Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
138s -
max time network
132s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
26/05/2024, 03:58
Behavioral task
behavioral1
Sample
e0e45ed36736243b070af635c9efa1f3a8a5f16d56900ffdc76956660c498876.exe
Resource
win7-20231129-en
General
-
Target
e0e45ed36736243b070af635c9efa1f3a8a5f16d56900ffdc76956660c498876.exe
-
Size
1.0MB
-
MD5
075871f9bc9e82f769ac26bb9c6fb6b3
-
SHA1
9ac632584d336b025130af45da627c1c0bd68ba2
-
SHA256
e0e45ed36736243b070af635c9efa1f3a8a5f16d56900ffdc76956660c498876
-
SHA512
90a4089cf25493f7d0489caa0ee93b96cbac9e15d2596f1f7a03ec1e59c3dd85a63ea6a4c7cf9b40cbea87d15b0884c442f75a33cce53d6619bb33375f99b3f1
-
SSDEEP
24576:zQ5aILMCfmAUjzX6xQ0+wCIygDsAUSTsU9CT6:E5aIwC+Agr6SNass
Malware Config
Signatures
-
KPOT Core Executable 1 IoCs
resource yara_rule behavioral2/files/0x000700000002354f-21.dat family_kpot -
Trickbot x86 loader 1 IoCs
Detected Trickbot's x86 loader that unpacks the x86 payload.
resource yara_rule behavioral2/memory/3212-15-0x00000000021E0000-0x0000000002209000-memory.dmp trickbot_loader32 -
Executes dropped EXE 3 IoCs
pid Process 2928 e0e46ed37837243b080af736c9efa1f3a9a6f17d67900ffdc87967770c499987.exe 2840 e0e46ed37837243b080af736c9efa1f3a9a6f17d67900ffdc87967770c499987.exe 4828 e0e46ed37837243b080af736c9efa1f3a9a6f17d67900ffdc87967770c499987.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeTcbPrivilege 2840 e0e46ed37837243b080af736c9efa1f3a9a6f17d67900ffdc87967770c499987.exe Token: SeTcbPrivilege 4828 e0e46ed37837243b080af736c9efa1f3a9a6f17d67900ffdc87967770c499987.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 3212 e0e45ed36736243b070af635c9efa1f3a8a5f16d56900ffdc76956660c498876.exe 2928 e0e46ed37837243b080af736c9efa1f3a9a6f17d67900ffdc87967770c499987.exe 2840 e0e46ed37837243b080af736c9efa1f3a9a6f17d67900ffdc87967770c499987.exe 4828 e0e46ed37837243b080af736c9efa1f3a9a6f17d67900ffdc87967770c499987.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3212 wrote to memory of 2928 3212 e0e45ed36736243b070af635c9efa1f3a8a5f16d56900ffdc76956660c498876.exe 90 PID 3212 wrote to memory of 2928 3212 e0e45ed36736243b070af635c9efa1f3a8a5f16d56900ffdc76956660c498876.exe 90 PID 3212 wrote to memory of 2928 3212 e0e45ed36736243b070af635c9efa1f3a8a5f16d56900ffdc76956660c498876.exe 90 PID 2928 wrote to memory of 4100 2928 e0e46ed37837243b080af736c9efa1f3a9a6f17d67900ffdc87967770c499987.exe 91 PID 2928 wrote to memory of 4100 2928 e0e46ed37837243b080af736c9efa1f3a9a6f17d67900ffdc87967770c499987.exe 91 PID 2928 wrote to memory of 4100 2928 e0e46ed37837243b080af736c9efa1f3a9a6f17d67900ffdc87967770c499987.exe 91 PID 2928 wrote to memory of 4100 2928 e0e46ed37837243b080af736c9efa1f3a9a6f17d67900ffdc87967770c499987.exe 91 PID 2928 wrote to memory of 4100 2928 e0e46ed37837243b080af736c9efa1f3a9a6f17d67900ffdc87967770c499987.exe 91 PID 2928 wrote to memory of 4100 2928 e0e46ed37837243b080af736c9efa1f3a9a6f17d67900ffdc87967770c499987.exe 91 PID 2928 wrote to memory of 4100 2928 e0e46ed37837243b080af736c9efa1f3a9a6f17d67900ffdc87967770c499987.exe 91 PID 2928 wrote to memory of 4100 2928 e0e46ed37837243b080af736c9efa1f3a9a6f17d67900ffdc87967770c499987.exe 