Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
22/05/2024, 21:07
Behavioral task
behavioral1
Sample
4528d2a084013ebaa2c3526e3a07e77a65a0484fee2dd65227d45ead01244e5f.exe
Resource
win7-20240508-en
General
-
Target
4528d2a084013ebaa2c3526e3a07e77a65a0484fee2dd65227d45ead01244e5f.exe
-
Size
1.1MB
-
MD5
1aee717ecfeaae4a113f6d0a2e3209f1
-
SHA1
79ce52468b618b6e76aea967f1839ff7353609dc
-
SHA256
4528d2a084013ebaa2c3526e3a07e77a65a0484fee2dd65227d45ead01244e5f
-
SHA512
c61c0f9134f14cad8ce89dc441d4e465cf10134dfc3112303e46de730646a8c4c563bf853470040b3f6ed52ea7618486e5e9ce789a40463c3ed0ada0483e672b
-
SSDEEP
24576:zQ5aILMCfmAUjzX6xQGCZLFdGm1StE10/Zc9gger:E5aIwC+Agr6S/FFC+I
Malware Config
Signatures
-
KPOT Core Executable 1 IoCs
resource yara_rule behavioral2/files/0x0009000000023266-20.dat family_kpot -
Trickbot x86 loader 1 IoCs
Detected Trickbot's x86 loader that unpacks the x86 payload.
resource yara_rule behavioral2/memory/4472-17-0x0000000002C10000-0x0000000002C39000-memory.dmp trickbot_loader32 -
Executes dropped EXE 3 IoCs
pid Process 1208 4629d2a094013ebaa2c3627e3a08e88a76a0494fee2dd76228d46ead01244e6f.exe 2584 4629d2a094013ebaa2c3627e3a08e88a76a0494fee2dd76228d46ead01244e6f.exe 540 4629d2a094013ebaa2c3627e3a08e88a76a0494fee2dd76228d46ead01244e6f.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeTcbPrivilege 2584 4629d2a094013ebaa2c3627e3a08e88a76a0494fee2dd76228d46ead01244e6f.exe Token: SeTcbPrivilege 540 4629d2a094013ebaa2c3627e3a08e88a76a0494fee2dd76228d46ead01244e6f.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 4472 4528d2a084013ebaa2c3526e3a07e77a65a0484fee2dd65227d45ead01244e5f.exe 1208 4629d2a094013ebaa2c3627e3a08e88a76a0494fee2dd76228d46ead01244e6f.exe 2584 4629d2a094013ebaa2c3627e3a08e88a76a0494fee2dd76228d46ead01244e6f.exe 540 4629d2a094013ebaa2c3627e3a08e88a76a0494fee2dd76228d46ead01244e6f.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4472 wrote to memory of 1208 4472 4528d2a084013ebaa2c3526e3a07e77a65a0484fee2dd65227d45ead01244e5f.exe 91 PID 4472 wrote to memory of 1208 4472 4528d2a084013ebaa2c3526e3a07e77a65a0484fee2dd65227d45ead01244e5f.exe 91 PID 4472 wrote to memory of 1208 4472 4528d2a084013ebaa2c3526e3a07e77a65a0484fee2dd65227d45ead01244e5f.exe 91 PID 1208 wrote to memory of 3060 1208 4629d2a094013ebaa2c3627e3a08e88a76a0494fee2dd76228d46ead01244e6f.exe 92 PID 1208 wrote to memory of 3060 1208 4629d2a094013ebaa2c3627e3a08e88a76a0494fee2dd76228d46ead01244e6f.exe 92 PID 1208 wrote to memory of 3060 1208 4629d2a094013ebaa2c3627e3a08e88a76a0494fee2dd76228d46ead01244e6f.exe 92 PID 1208 wrote to memory of 3060 1208 4629d2a094013ebaa2c3627e3a08e88a76a0494fee2dd76228d46ead01244e6f.exe 92 PID 1208 wrote to memory of 3060 1208 4629d2a094013ebaa2c3627e3a08e88a76a0494fee2dd76228d46ead01244e6f.exe 