Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
7Big tits a...ss.scr
windows7-x64
10Big tits a...ss.scr
windows10-2004-x64
10Choky Ice ...on.scr
windows7-x64
10Choky Ice ...on.scr
windows10-2004-x64
10Come Inside.scr
windows7-x64
10Come Inside.scr
windows10-2004-x64
10Ivana Suga...se.scr
windows7-x64
10Ivana Suga...se.scr
windows10-2004-x64
10Surprise f...oy.scr
windows7-x64
10Surprise f...oy.scr
windows10-2004-x64
10Analysis
-
max time kernel
150s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
14/05/2024, 23:23
Behavioral task
behavioral1
Sample
Big tits and deep ass.scr
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral2
Sample
Big tits and deep ass.scr
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
Choky Ice And His Best Friend Max A Surprising Us With Great Threesome Action.scr
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral4
Sample
Choky Ice And His Best Friend Max A Surprising Us With Great Threesome Action.scr
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
Come Inside.scr
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral6
Sample
Come Inside.scr
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
Ivana Sugar Dp By Surprise.scr
Resource
win7-20240215-en
windows7-x64
Behavioral task
behavioral8
Sample
Ivana Sugar Dp By Surprise.scr
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
Surprise for playful boy.scr
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral10
Sample
Surprise for playful boy.scr
Resource
win10v2004-20240508-en
windows10-2004-x64
General
-
Target
Come Inside.scr
-
Size
521KB
-
MD5
e5a3b8e0ea5a54fdb1d408fe6a48bff5
-
SHA1
636cc09bdeb18fed338ce2a5082c79d4d258cf3b
-
SHA256
93b7e7810a3726a1c2a7f4eadcd8cbad7202ce9245f818d14c4bd5d2556346fe
-
SHA512
98fb147438a4a5f941e92003b8a7a448067571271727ac90470a949addfcef3061b27d554a904236a1e5d0f6a16790228a6b597df695e1f0b584c7b93cb47667
-
SSDEEP
12288:ONWz1AUZbht1FGdX3EDVsmfZ/al8ViJQPRHDVsmh:OQzO8bhOED6mB/aYYQ5HD6mh
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,,C:\\Program Files (x86)\\Windows Sidebar\\yqruAoCW.exe" Come Inside.scr -
Modifies firewall policy service 2 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" gNZDGXPm.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" gNZDGXPm.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" gNZDGXPm.exe -
Modifies security service 2 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" gNZDGXPm.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4" gNZDGXPm.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\mpssvc\Start = "4" gNZDGXPm.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" gNZDGXPm.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" gNZDGXPm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" gNZDGXPm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" gNZDGXPm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" gNZDGXPm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" gNZDGXPm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" gNZDGXPm.exe -
Disables Task Manager via registry modification
-
resource yara_rule behavioral6/files/0x00070000000233f1-13.dat aspack_v212_v242 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation Come Inside.scr -
Drops startup file 4 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\KfJGxbbA.exe Come Inside.scr File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\KfJGxbbA.exe Come Inside.scr File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\KfJGxbbA.exe gNZDGXPm.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\KfJGxbbA.exe gNZDGXPm.exe -
Executes dropped EXE 2 IoCs
pid Process 2928 gNZDGXPm.exe 960 gNZDGXPm.exe -
resource yara_rule behavioral6/memory/4992-2-0x0000000000400000-0x0000000000416000-memory.dmp upx behavioral6/memory/4992-5-0x0000000000400000-0x0000000000416000-memory.dmp upx behavioral6/memory/4992-7-0x0000000000400000-0x0000000000416000-memory.dmp upx behavioral6/memory/4992-8-0x0000000000400000-0x0000000000416000-memory.dmp upx behavioral6/memory/960-28-0x0000000000400000-0x0000000000416000-memory.dmp upx behavioral6/memory/4992-35-0x0000000000400000-0x0000000000416000-memory.dmp upx behavioral6/memory/960-37-0x0000000000400000-0x0000000000416000-memory.dmp upx behavioral6/memory/960-42-0x0000000000400000-0x0000000000416000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" gNZDGXPm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" gNZDGXPm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" gNZDGXPm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" gNZDGXPm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" gNZDGXPm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" gNZDGXPm.