Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
07/03/2024, 12:45
Static task
static1
Behavioral task
behavioral1
Sample
b8c1fa7b9f8818580e6531103672dade.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
b8c1fa7b9f8818580e6531103672dade.exe
Resource
win10v2004-20240226-en
General
-
Target
b8c1fa7b9f8818580e6531103672dade.exe
-
Size
152KB
-
MD5
b8c1fa7b9f8818580e6531103672dade
-
SHA1
83e19142d500dca959dfd159c33ee857df953fe5
-
SHA256
d59673c999f3f442f8e3408400e963f96c0ff441b9478e90a86026de41a9e487
-
SHA512
b3b05f1cdc44c84416a122bbde77c1de5b4e3d41a71d3883c10fcf851edd3a33c755ec9f648930ee953192f1581f4c55f3e1127ccdd404596f0529b8316e7369
-
SSDEEP
3072:UpNlV8gSvbLlf+U704ChxTQqh7/28guGE0ocENjMdr:UpNlVIlGd4CFh7/28gUQ
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\dllcache\\zreportbugs.exe," b8c1fa7b9f8818580e6531103672dade.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation b8c1fa7b9f8818580e6531103672dade.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\dllcache\zreportbugs.exe b8c1fa7b9f8818580e6531103672dade.exe File created C:\Windows\SysWOW64\dllcache\zreportbugs.exe b8c1fa7b9f8818580e6531103672dade.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3564 b8c1fa7b9f8818580e6531103672dade.exe 3564 b8c1fa7b9f8818580e6531103672dade.exe 3564 b8c1fa7b9f8818580e6531103672dade.exe 3564 b8c1fa7b9f8818580e6531103672dade.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3564 b8c1fa7b9f8818580e6531103672dade.exe 3564 b8c1fa7b9f8818580e6531103672dade.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3564 wrote to memory of 5096 3564 b8c1fa7b9f8818580e6531103672dade.exe 97 PID 3564 wrote to memory of 5096 3564 b8c1fa7b9f8818580e6531103672dade.exe 97 PID 3564 wrote to memory of 5096 3564 b8c1fa7b9f8818580e6531103672dade.exe 97 PID 5096 wrote to memory of 3032 5096 cmd.exe 99 PID 5096 wrote to memory of 3032 5096 cmd.exe 99 PID 5096 wrote to memory of 3032 5096 cmd.exe 99 -
Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 3032 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b8c1fa7b9f8818580e6531103672dade.exe"C:\Users\Admin\AppData\Local\Temp\b8c1fa7b9f8818580e6531103672dade.exe"1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3564 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\del.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:5096 -
C:\Windows\SysWOW64\attrib.exeattrib -a -r -s -h " C:\Users\Admin\AppData\Local\Temp\b8c1fa7b9f8818580e6531103672dade.exe"3⤵
- Views/modifies file attributes
PID:3032
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1344 --field-trial-handle=2284,i,15722001240173834669,15048020084704567542,262144 --variations-seed-version /prefetch:81⤵PID:1624
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
289B
MD534f9df4592140de286f3d5a50ce349a8
SHA179be6a924c55608bbaee413b89a30a01be1debd5
SHA2564a616ee615eabfb9d2ff931fb94c921b4bbd07a52316ea13500f5a6aeb60725d
SHA512710898c052418788ead94cf55ef4e1fed41ebc4c4ba2fce5a1d2167db9d431d9cc612e9667921c61ab1fd3f47b8296e9857f05677444c02e7845b25820698e57