92 PID 1208 wrote to memory of 3060 1208 4629d2a094013ebaa2c3627e3a08e88a76a0494fee2dd76228d46ead01244e6f.exe 92 PID 1208 wrote to memory of 3060 1208 4629d2a094013ebaa2c3627e3a08e88a76a0494fee2dd76228d46ead01244e6f.exe 92 PID 1208 wrote to memory of 3060 1208 4629d2a094013ebaa2c3627e3a08e88a76a0494fee2dd76228d46ead01244e6f.exe 92 PID 1208 wrote to memory of 3060 1208 4629d2a094013ebaa2c3627e3a08e88a76a0494fee2dd76228d46ead01244e6f.exe 92 PID 1208 wrote to memory of 3060 1208 4629d2a094013ebaa2c3627e3a08e88a76a0494fee2dd76228d46ead01244e6f.exe 92 PID 1208 wrote to memory of 3060 1208 4629d2a094013ebaa2c3627e3a08e88a76a0494fee2dd76228d46ead01244e6f.exe 92 PID 1208 wrote to memory of 3060 1208 4629d2a094013ebaa2c3627e3a08e88a76a0494fee2dd76228d46ead01244e6f.exe 92 PID 1208 wrote to memory of 3060 1208 4629d2a094013ebaa2c3627e3a08e88a76a0494fee2dd76228d46ead01244e6f.exe 92 PID 1208 wrote to memory of 3060 1208 4629d2a094013ebaa2c3627e3a08e88a76a0494fee2dd76228d46ead01244e6f.exe 92 PID 1208 wrote to memory of 3060 1208 4629d2a094013ebaa2c3627e3a08e88a76a0494fee2dd76228d46ead01244e6f.exe 92 PID 1208 wrote to memory of 3060 1208 4629d2a094013ebaa2c3627e3a08e88a76a0494fee2dd76228d46ead01244e6f.exe 92 PID 1208 wrote to memory of 3060 1208 4629d2a094013ebaa2c3627e3a08e88a76a0494fee2dd76228d46ead01244e6f.exe 92 PID 1208 wrote to memory of 3060 1208 4629d2a094013ebaa2c3627e3a08e88a76a0494fee2dd76228d46ead01244e6f.exe 92 PID 1208 wrote to memory of 3060 1208 4629d2a094013ebaa2c3627e3a08e88a76a0494fee2dd76228d46ead01244e6f.exe 92 PID 1208 wrote to memory of 3060 1208 4629d2a094013ebaa2c3627e3a08e88a76a0494fee2dd76228d46ead01244e6f.exe 92 PID 1208 wrote to memory of 3060 1208 4629d2a094013ebaa2c3627e3a08e88a76a0494fee2dd76228d46ead01244e6f.exe 92 PID 1208 wrote to memory of 3060 1208 4629d2a094013ebaa2c3627e3a08e88a76a0494fee2dd76228d46ead01244e6f.exe 92 PID 1208 wrote to memory of 3060 1208 4629d2a094013ebaa2c3627e3a08e88a76a0494fee2dd76228d46ead01244e6f.exe 92 PID 1208 wrote to memory of 3060 1208 4629d2a094013ebaa2c3627e3a08e88a76a0494fee2dd76228d46ead01244e6f.exe 92 PID 1208 wrote to memory of 3060 1208 4629d2a094013ebaa2c3627e3a08e88a76a0494fee2dd76228d46ead01244e6f.exe 92 PID 1208 wrote to memory of 3060 1208 4629d2a094013ebaa2c3627e3a08e88a76a0494fee2dd76228d46ead01244e6f.exe 92 PID 2584 wrote to memory of 1536 2584 4629d2a094013ebaa2c3627e3a08e88a76a0494fee2dd76228d46ead01244e6f.exe 103 PID 2584 wrote to memory of 1536 2584 4629d2a094013ebaa2c3627e3a08e88a76a0494fee2dd76228d46ead01244e6f.exe 103 PID 2584 wrote to memory of 1536 2584 4629d2a094013ebaa2c3627e3a08e88a76a0494fee2dd76228d46ead01244e6f.exe 103 PID 2584 wrote to memory of 1536 2584 4629d2a094013ebaa2c3627e3a08e88a76a0494fee2dd76228d46ead01244e6f.exe 