Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
163s -
max time network
171s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
07/04/2024, 18:22
Static task
static1
Behavioral task
behavioral1
Sample
08353cc8f2b15c9ad6a1781b9905ad7a354cf33d0db3f076fd4acc47d583328e.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
08353cc8f2b15c9ad6a1781b9905ad7a354cf33d0db3f076fd4acc47d583328e.exe
Resource
win10v2004-20240226-en
General
-
Target
08353cc8f2b15c9ad6a1781b9905ad7a354cf33d0db3f076fd4acc47d583328e.exe
-
Size
61KB
-
MD5
e2f1357f3ac3b2cd335104e725f2dca3
-
SHA1
86f97f76d24b9f70c8edee70185d1ab7886db2eb
-
SHA256
08353cc8f2b15c9ad6a1781b9905ad7a354cf33d0db3f076fd4acc47d583328e
-
SHA512
755eacb03df3d0ce9b17ef16df26daaf5750f07d27f33edcb99f3ca3c4be14aca67117c1a894fde0d4324e224d9e81719c0c9fbd2862376febca09cea2f0d114
-
SSDEEP
1536:NDj2d6rnJbJnJBSX1nV1b1N1Il1k1YFI1x1J1MuEqx517Q/1T1Jzct01Nsqnl1RE:FlnnJBSX1nV1b1N1Il1k1YFI1x1J1MuD
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 4400 microsofthelp.exe -
Executes dropped EXE 1 IoCs
pid Process 4400 microsofthelp.exe -
Loads dropped DLL 1 IoCs
pid Process 4400 microsofthelp.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\microsofthelp = "C:\\Windows\\microsofthelp.exe" 08353cc8f2b15c9ad6a1781b9905ad7a354cf33d0db3f076fd4acc47d583328e.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\HidePlugin.dll microsofthelp.exe File created C:\Windows\microsofthelp.exe 08353cc8f2b15c9ad6a1781b9905ad7a354cf33d0db3f076fd4acc47d583328e.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4400 microsofthelp.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 316 wrote to memory of 4400 316 08353cc8f2b15c9ad6a1781b9905ad7a354cf33d0db3f076fd4acc47d583328e.exe 87 PID 316 wrote to memory of 4400 316 08353cc8f2b15c9ad6a1781b9905ad7a354cf33d0db3f076fd4acc47d583328e.exe 87 PID 316 wrote to memory of 4400 316 08353cc8f2b15c9ad6a1781b9905ad7a354cf33d0db3f076fd4acc47d583328e.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\08353cc8f2b15c9ad6a1781b9905ad7a354cf33d0db3f076fd4acc47d583328e.exe"C:\Users\Admin\AppData\Local\Temp\08353cc8f2b15c9ad6a1781b9905ad7a354cf33d0db3f076fd4acc47d583328e.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:316 -
C:\Windows\microsofthelp.exe"C:\Windows\microsofthelp.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:4400
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD54c0b9970f96300dfa1f45afc7539d35f
SHA1ebbb4ed2003662d78d1f32e7b6da1b6f504ae711
SHA2564e96660cc8be7171a79755a20860366987547322b3a809e78c9850f14c242262
SHA512579f8787b52bf62a0296d8a24753263201fbc84abec5927033e3c97576f965ead0f8422acd3f7af1345b0df0001b0cd68fa971062e21269f6940cf3e1508ca88
-
Filesize
62KB
MD5959affcda29e008b757efbf6a3422687
SHA18abf02c9b094b20e4d86a882a8b75d66af2a64c0
SHA256ff00a841055389e867153f99d0fa1c28c401a9250eca63b60ef58917d00a127b
SHA512ffb1d606ec6dd37a62e010e0c2d8c434cc674c7cf691efe3ab69d42a3d373372d69ac90c4978cd84682b09b7f7db3ec7ce40e93a684e07edd31f802c2154fc4e