Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
19/05/2024, 18:48
Static task
static1
Behavioral task
behavioral1
Sample
10bf38821b0590fef1b82616920ec743bd09f7d1c374e77731138bed045653e1.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
10bf38821b0590fef1b82616920ec743bd09f7d1c374e77731138bed045653e1.exe
Resource
win10v2004-20240226-en
General
-
Target
10bf38821b0590fef1b82616920ec743bd09f7d1c374e77731138bed045653e1.exe
-
Size
12KB
-
MD5
3dca6c626c9363766d4bd4108b0f46f6
-
SHA1
6e3caa5776ba1bedbb33e469d59d0f425e051897
-
SHA256
10bf38821b0590fef1b82616920ec743bd09f7d1c374e77731138bed045653e1
-
SHA512
b7665e0ebb72f4654ad14b5a53b81454e485f2ce33df64e93eb7c4aec513d7d2110d75f54e0dcfe7bf009bdf5020b465f63410eb3ab83e9d3916ab05f8b60192
-
SSDEEP
384:mL7li/2z4q2DcEQvdhcJKLTp/NK9xa1C:AkM/Q9c1C
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation 10bf38821b0590fef1b82616920ec743bd09f7d1c374e77731138bed045653e1.exe -
Deletes itself 1 IoCs
pid Process 4304 tmpB08.tmp.exe -
Executes dropped EXE 1 IoCs
pid Process 4304 tmpB08.tmp.exe -
Uses the VBS compiler for execution 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3076 10bf38821b0590fef1b82616920ec743bd09f7d1c374e77731138bed045653e1.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 3076 wrote to memory of 4696 3076 10bf38821b0590fef1b82616920ec743bd09f7d1c374e77731138bed045653e1.exe 91 PID 3076 wrote to memory of 4696 3076 10bf38821b0590fef1b82616920ec743bd09f7d1c374e77731138bed045653e1.exe 91 PID 3076 wrote to memory of 4696 3076 10bf38821b0590fef1b82616920ec743bd09f7d1c374e77731138bed045653e1.exe 91 PID 4696 wrote to memory of 4260 4696 vbc.exe 93 PID 4696 wrote to memory of 4260 4696 vbc.exe 93 PID 4696 wrote to memory of 4260 4696 vbc.exe 93 PID 3076 wrote to memory of 4304 3076 10bf38821b0590fef1b82616920ec743bd09f7d1c374e77731138bed045653e1.exe 98 PID 3076 wrote to memory of 4304 3076 10bf38821b0590fef1b82616920ec743bd09f7d1c374e77731138bed045653e1.exe 98 PID 3076 wrote to memory of 4304 3076 10bf38821b0590fef1b82616920ec743bd09f7d1c374e77731138bed045653e1.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\10bf38821b0590fef1b82616920ec743bd09f7d1c374e77731138bed045653e1.exe"C:\Users\Admin\AppData\Local\Temp\10bf38821b0590fef1b82616920ec743bd09f7d1c374e77731138bed045653e1.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3076 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\iblrmnle\iblrmnle.cmdline"2⤵
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES175B.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc3AB4F7F7AA58471BB5A06F6A2A5565FE.TMP"3⤵PID:4260
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmpB08.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpB08.tmp.exe" C:\Users\Admin\AppData\Local\Temp\10bf38821b0590fef1b82616920ec743bd09f7d1c374e77731138bed045653e1.exe2⤵
- Deletes itself
- Executes dropped EXE
PID:4304
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3816 --field-trial-handle=2248,i,10247514684337323751,15511974759131734137,262144 --variations-seed-version /prefetch:81⤵PID:2096
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD57b1818a32322e32a1966cf212aac3b43
SHA1ff0e3fe9cbc3b6aa63e4f71eb832a12c17b129f0
SHA2560ac3fec603a25e4209fe3bc6e7655648bcf07808272bca5a963b46c73a0584ea
SHA512d8e5054429a34117694c4ab7e8e113cf5f4b15345425ab8962906a4366292b074ebf91e0fb3ce72e33c85ca925a49a8752ed4b3dca4820cef616b959e7480d2e
-
Filesize
1KB
MD5a2f196b64b710a6880b5426dc7f485f0
SHA12e7817782c71203b6004ca8223870688fe153de9
SHA256fe0285953386fdfbb3bf391c2de4716dba14e26446cae05d34b0a9a8b43f9c92
SHA512dbf519e9103d8ac621a49c2ae131d4682ed1d2e852b791445f8e0d030d19d61bdb831f36a2c41f097bce9532840115d80c7f96d3781f9d1b370e0b809b8aab85
-
Filesize
2KB
MD5708632f6b9d50ae1d5d5e22dc4f79199
SHA1394ba060b29863d126e2487515ce20ec94ea7ae8
SHA2560b17fbe427d92bc06c88035f7e0b9eec28579fa96d83dfec74acd326cb94f1d8
SHA512aa7fbd0ebc646ed39ad093b741869ddf4bf0569f905c9caaea1e20b7e3cd4838a3db91396ebd06a2f4c32006c258ebcb9782b18b2befd5c0ea171a6d9f26f064
-
Filesize
272B
MD5bba3165bf1784867e7e3c403afccfc97
SHA13b9bf10e630d1b386051c73dc2e1080c5f429705
SHA256354b9a6b3ede1efba909ea8f311b7f364abd8a29e3714d604b5be0565dda0fe1
SHA512a8d34db9dc3bd7fe178934e29eec7b3520fb6347f11243003553e7dce7c5eb3b588caf37380980731991ca233afe9ed3392c09b399c34ff76b674ba35810925c
-
Filesize
12KB
MD5d6b37e34e60c1a9966929e228238383d
SHA125edeb2dbac93766f36de31cb06a25561d3d5c22
SHA2569f5a613c33fd10bbc556729d2e91e8a5cff39dc75d935fb3c1169e0af443fb95
SHA5126987bfceda6e757c7c06e13dbf73aa92b4b78871c380b3273fb68f1fb81379963c5ac20a70925349f5be59a3dc93b7e4a5d41a85088d69a13de9af6202659f8c
-
Filesize
1KB
MD51bd6dde813ae584ed9655b329fc302e1
SHA1c850ef6ca0e78f177b7ef438fc469453d47e94ff
SHA2569bd86fbac614d79daea6fa18f6f144e9c9c6bae778f969da4c768c6ada647962
SHA5120a9d9d16150c97da2ca7fc6568a6b3cfd589cb668fd9d41256557f055b6dae5b8018195de88465b341056f8ca7c2ded17ab7fced0d49f11caa0a012e64261aa9