memory.dmp upx -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\sdra64.exe b4f52848c48aea663e5344e33a1b087a.exe File created C:\Windows\SysWOW64\sdra64.exe b4f52848c48aea663e5344e33a1b087a.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 5008 set thread context of 1884 5008 b4f52848c48aea663e5344e33a1b087a.exe 88 -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1884 b4f52848c48aea663e5344e33a1b087a.exe 1884 b4f52848c48aea663e5344e33a1b087a.exe 1884 b4f52848c48aea663e5344e33a1b087a.exe 1884 b4f52848c48aea663e5344e33a1b087a.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1884 b4f52848c48aea663e5344e33a1b087a.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 5008 b4f52848c48aea663e5344e33a1b087a.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5008 wrote to memory of 1884 5008 b4f52848c48aea663e5344e33a1b087a.exe 88 PID 5008 wrote to memory of 1884 5008 b4f52848c48aea663e5344e33a1b087a.exe 88 PID 5008 wrote to memory of 1884 5008 b4f52848c48aea663e5344e33a1b087a.exe 88 PID 5008 wrote to memory of 1884 5008 b4f52848c48aea663e5344e33a1b087a.exe 88 PID 5008 wrote to memory of 1884 5008 b4f52848c48aea663e5344e33a1b087a.exe 88 PID 5008 wrote to memory of 1884 5008 b4f52848c48aea663e5344e33a1b087a.exe 88 PID 5008 wrote to memory of 1884 5008 b4f52848c48aea663e5344e33a1b087a.exe 88 PID 5008 wrote to memory of 1884 5008 b4f52848c48aea663e5344e33a1b087a.exe 88 PID 1884 wrote to memory of 632 1884 b4f52848c48aea663e5344e33a1b087a.exe 5 PID 1884 wrote to memory of 632 1884 b4f52848c48aea663e5344e33a1b087a.exe 5 PID 1884 wrote to memory of 632 1884 b4f52848c48aea663e5344e33a1b087a.exe 5 PID 1884 wrote to memory of 632 1884 b4f52848c48aea663e5344e33a1b087a.exe 5 PID 1884 wrote to memory of 632 1884 b4f52848c48aea663e5344e33a1b087a.exe 5 PID 1884 wrote to memory of 632 1884 b4f52848c48aea663e5344e33a1b087a.exe 5 PID 1884 wrote to memory of 632 1884 b4f52848c48aea663e5344e33a1b087a.exe 5 PID 1884 wrote to memory of 632 1884 b4f52848c48aea663e5344e33a1b087a.exe 5 PID 1884 wrote to memory of 632 1884 b4f52848c48aea663e5344e33a1b087a.exe 5 PID 1884 wrote to memory of 632 1884 b4f52848c48aea663e5344e33a1b087a.exe 5 PID 1884 wrote to memory of 632 1884 b4f52848c48aea663e5344e33a1b087a.exe 5 PID 1884 wrote to memory of 632 1884 b4f52848c48aea663e5344e33a1b087a.exe 5 PID 1884 wrote to memory of 632 1884 b4f52848c48aea663e5344e33a1b087a.exe 5 PID 1884 wrote to memory of 632 1884 b4f52848c48aea663e5344e33a1b087a.exe 5 PID 1884 wrote to memory of 632 1884 b4f52848c48aea663e5344e33a1b087a.exe 5 PID 1884 wrote to memory of 632 1884 b4f52848c48aea663e5344e33a1b087a.exe 5 PID 1884 wrote to memory of 632 1884 b4f52848c48aea663e5344e33a1b087a.exe 5 PID 1884 wrote to memory of 632 1884 b4f52848c48aea663e5344e33a1b087a.exe 5 PID 1884 wrote to memory of 632 1884 b4f52848c48aea663e5344e33a1b087a.exe 5 PID 1884 wrote to memory of 632 1884 b4f52848c48aea663e5344e33a1b087a.exe 5 PID 1884 wrote to memory of 632 1884 b4f52848c48aea663e5344e33a1b087a.exe 5 PID 1884 wrote to memory of 632 1884 