Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
92s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
09/04/2024, 21:21
Static task
static1
Behavioral task
behavioral1
Sample
0c65d9ab75e7aa8dcf94cb642500b0cc.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0c65d9ab75e7aa8dcf94cb642500b0cc.exe
Resource
win10v2004-20231215-en
General
-
Target
0c65d9ab75e7aa8dcf94cb642500b0cc.exe
-
Size
108KB
-
MD5
0c65d9ab75e7aa8dcf94cb642500b0cc
-
SHA1
c2966be8bd1c8aa1153671e29a44a37b3fd81a09
-
SHA256
a696374793e0dd73d04bb3d38ec1c8ef548cb374f7343a0cf6e21609417917b0
-
SHA512
94d060798b0b0cae8948f013948fd5fae764d6b10fbd9fc4f64a6ea927cf9235438b760f73c02bcdc7f34222eec710b455bef0ac8f6f2b3b179df66fab4f2e24
-
SSDEEP
3072:zZsAH+Nu92R2hTFkV/2C5ruvq2FcFmKcUsvKwF:ztHpUR2x6o0rIqGUs
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad 0c65d9ab75e7aa8dcf94cb642500b0cc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" 0c65d9ab75e7aa8dcf94cb642500b0cc.exe -
Executes dropped EXE 1 IoCs
pid Process 2548 Nkcmohbg.exe -
Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\Nkcmohbg.exe 0c65d9ab75e7aa8dcf94cb642500b0cc.exe File opened for modification C:\Windows\SysWOW64\Nkcmohbg.exe 0c65d9ab75e7aa8dcf94cb642500b0cc.exe File created C:\Windows\SysWOW64\Hnibdpde.dll 0c65d9ab75e7aa8dcf94cb642500b0cc.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 4488 2548 WerFault.exe 85 -
Modifies registry class 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node 0c65d9ab75e7aa8dcf94cb642500b0cc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID 0c65d9ab75e7aa8dcf94cb642500b0cc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717} 0c65d9ab75e7aa8dcf94cb642500b0cc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hnibdpde.dll" 0c65d9ab75e7aa8dcf94cb642500b0cc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" 0c65d9ab75e7aa8dcf94cb642500b0cc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 0c65d9ab75e7aa8dcf94cb642500b0cc.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2596 wrote to memory of 2548 2596 0c65d9ab75e7aa8dcf94cb642500b0cc.exe 85 PID 2596 wrote to memory of 2548 2596 0c65d9ab75e7aa8dcf94cb642500b0cc.exe 85 PID 2596 wrote to memory of 2548 2596 0c65d9ab75e7aa8dcf94cb642500b0cc.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\0c65d9ab75e7aa8dcf94cb642500b0cc.exe"C:\Users\Admin\AppData\Local\Temp\0c65d9ab75e7aa8dcf94cb642500b0cc.exe"1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Windows\SysWOW64\Nkcmohbg.exeC:\Windows\system32\Nkcmohbg.exe2⤵
- Executes dropped EXE
PID:2548 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2548 -s 3363⤵
- Program crash
PID:4488
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2548 -ip 25481⤵PID:1204
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
108KB
MD5c2fe078be93922e0b1603d682345fabc
SHA1557544f75dffe4ad321bd8918bdc1ac0404da8d4
SHA2569e762b9ed38cb6529c32027000a474bbcfa80df76ab05920f96f6bd879e4e98b
SHA5128bd8a98b5aec6e9123b2366ce36c5671744b0fc6a4536c6bb5088733d41402d82ba872f9c09e3d0fbb1c64683a4c552a921ec2bb21e678ff514572ee9cd216b3