Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
06/03/2024, 01:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b6268d11a8352702f4d032c379932907.exe
Resource
win7-20240220-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
b6268d11a8352702f4d032c379932907.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
14 signatures
150 seconds
General
-
Target
b6268d11a8352702f4d032c379932907.exe
-
Size
645KB
-
MD5
b6268d11a8352702f4d032c379932907
-
SHA1
99e1fd77dc77bbe2cd36394b47eff6c5300dc233
-
SHA256
b0368cae653f4d839e417afb7875e71a54324806382951f44c9e19598ebc3e27
-
SHA512
6613eb0dc1229bbfa2ba7fc87fcf70e4108d8f5f3ab2b9db443fe59054209de94e77d5058062aedf0afa85c27442de043cf17afb5018bff32543adc3f1fe3267
-
SSDEEP
12288:9lQwbcauT1dH2kCuPsTZXHyyf1/pqsVKLqdz4keFyLP5:9QauTTzPs1yzsEjwLP5
Score
10/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation b6268d11a8352702f4d032c379932907.exe Key value queried \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation b6268d11a8352702f4d032c379932907.exe -
Executes dropped EXE 1 IoCs
pid Process 112 b6268d11a8352702f4d032c379932907.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Office = "\\Microsoft Office Collection\\office365.exe" b6268d11a8352702f4d032c379932907.exe Set value (str) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Office = "C:\\Users\\Admin\\AppData\\Local\\Microsoft Office Collection\\office365.exe" b6268d11a8352702f4d032c379932907.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName Taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 Taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A Taskmgr.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 4120 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 112 b6268d11a8352702f4d032c379932907.exe 112 b6268d11a8352702f4d032c379932907.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 112 b6268d11a8352702f4d032c379932907.exe 3636 Taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 4820 b6268d11a8352702f4d032c379932907.exe Token: SeDebugPrivilege 112 b6268d11a8352702f4d032c379932907.exe Token: SeDebugPrivilege 3636 Taskmgr.exe Token: SeSystemProfilePrivilege 3636 Taskmgr.exe Token: SeCreateGlobalPrivilege 3636 Taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe 3636 Taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 112 b6268d11a8352702f4d032c379932907.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 4820 wrote to memory of 112 4820 b6268d11a8352702f4d032c379932907.exe 91 PID 4820 wrote to memory of 112 4820 b6268d11a8352702f4d032c379932907.exe 91 PID 4820 wrote to memory of 112 4820 b6268d11a8352702f4d032c379932907.exe 91 PID 4820 wrote to memory of 2700 4820 b6268d11a8352702f4d032c379932907.exe 92 PID 4820 wrote to memory of 2700 4820 b6268d11a8352702f4d032c379932907.exe 92 PID 4820 wrote to memory of 2700 4820 b6268d11a8352702f4d032c379932907.exe 92 PID 2700 wrote to memory of 4120 2700 cmd.exe 94 PID 2700 wrote to memory of 4120 2700 cmd.exe 94 PID 2700 wrote to memory of 4120 2700 cmd.exe 94 PID 112 wrote to memory of 3636 112 b6268d11a8352702f4d032c379932907.exe 95 PID 112 wrote to memory of 3636 112 b6268d11a8352702f4d032c379932907.exe 95 PID 112 wrote to memory of 3636 112 b6268d11a8352702f4d032c379932907.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\b6268d11a8352702f4d032c379932907.exe"C:\Users\Admin\AppData\Local\Temp\b6268d11a8352702f4d032c379932907.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\b6268d11a8352702f4d032c379932907\b6268d11a8352702f4d032c379932907.exe"C:\Users\Admin\AppData\Local\Temp\b6268d11a8352702f4d032c379932907\b6268d11a8352702f4d032c379932907.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:112 -
C:\Windows\SysWOW64\Taskmgr.exe"C:\Windows\System32\Taskmgr.exe"3⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3636
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 1000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\b6268d11a8352702f4d032c379932907.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 10003⤵
- Runs ping.exe
PID:4120
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\b6268d11a8352702f4d032c379932907\b6268d11a8352702f4d032c379932907.exe
Filesize645KB
MD5b6268d11a8352702f4d032c379932907
SHA199e1fd77dc77bbe2cd36394b47eff6c5300dc233
SHA256b0368cae653f4d839e417afb7875e71a54324806382951f44c9e19598ebc3e27
SHA5126613eb0dc1229bbfa2ba7fc87fcf70e4108d8f5f3ab2b9db443fe59054209de94e77d5058062aedf0afa85c27442de043cf17afb5018bff32543adc3f1fe3267
-
Filesize
70B
MD58efaf0f5e37779d7e6bc815e51fd10a7
SHA1725071d4f33ec443738395a5d7b651711424df05
SHA25617b71f1c104f2d0830d27d0f8b502f39a319c95f303b6e23d6c3b9f364ae2413
SHA512200e2ebd49706df349c1e47abe0724f258c114586acb4f30e3fe5dde8aa5d7e3040cae0359262439d2566292794386cd463feb02dc2c81b6c74675cd8b738548