Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
13/03/2024, 21:24
Static task
static1
Behavioral task
behavioral1
Sample
8ecfabe7af1b9f3ebe30842e11f609e281089a821c5974b9a1d2fecd31e7081b.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
8ecfabe7af1b9f3ebe30842e11f609e281089a821c5974b9a1d2fecd31e7081b.exe
Resource
win10v2004-20240226-en
General
-
Target
8ecfabe7af1b9f3ebe30842e11f609e281089a821c5974b9a1d2fecd31e7081b.exe
-
Size
234KB
-
MD5
cb92ebf96efb9c65449c3aeac8a4dd4c
-
SHA1
1423638ca3bd4eee278fe4378c0c9bcc64cd8c29
-
SHA256
8ecfabe7af1b9f3ebe30842e11f609e281089a821c5974b9a1d2fecd31e7081b
-
SHA512
97c4d029f8edb583d8e1a05b07d5bfe2cfd38c92658ebac4b36f9d7016dcf1302439cd4d45e4bcab9ff877889f5ab5dd013e7562e28822611be74da03c808a44
-
SSDEEP
6144:pMI7UCCRtAortyeWPWncRgUe0mHf1PiG6afbUHl:pvUCwhoXqc+YOP76ObU
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 1280 explvr32.exe 2116 diskkill.exe 4648 ~3C1E.tmp -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ARPdial = "C:\\Users\\Admin\\AppData\\Roaming\\coloshta\\explvr32.exe" 8ecfabe7af1b9f3ebe30842e11f609e281089a821c5974b9a1d2fecd31e7081b.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\diskkill.exe 8ecfabe7af1b9f3ebe30842e11f609e281089a821c5974b9a1d2fecd31e7081b.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1280 explvr32.exe 1280 explvr32.exe 3580 Explorer.EXE 3580 Explorer.EXE 3580 Explorer.EXE 3580 Explorer.EXE 3580 Explorer.EXE 3580 Explorer.EXE 3580 Explorer.EXE 3580 Explorer.EXE 3580 Explorer.EXE 3580 Explorer.EXE 3580 Explorer.EXE 3580 Explorer.EXE 3580 Explorer.EXE 3580 Explorer.EXE 3580 Explorer.EXE 3580 Explorer.EXE 3580 Explorer.EXE 3580 Explorer.EXE 3580 Explorer.EXE 3580 Explorer.EXE 3580 Explorer.EXE 3580 Explorer.EXE 3580 Explorer.EXE 3580 Explorer.EXE 3580 Explorer.EXE 3580 Explorer.EXE 3580 Explorer.EXE 3580 Explorer.EXE 3580 Explorer.EXE 3580 Explorer.EXE 3580 Explorer.EXE 3580 Explorer.EXE 3580 Explorer.EXE 3580 Explorer.EXE 3580 Explorer.EXE 3580 Explorer.EXE 3580 Explorer.EXE 3580 Explorer.EXE 3580 Explorer.EXE 3580 Explorer.EXE 3580 Explorer.EXE 3580 Explorer.EXE 3580 Explorer.EXE 3580 Explorer.EXE 3580 Explorer.EXE 3580 Explorer.EXE 3580 Explorer.EXE 3580 Explorer.EXE 3580 Explorer.EXE 3580 Explorer.EXE 3580 Explorer.EXE 3580 Explorer.EXE 3580 Explorer.EXE 3580 Explorer.EXE 3580 Explorer.EXE 3580 Explorer.EXE 3580 Explorer.EXE 3580 Explorer.EXE 3580 Explorer.EXE 3580 Explorer.EXE 3580 Explorer.EXE 3580 Explorer.EXE -
Suspicious use of AdjustPrivilegeToken 21 IoCs