91 PID 2928 wrote to memory of 4100 2928 e0e46ed37837243b080af736c9efa1f3a9a6f17d67900ffdc87967770c499987.exe 91 PID 2928 wrote to memory of 4100 2928 e0e46ed37837243b080af736c9efa1f3a9a6f17d67900ffdc87967770c499987.exe 91 PID 2928 wrote to memory of 4100 2928 e0e46ed37837243b080af736c9efa1f3a9a6f17d67900ffdc87967770c499987.exe 91 PID 2928 wrote to memory of 4100 2928 e0e46ed37837243b080af736c9efa1f3a9a6f17d67900ffdc87967770c499987.exe 91 PID 2928 wrote to memory of 4100 2928 e0e46ed37837243b080af736c9efa1f3a9a6f17d67900ffdc87967770c499987.exe 91 PID 2928 wrote to memory of 4100 2928 e0e46ed37837243b080af736c9efa1f3a9a6f17d67900ffdc87967770c499987.exe 91 PID 2928 wrote to memory of 4100 2928 e0e46ed37837243b080af736c9efa1f3a9a6f17d67900ffdc87967770c499987.exe 91 PID 2928 wrote to memory of 4100 2928 e0e46ed37837243b080af736c9efa1f3a9a6f17d67900ffdc87967770c499987.exe 91 PID 2928 wrote to memory of 4100 2928 e0e46ed37837243b080af736c9efa1f3a9a6f17d67900ffdc87967770c499987.exe 91 PID 2928 wrote to memory of 4100 2928 e0e46ed37837243b080af736c9efa1f3a9a6f17d67900ffdc87967770c499987.exe 91 PID 2928 wrote to memory of 4100 2928 e0e46ed37837243b080af736c9efa1f3a9a6f17d67900ffdc87967770c499987.exe 91 PID 2928 wrote to memory of 4100 2928 e0e46ed37837243b080af736c9efa1f3a9a6f17d67900ffdc87967770c499987.exe 91 PID 2928 wrote to memory of 4100 2928 e0e46ed37837243b080af736c9efa1f3a9a6f17d67900ffdc87967770c499987.exe 91 PID 2928 wrote to memory of 4100 2928 e0e46ed37837243b080af736c9efa1f3a9a6f17d67900ffdc87967770c499987.exe 91 PID 2928 wrote to memory of 4100 2928 e0e46ed37837243b080af736c9efa1f3a9a6f17d67900ffdc87967770c499987.exe 91 PID 2928 wrote to memory of 4100 2928 e0e46ed37837243b080af736c9efa1f3a9a6f17d67900ffdc87967770c499987.exe 91 PID 2928 wrote to memory of 4100 2928 e0e46ed37837243b080af736c9efa1f3a9a6f17d67900ffdc87967770c499987.exe 91 PID 2928 wrote to memory of 4100 2928 e0e46ed37837243b080af736c9efa1f3a9a6f17d67900ffdc87967770c499987.exe 91 PID 2840 wrote to memory of 4536 2840 e0e46ed37837243b080af736c9efa1f3a9a6f17d67900ffdc87967770c499987.exe 110 PID 2840 wrote to memory of 4536 2840 e0e46ed37837243b080af736c9efa1f3a9a6f17d67900ffdc87967770c499987.exe 110 PID 2840 wrote to memory of 4536 2840 e0e46ed37837243b080af736c9efa1f3a9a6f17d67900ffdc87967770c499987.exe 110 PID 2840 wrote to memory of 4536 2840 e0e46ed37837243b080af736c9efa1f3a9a6f17d67900ffdc87967770c499987.exe 110 PID 2840 wrote to memory of 4536 2840 e0e46ed37837243b080af736c9efa1f3a9a6f17d67900ffdc87967770c499987.exe 110 PID 2840 wrote to memory of 4536 2840 e0e46ed37837243b080af736c9efa1f3a9a6f17d67900ffdc87967770c499987.exe 110 PID 2840 wrote to memory of 4536 2840 e0e46ed37837243b080af736c9efa1f3a9a6f17d67900ffdc87967770c499987.exe 110 PID 2840 wrote to memory of 4536 2840 e0e46ed37837243b080af736c9efa1f3a9a6f17d67900ffdc87967770c499987.exe 110 PID 2840 wrote to memory of 4536 2840 e0e46ed37837243b080af736c9efa1f3a9a6f17d67900ffdc87967770c499987.exe 110 PID 2840 wrote to memory of 4536 2840 e0e46ed37837243b080af736c9efa1f3a9a6f17d67900ffdc87967770c499987.exe 110 PID 2840 wrote to memory of 4536 2840 