b4f52848c48aea663e5344e33a1b087a.exe 5 PID 1884 wrote to memory of 632 1884 b4f52848c48aea663e5344e33a1b087a.exe 5 PID 1884 wrote to memory of 632 1884 b4f52848c48aea663e5344e33a1b087a.exe 5 PID 1884 wrote to memory of 632 1884 b4f52848c48aea663e5344e33a1b087a.exe 5 PID 1884 wrote to memory of 632 1884 b4f52848c48aea663e5344e33a1b087a.exe 5 PID 1884 wrote to memory of 632 1884 b4f52848c48aea663e5344e33a1b087a.exe 5 PID 1884 wrote to memory of 632 1884 b4f52848c48aea663e5344e33a1b087a.exe 5 PID 1884 wrote to memory of 632 1884 b4f52848c48aea663e5344e33a1b087a.exe 5 PID 1884 wrote to memory of 632 1884 b4f52848c48aea663e5344e33a1b087a.exe 5 PID 1884 wrote to memory of 632 1884 b4f52848c48aea663e5344e33a1b087a.exe 5 PID 1884 wrote to memory of 632 1884 b4f52848c48aea663e5344e33a1b087a.exe 5 PID 1884 wrote to memory of 632 1884 b4f52848c48aea663e5344e33a1b087a.exe 5 PID 1884 wrote to memory of 632 1884 b4f52848c48aea663e5344e33a1b087a.exe 5 PID 1884 wrote to memory of 632 1884 b4f52848c48aea663e5344e33a1b087a.exe 5 PID 1884 wrote to memory of 632 1884 b4f52848c48aea663e5344e33a1b087a.exe 5 PID 1884 wrote to memory of 632 1884 b4f52848c48aea663e5344e33a1b087a.exe 5 PID 1884 wrote to memory of 632 1884 b4f52848c48aea663e5344e33a1b087a.exe 5 PID 1884 wrote to memory of 632 1884 b4f52848c48aea663e5344e33a1b087a.exe 5 PID 1884 wrote to memory of 632 1884 b4f52848c48aea663e5344e33a1b087a.exe 5 PID 1884 wrote to memory of 632 1884 b4f52848c48aea663e5344e33a1b087a.exe 5 PID 1884 wrote to memory of 632 1884 b4f52848c48aea663e5344e33a1b087a.exe 5 PID 1884 wrote to memory of 632 1884 b4f52848c48aea663e5344e33a1b087a.exe 5 PID 1884 wrote to memory of 632 1884 b4f52848c48aea663e5344e33a1b087a.exe 5 PID 1884 wrote to memory of 632 1884 b4f52848c48aea663e5344e33a1b087a.exe 5 PID 1884 wrote to memory of 632 1884 b4f52848c48aea663e5344e33a1b087a.exe 5 PID 1884 wrote to memory of 632 1884 b4f52848c48aea663e5344e33a1b087a.exe 5 PID 1884 wrote to memory of 632 1884 b4f52848c48aea663e5344e33a1b087a.exe 5 PID 1884 wrote to memory of 632 1884 b4f52848c48aea663e5344e33a1b087a.exe 5 PID 1884 wrote to memory of 632 1884 b4f52848c48aea663e5344e33a1b087a.exe 5 PID 1884 wrote to memory of 632 1884 b4f52848c48aea663e5344e33a1b087a.exe 5 PID 1884 wrote to memory of 632 1884 b4f52848c48aea663e5344e33a1b087a.exe 5 PID 1884 wrote to memory of 632 1884 b4f52848c48aea663e5344e33a1b087a.exe 5 PID 1884 wrote to memory of 632 1884 b4f52848c48aea663e5344e33a1b087a.exe 5 PID 1884 wrote to memory of 632 1884 b4f52848c48aea663e5344e33a1b087a.exe 5 PID 1884 wrote to memory of 632 1884 b4f52848c48aea663e5344e33a1b087a.exe 5
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:632
-
C:\Users\Admin\AppData\Local\Temp\b4f52848c48aea663e5344e33a1b087a.exe"C:\Users\Admin\AppData\Local\Temp\b4f52848c48aea663e5344e33a1b087a.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\b4f52848c48aea663e5344e33a1b087a.exeC:\Users\Admin\AppData\Local\Temp\b4f52848c48aea663e5344e33a1b087a.exe2⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1884
-