description pid Process Token: SeDebugPrivilege 1280 explvr32.exe Token: SeShutdownPrivilege 3580 Explorer.EXE Token: SeCreatePagefilePrivilege 3580 Explorer.EXE Token: SeShutdownPrivilege 3580 Explorer.EXE Token: SeCreatePagefilePrivilege 3580 Explorer.EXE Token: SeShutdownPrivilege 3580 Explorer.EXE Token: SeCreatePagefilePrivilege 3580 Explorer.EXE Token: SeShutdownPrivilege 3580 Explorer.EXE Token: SeCreatePagefilePrivilege 3580 Explorer.EXE Token: SeShutdownPrivilege 3580 Explorer.EXE Token: SeCreatePagefilePrivilege 3580 Explorer.EXE Token: SeShutdownPrivilege 3580 Explorer.EXE Token: SeCreatePagefilePrivilege 3580 Explorer.EXE Token: SeShutdownPrivilege 3580 Explorer.EXE Token: SeCreatePagefilePrivilege 3580 Explorer.EXE Token: SeShutdownPrivilege 3580 Explorer.EXE Token: SeCreatePagefilePrivilege 3580 Explorer.EXE Token: SeShutdownPrivilege 3580 Explorer.EXE Token: SeCreatePagefilePrivilege 3580 Explorer.EXE Token: SeShutdownPrivilege 3580 Explorer.EXE Token: SeCreatePagefilePrivilege 3580 Explorer.EXE -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 3580 Explorer.EXE -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4456 wrote to memory of 1280 4456 8ecfabe7af1b9f3ebe30842e11f609e281089a821c5974b9a1d2fecd31e7081b.exe 95 PID 4456 wrote to memory of 1280 4456 8ecfabe7af1b9f3ebe30842e11f609e281089a821c5974b9a1d2fecd31e7081b.exe 95 PID 4456 wrote to memory of 1280 4456 8ecfabe7af1b9f3ebe30842e11f609e281089a821c5974b9a1d2fecd31e7081b.exe 95 PID 1280 wrote to memory of 4648 1280 explvr32.exe 97 PID 1280 wrote to memory of 4648 1280 explvr32.exe 97 PID 4648 wrote to memory of 3580 4648 ~3C1E.tmp 57
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
PID:3580 -
C:\Users\Admin\AppData\Local\Temp\8ecfabe7af1b9f3ebe30842e11f609e281089a821c5974b9a1d2fecd31e7081b.exe"C:\Users\Admin\AppData\Local\Temp\8ecfabe7af1b9f3ebe30842e11f609e281089a821c5974b9a1d2fecd31e7081b.exe"2⤵
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Users\Admin\AppData\Roaming\coloshta\explvr32.exe"C:\Users\Admin\AppData\Roaming\coloshta"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\~3C1E.tmp3580 239624 1280 14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4648
-
-
-
-
C:\Windows\SysWOW64\diskkill.exeC:\Windows\SysWOW64\diskkill.exe -s1⤵
- Executes dropped EXE
PID:2116
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
MD586dc243576cf5c7445451af37631eea9
SHA199a81c47c4c02f32c0ab456bfa23c306c7a09bf9
SHA25625d2a671e1b5b5b95697ac0234ce4d46e0d0894919521b54aabebd9daecf994a
SHA512c7310524f9b65f811146c1eb6ae944966351ac88a95fbc1ac422d8810730e5e212a7e28090ad758ea23c96ba38073e7fcf42460575e7f09dbc759a45c5d5a4a4
-
Filesize
234KB
MD5d2f7007661f6c7d95b5d84f59ec5bc68
SHA11399c0ac87530203bd8725765cee2a05aa774b25
SHA256e5b8b343bff5ca3c10312e75e0ebf406de0dfaecc040330ff3fce3ffb29b06b2
SHA5129f4b645e1ca67c60f6c280ff213004e265d053041da2d560b571ffe3fd03fed5eabfa1d2c43869cba341e6dcb544503d3f66ef7ea94d34c6cfa77a9b5f3d459d