Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
11/03/2024, 01:57
Static task
static1
Behavioral task
behavioral1
Sample
f4570a3e1ae9fb5307f321983c446d9bbef183de59726bd11be5440e6faf25f9.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f4570a3e1ae9fb5307f321983c446d9bbef183de59726bd11be5440e6faf25f9.exe
Resource
win10v2004-20240226-en
General
-
Target
f4570a3e1ae9fb5307f321983c446d9bbef183de59726bd11be5440e6faf25f9.exe
-
Size
161KB
-
MD5
f44f1d6941436fe095bef7425f850335
-
SHA1
e442ae7623976fbc3b8bcd1118cdf9bd3ec2d6a3
-
SHA256
f4570a3e1ae9fb5307f321983c446d9bbef183de59726bd11be5440e6faf25f9
-
SHA512
afd084d03ea732dda2a331e4ffd5cbdbed6181649c520cd2a9b9522033eeaf4722b680ac920a666281f8ce6cd20c33aa6f36646e944b8b050973be544a3b850a
-
SSDEEP
3072:qv5Ls27BIJo7LyXuM/XXXdwVBXXXhYfjCXXXDrXXXDKXXXmfXXXxXXXLIIIBoqfm:qBs27V7LyXf/XXX2VBXXXefjCXXXDrXf
Malware Config
Signatures
-
Detects Windows executables referencing non-Windows User-Agents 1 IoCs
resource yara_rule behavioral2/files/0x000400000001e980-2.dat INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation f4570a3e1ae9fb5307f321983c446d9bbef183de59726bd11be5440e6faf25f9.exe -
Executes dropped EXE 1 IoCs
pid Process 3184 egkhost.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\Debug\egkhost.exe f4570a3e1ae9fb5307f321983c446d9bbef183de59726bd11be5440e6faf25f9.exe File created C:\Windows\Debug\egkhost.exe f4570a3e1ae9fb5307f321983c446d9bbef183de59726bd11be5440e6faf25f9.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 egkhost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz egkhost.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 3804 f4570a3e1ae9fb5307f321983c446d9bbef183de59726bd11be5440e6faf25f9.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3804 wrote to memory of 4016 3804 f4570a3e1ae9fb5307f321983c446d9bbef183de59726bd11be5440e6faf25f9.exe 93 PID 3804 wrote to memory of 4016 3804 f4570a3e1ae9fb5307f321983c446d9bbef183de59726bd11be5440e6faf25f9.exe 93 PID 3804 wrote to memory of 4016 3804 f4570a3e1ae9fb5307f321983c446d9bbef183de59726bd11be5440e6faf25f9.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\f4570a3e1ae9fb5307f321983c446d9bbef183de59726bd11be5440e6faf25f9.exe"C:\Users\Admin\AppData\Local\Temp\f4570a3e1ae9fb5307f321983c446d9bbef183de59726bd11be5440e6faf25f9.exe"1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3804 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\F4570A~1.EXE > nul2⤵PID:4016
-
-
C:\Windows\Debug\egkhost.exeC:\Windows\Debug\egkhost.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
PID:3184
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
161KB
MD5c67559301fa6b512c901c2e5542fdc5b
SHA14a9a10a229ebf43a3219d977d7415c3793f542bc
SHA25625120f71ce7a84b15457f8d64af3f60dca8ceac7e6a65e8d1d0a7bc55093f08f
SHA512ceaf16aedf97a364be74c1ece4c1c45400ba1fbad1a6cbb68059aae6aa18433a58849c50fa17c05f870fb0f84c21b072545f95fb34c774091bc875b8351cda97