Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
10/03/2024, 03:17
Static task
static1
Behavioral task
behavioral1
Sample
bd87756e621bd65c9a22700979ed276b.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
bd87756e621bd65c9a22700979ed276b.exe
Resource
win10v2004-20240226-en
General
-
Target
bd87756e621bd65c9a22700979ed276b.exe
-
Size
32KB
-
MD5
bd87756e621bd65c9a22700979ed276b
-
SHA1
1577b6a5f1c61bd5e7e6caf79e1d678508785f16
-
SHA256
e92b44743b2c5d16b640d5480fd6395814b488671e429813251d18ea2e149073
-
SHA512
27b36e0fa07169208395882d2754edf01566852a11bbde1197b09f54f5f659e2a71796cdfd65a5b1bb4ac34767f358f7f3f873f32e1e8ecceb0ad3e58182d22c
-
SSDEEP
768:cxvrR16lyByqFNHg0xpjzUCOwydxVRpsRjGBYPVz3j:eDR1Jyq3LjgTvpsRyBG3
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 2892 wuaucldt.exe 3216 wuaucldt.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\wuaucldt = "c:\\windows\\system32\\wuaucldt.exe" wuaucldt.exe Set value (str) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wuaucldt = "c:\\users\\admin\\wuaucldt.exe" wuaucldt.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 svchost.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created \??\c:\windows\SysWOW64\wuaucldt.exe bd87756e621bd65c9a22700979ed276b.exe File created \??\c:\windows\SysWOW64\wuaucldt.exe wuaucldt.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3216 set thread context of 4300 3216 wuaucldt.exe 92 -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 1008 wrote to memory of 2892 1008 bd87756e621bd65c9a22700979ed276b.exe 89 PID 1008 wrote to memory of 2892 1008 bd87756e621bd65c9a22700979ed276b.exe 89 PID 1008 wrote to memory of 2892 1008 bd87756e621bd65c9a22700979ed276b.exe 89 PID 2892 wrote to memory of 3216 2892 wuaucldt.exe 91 PID 2892 wrote to memory of 3216 2892 wuaucldt.exe 91 PID 2892 wrote to memory of 3216 2892 wuaucldt.exe 91 PID 3216 wrote to memory of 4300 3216 wuaucldt.exe 92 PID 3216 wrote to memory of 4300 3216 wuaucldt.exe 92 PID 3216 wrote to memory of 4300 3216 wuaucldt.exe 92 PID 3216 wrote to memory of 4300 3216 wuaucldt.exe 92 PID 3216 wrote to memory of 4300 3216 wuaucldt.exe 92 PID 1008 wrote to memory of 1568 1008 bd87756e621bd65c9a22700979ed276b.exe 94 PID 1008 wrote to memory of 1568 1008 bd87756e621bd65c9a22700979ed276b.exe 94 PID 1008 wrote to memory of 1568 1008 bd87756e621bd65c9a22700979ed276b.exe 94 PID 2892 wrote to memory of 2872 2892 wuaucldt.exe 96 PID 2892 wrote to memory of 2872 2892 wuaucldt.exe 96 PID 2892 wrote to memory of 2872 2892 wuaucldt.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\bd87756e621bd65c9a22700979ed276b.exe"C:\Users\Admin\AppData\Local\Temp\bd87756e621bd65c9a22700979ed276b.exe"1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1008 -
\??\c:\windows\SysWOW64\wuaucldt.exec:\windows\system32\wuaucldt.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\users\admin\wuaucldt.exec:\users\admin\wuaucldt.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3216 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe4⤵
- Writes to the Master Boot Record (MBR)
PID:4300
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del c:\windows\syswow64\wuaucldt.exe3⤵PID:2872
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del c:\users\admin\appdata\local\temp\BD8775~1.EXE2⤵PID:1568
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
32KB
MD5bd87756e621bd65c9a22700979ed276b
SHA11577b6a5f1c61bd5e7e6caf79e1d678508785f16
SHA256e92b44743b2c5d16b640d5480fd6395814b488671e429813251d18ea2e149073
SHA51227b36e0fa07169208395882d2754edf01566852a11bbde1197b09f54f5f659e2a71796cdfd65a5b1bb4ac34767f358f7f3f873f32e1e8ecceb0ad3e58182d22c