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SPGMfGzi = "C:\\Users\\Admin\\AppData\\Local\\Comms\\vEExarqt.exe" Come Inside.scr Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SPGMfGzi = "C:\\Users\\Admin\\AppData\\Local\\Comms\\vEExarqt.exe" gNZDGXPm.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" gNZDGXPm.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 64 set thread context of 4992 64 Come Inside.scr 86 PID 2928 set thread context of 960 2928 gNZDGXPm.exe 88 -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\Windows Sidebar\yqruAoCW.exe Come Inside.scr File opened for modification C:\Program Files (x86)\Windows Sidebar\yqruAoCW.exe Come Inside.scr -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 960 gNZDGXPm.exe 960 gNZDGXPm.exe 960 gNZDGXPm.exe 960 gNZDGXPm.exe 960 gNZDGXPm.exe 960 gNZDGXPm.exe 960 gNZDGXPm.exe 960 gNZDGXPm.exe 960 gNZDGXPm.exe 960 gNZDGXPm.exe 960 gNZDGXPm.exe 960 gNZDGXPm.exe 960 gNZDGXPm.exe 960 gNZDGXPm.exe 960 gNZDGXPm.exe 960 gNZDGXPm.exe 960 gNZDGXPm.exe 960 gNZDGXPm.exe 960 gNZDGXPm.exe 960 gNZDGXPm.exe 960 gNZDGXPm.exe 960 gNZDGXPm.exe 960 gNZDGXPm.exe 960 gNZDGXPm.exe 960 gNZDGXPm.exe 960 gNZDGXPm.exe 960 gNZDGXPm.exe 960 gNZDGXPm.exe 960 gNZDGXPm.exe 960 gNZDGXPm.exe 960 gNZDGXPm.exe 960 gNZDGXPm.exe 960 gNZDGXPm.exe 960 gNZDGXPm.exe 960 gNZDGXPm.exe 960 gNZDGXPm.exe 960 gNZDGXPm.exe 960 gNZDGXPm.exe 960 gNZDGXPm.exe 960 gNZDGXPm.exe 960 gNZDGXPm.exe 960 gNZDGXPm.exe 960 gNZDGXPm.exe 960 gNZDGXPm.exe 960 gNZDGXPm.exe 960 gNZDGXPm.exe 960 gNZDGXPm.exe 960 gNZDGXPm.exe 960 gNZDGXPm.exe 960 gNZDGXPm.exe 960 gNZDGXPm.exe 960 gNZDGXPm.exe 960 gNZDGXPm.exe 960 gNZDGXPm.exe 960 gNZDGXPm.exe 960 gNZDGXPm.exe 960 gNZDGXPm.exe 960 gNZDGXPm.exe 960 gNZDGXPm.exe 960 gNZDGXPm.exe 960 gNZDGXPm.exe 960 gNZDGXPm.exe 960 gNZDGXPm.exe 960 gNZDGXPm.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeSecurityPrivilege 4992 Come Inside.scr Token: SeDebugPrivilege 4992 Come Inside.scr Token: SeTcbPrivilege 4992 Come Inside.scr Token: SeSecurityPrivilege 960 gNZDGXPm.exe Token: SeDebugPrivilege 960 gNZDGXPm.exe Token: SeTcbPrivilege 960 gNZDGXPm.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 64 wrote to memory of 4992 64 Come Inside.scr 86 PID 64 wrote to memory of 4992 64 Come Inside.scr 86 PID 64 wrote to memory of 4992 64 Come Inside.scr 86 PID 64 wrote to memory of 4992 64 Come Inside.scr 86 PID 64 wrote to memory of 4992 64 Come Inside.scr 86 PID 4992 wrote to memory of 2928 4992 Come Inside.scr 87 PID 4992 wrote to memory of 2928 4992 Come Inside.scr 87 PID 4992 wrote to memory of 2928 4992 Come Inside.scr 87 PID 2928 wrote to memory of 960 2928 gNZDGXPm.exe 88 PID 2928 wrote to memory of 960 2928 gNZDGXPm.exe 88 PID 2928 wrote to memory of 960 2928 gNZDGXPm.exe 88 PID 2928 wrote to memory of 960 2928 gNZDGXPm.exe 88 PID 2928 wrote to memory of 960 2928 gNZDGXPm.exe 88 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" gNZDGXPm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Come Inside.scr"C:\Users\Admin\AppData\Local\Temp\Come Inside.scr" /S1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:64 -
C:\Users\Admin\AppData\Local\Temp\Come Inside.scr"C:\Users\Admin\AppData\Local\Temp\Come Inside.scr"2⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\gNZDGXPm.exe"C:\Users\Admin\AppData\Local\Temp\gNZDGXPm.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\gNZDGXPm.exe"C:\Users\Admin\AppData\Local\Temp\gNZDGXPm.exe"4⤵
- Modifies firewall policy service
- Modifies security service
- UAC bypass
- Windows security bypass
- Drops startup file
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:960
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
521KB
MD5e5a3b8e0ea5a54fdb1d408fe6a48bff5
SHA1636cc09bdeb18fed338ce2a5082c79d4d258cf3b
SHA25693b7e7810a3726a1c2a7f4eadcd8cbad7202ce9245f818d14c4bd5d2556346fe
SHA51298fb147438a4a5f941e92003b8a7a448067571271727ac90470a949addfcef3061b27d554a904236a1e5d0f6a16790228a6b597df695e1f0b584c7b93cb47667