103 PID 2584 wrote to memory of 1536 2584 4629d2a094013ebaa2c3627e3a08e88a76a0494fee2dd76228d46ead01244e6f.exe 103 PID 2584 wrote to memory of 1536 2584 4629d2a094013ebaa2c3627e3a08e88a76a0494fee2dd76228d46ead01244e6f.exe 103 PID 2584 wrote to memory of 1536 2584 4629d2a094013ebaa2c3627e3a08e88a76a0494fee2dd76228d46ead01244e6f.exe 103 PID 2584 wrote to memory of 1536 2584 4629d2a094013ebaa2c3627e3a08e88a76a0494fee2dd76228d46ead01244e6f.exe 103 PID 2584 wrote to memory of 1536 2584 4629d2a094013ebaa2c3627e3a08e88a76a0494fee2dd76228d46ead01244e6f.exe 103 PID 2584 wrote to memory of 1536 2584 4629d2a094013ebaa2c3627e3a08e88a76a0494fee2dd76228d46ead01244e6f.exe 103 PID 2584 wrote to memory of 1536 2584 4629d2a094013ebaa2c3627e3a08e88a76a0494fee2dd76228d46ead01244e6f.exe 103 PID 2584 wrote to memory of 1536 2584 4629d2a094013ebaa2c3627e3a08e88a76a0494fee2dd76228d46ead01244e6f.exe 103 PID 2584 wrote to memory of 1536 2584 4629d2a094013ebaa2c3627e3a08e88a76a0494fee2dd76228d46ead01244e6f.exe 103 PID 2584 wrote to memory of 1536 2584 4629d2a094013ebaa2c3627e3a08e88a76a0494fee2dd76228d46ead01244e6f.exe 103 PID 2584 wrote to memory of 1536 2584 4629d2a094013ebaa2c3627e3a08e88a76a0494fee2dd76228d46ead01244e6f.exe 103 PID 2584 wrote to memory of 1536 2584 4629d2a094013ebaa2c3627e3a08e88a76a0494fee2dd76228d46ead01244e6f.exe 103 PID 2584 wrote to memory of 1536 2584 4629d2a094013ebaa2c3627e3a08e88a76a0494fee2dd76228d46ead01244e6f.exe 103 PID 2584 wrote to memory of 1536 2584 4629d2a094013ebaa2c3627e3a08e88a76a0494fee2dd76228d46ead01244e6f.exe 103 PID 2584 wrote to memory of 1536 2584 4629d2a094013ebaa2c3627e3a08e88a76a0494fee2dd76228d46ead01244e6f.exe 103 PID 2584 wrote to memory of 1536 2584 4629d2a094013ebaa2c3627e3a08e88a76a0494fee2dd76228d46ead01244e6f.exe 103 PID 2584 wrote to memory of 1536 2584 4629d2a094013ebaa2c3627e3a08e88a76a0494fee2dd76228d46ead01244e6f.exe 103 PID 2584 wrote to memory of 1536 2584 4629d2a094013ebaa2c3627e3a08e88a76a0494fee2dd76228d46ead01244e6f.exe 103 PID 2584 wrote to memory of 1536 2584 4629d2a094013ebaa2c3627e3a08e88a76a0494fee2dd76228d46ead01244e6f.exe 103 PID 2584 wrote to memory of 1536 2584 4629d2a094013ebaa2c3627e3a08e88a76a0494fee2dd76228d46ead01244e6f.exe 103 PID 2584 wrote to memory of 1536 2584 4629d2a094013ebaa2c3627e3a08e88a76a0494fee2dd76228d46ead01244e6f.exe 103 PID 2584 wrote to memory of 1536 2584 4629d2a094013ebaa2c3627e3a08e88a76a0494fee2dd76228d46ead01244e6f.exe 103 PID 540 wrote to memory of 1772 540 4629d2a094013ebaa2c3627e3a08e88a76a0494fee2dd76228d46ead01244e6f.exe 105 PID 540 wrote to memory of 1772 540 4629d2a094013ebaa2c3627e3a08e88a76a0494fee2dd76228d46ead01244e6f.exe 105 PID 540 wrote to memory of 1772 540 4629d2a094013ebaa2c3627e3a08e88a76a0494fee2dd76228d46ead01244e6f.exe 