Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
07/03/2024, 23:23
Static task
static1
Behavioral task
behavioral1
Sample
b9ec5d1263ce730e0be1e8cf64c58cf4.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
b9ec5d1263ce730e0be1e8cf64c58cf4.exe
Resource
win10v2004-20240226-en
General
-
Target
b9ec5d1263ce730e0be1e8cf64c58cf4.exe
-
Size
1011KB
-
MD5
b9ec5d1263ce730e0be1e8cf64c58cf4
-
SHA1
d30aab11a419fc105a15b9505dbeaa931d19c735
-
SHA256
d481aeca84f16a3284d4de9af3625eb21024f48298538e03b3ec0921f2831046
-
SHA512
60782d9b3a69403c909e851b353ba93a737a0ea9a17c0b96a472c262a31ef20a37fe5437906396674a8dba0597dac64575d82b03d9361a25714fc4aaff9636b0
-
SSDEEP
24576:d3BPQLBt4p3UAh2vFjr0AFnOC6R/TJiUr2Fu+8Q:kQktvFjrX+Ldk
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation b9ec5d1263ce730e0be1e8cf64c58cf4.exe -
Executes dropped EXE 1 IoCs
pid Process 2504 06152620.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\06152620 = "C:\\ProgramData\\06152620\\06152620.exe" b9ec5d1263ce730e0be1e8cf64c58cf4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\06152620 = "C:\\PROGRA~3\\06152620\\06152620.exe" 06152620.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2504 06152620.exe -
Suspicious use of FindShellTrayWindow 8 IoCs
pid Process 2504 06152620.exe 2504 06152620.exe 2504 06152620.exe 2504 06152620.exe 2504 06152620.exe 2504 06152620.exe 2504 06152620.exe 2504 06152620.exe -
Suspicious use of SendNotifyMessage 8 IoCs
pid Process 2504 06152620.exe 2504 06152620.exe 2504 06152620.exe 2504 06152620.exe 2504 06152620.exe 2504 06152620.exe 2504 06152620.exe 2504 06152620.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4836 wrote to memory of 208 4836 b9ec5d1263ce730e0be1e8cf64c58cf4.exe 90 PID 4836 wrote to memory of 208 4836 b9ec5d1263ce730e0be1e8cf64c58cf4.exe 90 PID 4836 wrote to memory of 208 4836 b9ec5d1263ce730e0be1e8cf64c58cf4.exe 90 PID 208 wrote to memory of 4564 208 cmd.exe 93 PID 208 wrote to memory of 4564 208 cmd.exe 93 PID 208 wrote to memory of 4564 208 cmd.exe 93 PID 4564 wrote to memory of 2504 4564 cmd.exe 95 PID 4564 wrote to memory of 2504 4564 cmd.exe 95 PID 4564 wrote to memory of 2504 4564 cmd.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\b9ec5d1263ce730e0be1e8cf64c58cf4.exe"C:\Users\Admin\AppData\Local\Temp\b9ec5d1263ce730e0be1e8cf64c58cf4.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\ProgramData\06152620\06152620.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:208 -
C:\Windows\SysWOW64\cmd.execmd.exe /c start C:\PROGRA~3\06152620\06152620.exe /inst3⤵
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\PROGRA~3\06152620\06152620.exeC:\PROGRA~3\06152620\06152620.exe /inst4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2504
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1011KB
MD5b9ec5d1263ce730e0be1e8cf64c58cf4
SHA1d30aab11a419fc105a15b9505dbeaa931d19c735
SHA256d481aeca84f16a3284d4de9af3625eb21024f48298538e03b3ec0921f2831046
SHA51260782d9b3a69403c909e851b353ba93a737a0ea9a17c0b96a472c262a31ef20a37fe5437906396674a8dba0597dac64575d82b03d9361a25714fc4aaff9636b0
-
Filesize
233B
MD5aebeab0f327a309852f8903c8a4314fe
SHA19f758b15880dd35b564e68e4b1ef976491ba1d66
SHA256f76c4ed4a6b0446184e1ea35a9b12f8fa3337961ea0f9ef2ed1a50edf5a776d9
SHA512d8e650d5ed68fd733569010e99214261a5d3d50f7772df0de443b6871e5d156597443fc75ce11c07a796a2ffcaadaff0eeca32c110852ae26e2775b3e18548d6
-
Filesize
974KB
MD5f948063dcf2a19e8f243d1045810909a
SHA13b5c329625490f059e6390a29bd31f4abc0d741f
SHA2563bb4a4bd20aebfa22c4cf85c71f4c6fbc5b1642ed856165dead7d715be8a0a02
SHA512414d83ec7a9251eddd8f6ba965b9e646734a1e57ff6304fcd6612cc6f5ee96b7485c0341b6e49c945df971c4852a4c53b4e476e3bb0811b85ce9955e2f5ff932