Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
15/03/2024, 03:14
Static task
static1
Behavioral task
behavioral1
Sample
ca56f886230d54aa1dc5f9025e30d837.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ca56f886230d54aa1dc5f9025e30d837.exe
Resource
win10v2004-20240226-en
General
-
Target
ca56f886230d54aa1dc5f9025e30d837.exe
-
Size
68KB
-
MD5
ca56f886230d54aa1dc5f9025e30d837
-
SHA1
c64e66985f82d650682db95818229bd790fbaaf1
-
SHA256
36b9bfc07a5dbe39399a9a7dd7218d2be5b0542057e6e63e3425c9df58c5e86e
-
SHA512
72619cedd4a089276412b3c515eba349095057b3503a0299e99b3084fd458adfb1959473205538438021e2052cb1a1d68834b277fc4abdbd7e24b4b2dd1525b1
-
SSDEEP
1536:4arEyTj4/ydHQ7zoFhgeKpkoTuOz0ZXzAYbZkNw:LEyA0H4oFhgjeEuOAZDxNkNw
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 5044 service.exe 3404 service.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Local\\Temp\\service.exe" ca56f886230d54aa1dc5f9025e30d837.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Services = "service.exe" ca56f886230d54aa1dc5f9025e30d837.exe Set value (str) \REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Local\\Temp\\service.exe" service.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 3536 set thread context of 3768 3536 ca56f886230d54aa1dc5f9025e30d837.exe 87 PID 5044 set thread context of 3404 5044 service.exe 90 -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3536 ca56f886230d54aa1dc5f9025e30d837.exe 5044 service.exe -
Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 3536 wrote to memory of 3768 3536 ca56f886230d54aa1dc5f9025e30d837.exe 87 PID 3536 wrote to memory of 3768 3536 ca56f886230d54aa1dc5f9025e30d837.exe 87 PID 3536 wrote to memory of 3768 3536 ca56f886230d54aa1dc5f9025e30d837.exe 87 PID 3536 wrote to memory of 3768 3536 ca56f886230d54aa1dc5f9025e30d837.exe 87 PID 3536 wrote to memory of 3768 3536 ca56f886230d54aa1dc5f9025e30d837.exe 87 PID 3536 wrote to memory of 3768 3536 ca56f886230d54aa1dc5f9025e30d837.exe 87 PID 3536 wrote to memory of 3768 3536 ca56f886230d54aa1dc5f9025e30d837.exe 87 PID 3536 wrote to memory of 3768 3536 ca56f886230d54aa1dc5f9025e30d837.exe 87 PID 3768 wrote to memory of 5044 3768 ca56f886230d54aa1dc5f9025e30d837.exe 88 PID 3768 wrote to memory of 5044 3768 ca56f886230d54aa1dc5f9025e30d837.exe 88 PID 3768 wrote to memory of 5044 3768 ca56f886230d54aa1dc5f9025e30d837.exe 88 PID 5044 wrote to memory of 3404 5044 service.exe 90 PID 5044 wrote to memory of 3404 5044 service.exe 90 PID 5044 wrote to memory of 3404 5044 service.exe 90 PID 5044 wrote to memory of 3404 5044 service.exe 90 PID 5044 wrote to memory of 3404 5044 service.exe 90 PID 5044 wrote to memory of 3404 5044 service.exe 90 PID 5044 wrote to memory of 3404 5044 service.exe 90 PID 5044 wrote to memory of 3404 5044 service.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\ca56f886230d54aa1dc5f9025e30d837.exe"C:\Users\Admin\AppData\Local\Temp\ca56f886230d54aa1dc5f9025e30d837.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3536 -
C:\Users\Admin\AppData\Local\Temp\ca56f886230d54aa1dc5f9025e30d837.exeC:\Users\Admin\AppData\Local\Temp\ca56f886230d54aa1dc5f9025e30d8372⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3768 -
C:\Users\Admin\AppData\Local\Temp\service.exe"C:\Users\Admin\AppData\Local\Temp\service.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\service.exeC:\Users\Admin\AppData\Local\Temp\service4⤵
- Executes dropped EXE
- Adds Run key to start application
PID:3404
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD5ca56f886230d54aa1dc5f9025e30d837
SHA1c64e66985f82d650682db95818229bd790fbaaf1
SHA25636b9bfc07a5dbe39399a9a7dd7218d2be5b0542057e6e63e3425c9df58c5e86e
SHA51272619cedd4a089276412b3c515eba349095057b3503a0299e99b3084fd458adfb1959473205538438021e2052cb1a1d68834b277fc4abdbd7e24b4b2dd1525b1