105 PID 540 wrote to memory of 1772 540 4629d2a094013ebaa2c3627e3a08e88a76a0494fee2dd76228d46ead01244e6f.exe 105 PID 540 wrote to memory of 1772 540 4629d2a094013ebaa2c3627e3a08e88a76a0494fee2dd76228d46ead01244e6f.exe 105 PID 540 wrote to memory of 1772 540 4629d2a094013ebaa2c3627e3a08e88a76a0494fee2dd76228d46ead01244e6f.exe 105 PID 540 wrote to memory of 1772 540 4629d2a094013ebaa2c3627e3a08e88a76a0494fee2dd76228d46ead01244e6f.exe 105 PID 540 wrote to memory of 1772 540 4629d2a094013ebaa2c3627e3a08e88a76a0494fee2dd76228d46ead01244e6f.exe 105 PID 540 wrote to memory of 1772 540 4629d2a094013ebaa2c3627e3a08e88a76a0494fee2dd76228d46ead01244e6f.exe 105 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\4528d2a084013ebaa2c3526e3a07e77a65a0484fee2dd65227d45ead01244e5f.exe"C:\Users\Admin\AppData\Local\Temp\4528d2a084013ebaa2c3526e3a07e77a65a0484fee2dd65227d45ead01244e5f.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Users\Admin\AppData\Roaming\WinSocket\4629d2a094013ebaa2c3627e3a08e88a76a0494fee2dd76228d46ead01244e6f.exeC:\Users\Admin\AppData\Roaming\WinSocket\4629d2a094013ebaa2c3627e3a08e88a76a0494fee2dd76228d46ead01244e6f.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵PID:3060
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4116 --field-trial-handle=2292,i,2103142837140538807,15881446839139365070,262144 --variations-seed-version /prefetch:81⤵PID:3832
-
C:\Users\Admin\AppData\Roaming\WinSocket\4629d2a094013ebaa2c3627e3a08e88a76a0494fee2dd76228d46ead01244e6f.exeC:\Users\Admin\AppData\Roaming\WinSocket\4629d2a094013ebaa2c3627e3a08e88a76a0494fee2dd76228d46ead01244e6f.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe2⤵PID:1536
-
-
C:\Users\Admin\AppData\Roaming\WinSocket\4629d2a094013ebaa2c3627e3a08e88a76a0494fee2dd76228d46ead01244e6f.exeC:\Users\Admin\AppData\Roaming\WinSocket\4629d2a094013ebaa2c3627e3a08e88a76a0494fee2dd76228d46ead01244e6f.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:540 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe2⤵PID:1772
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\WinSocket\4629d2a094013ebaa2c3627e3a08e88a76a0494fee2dd76228d46ead01244e6f.exe
Filesize1.1MB
MD51aee717ecfeaae4a113f6d0a2e3209f1
SHA179ce52468b618b6e76aea967f1839ff7353609dc
SHA2564528d2a084013ebaa2c3526e3a07e77a65a0484fee2dd65227d45ead01244e5f
SHA512c61c0f9134f14cad8ce89dc441d4e465cf10134dfc3112303e46de730646a8c4c563bf853470040b3f6ed52ea7618486e5e9ce789a40463c3ed0ada0483e672b
-
Filesize
40KB
MD5feaf2a60b6fe8730bc34b7f13b0f1be1
SHA106cfae61bf6c8d556dfb8b2d7242bc98c6656ef5
SHA2568aa122dda9647833474604991314aa838cd55c4cfff311a54729a8101d65d96d
SHA512f32b3a046accecb704844a532ec87698360841627abb3d2765ec900333af017a727834b0d9033ab4bdbcb00dc0c413f98bdbdfdd2d1edba9ebde45aef0c35a26