e0e46ed37837243b080af736c9efa1f3a9a6f17d67900ffdc87967770c499987.exe 110 PID 2840 wrote to memory of 4536 2840 e0e46ed37837243b080af736c9efa1f3a9a6f17d67900ffdc87967770c499987.exe 110 PID 2840 wrote to memory of 4536 2840 e0e46ed37837243b080af736c9efa1f3a9a6f17d67900ffdc87967770c499987.exe 110 PID 2840 wrote to memory of 4536 2840 e0e46ed37837243b080af736c9efa1f3a9a6f17d67900ffdc87967770c499987.exe 110 PID 2840 wrote to memory of 4536 2840 e0e46ed37837243b080af736c9efa1f3a9a6f17d67900ffdc87967770c499987.exe 110 PID 2840 wrote to memory of 4536 2840 e0e46ed37837243b080af736c9efa1f3a9a6f17d67900ffdc87967770c499987.exe 110 PID 2840 wrote to memory of 4536 2840 e0e46ed37837243b080af736c9efa1f3a9a6f17d67900ffdc87967770c499987.exe 110 PID 2840 wrote to memory of 4536 2840 e0e46ed37837243b080af736c9efa1f3a9a6f17d67900ffdc87967770c499987.exe 110 PID 2840 wrote to memory of 4536 2840 e0e46ed37837243b080af736c9efa1f3a9a6f17d67900ffdc87967770c499987.exe 110 PID 2840 wrote to memory of 4536 2840 e0e46ed37837243b080af736c9efa1f3a9a6f17d67900ffdc87967770c499987.exe 110 PID 2840 wrote to memory of 4536 2840 e0e46ed37837243b080af736c9efa1f3a9a6f17d67900ffdc87967770c499987.exe 110 PID 2840 wrote to memory of 4536 2840 e0e46ed37837243b080af736c9efa1f3a9a6f17d67900ffdc87967770c499987.exe 110 PID 2840 wrote to memory of 4536 2840 e0e46ed37837243b080af736c9efa1f3a9a6f17d67900ffdc87967770c499987.exe 110 PID 2840 wrote to memory of 4536 2840 e0e46ed37837243b080af736c9efa1f3a9a6f17d67900ffdc87967770c499987.exe 110 PID 2840 wrote to memory of 4536 2840 e0e46ed37837243b080af736c9efa1f3a9a6f17d67900ffdc87967770c499987.exe 110 PID 2840 wrote to memory of 4536 2840 e0e46ed37837243b080af736c9efa1f3a9a6f17d67900ffdc87967770c499987.exe 110 PID 4828 wrote to memory of 2536 4828 e0e46ed37837243b080af736c9efa1f3a9a6f17d67900ffdc87967770c499987.exe 119 PID 4828 wrote to memory of 2536 4828 e0e46ed37837243b080af736c9efa1f3a9a6f17d67900ffdc87967770c499987.exe 119 PID 4828 wrote to memory of 2536 4828 e0e46ed37837243b080af736c9efa1f3a9a6f17d67900ffdc87967770c499987.exe 119 PID 4828 wrote to memory of 2536 4828 e0e46ed37837243b080af736c9efa1f3a9a6f17d67900ffdc87967770c499987.exe 119 PID 4828 wrote to memory of 2536 4828 e0e46ed37837243b080af736c9efa1f3a9a6f17d67900ffdc87967770c499987.exe 119 PID 4828 wrote to memory of 2536 4828 e0e46ed37837243b080af736c9efa1f3a9a6f17d67900ffdc87967770c499987.exe 119 PID 4828 wrote to memory of 2536 4828 e0e46ed37837243b080af736c9efa1f3a9a6f17d67900ffdc87967770c499987.exe 119 PID 4828 wrote to memory of 2536 4828 e0e46ed37837243b080af736c9efa1f3a9a6f17d67900ffdc87967770c499987.exe 119 PID 4828 wrote to memory of 2536 4828 e0e46ed37837243b080af736c9efa1f3a9a6f17d67900ffdc87967770c499987.exe 119 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\e0e45ed36736243b070af635c9efa1f3a8a5f16d56900ffdc76956660c498876.exe"C:\Users\Admin\AppData\Local\Temp\e0e45ed36736243b070af635c9efa1f3a8a5f16d56900ffdc76956660c498876.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3212 -
C:\Users\Admin\AppData\Roaming\WinSocket\e0e46ed37837243b080af736c9efa1f3a9a6f17d67900ffdc87967770c499987.exeC:\Users\Admin\AppData\Roaming\WinSocket\e0e46ed37837243b080af736c9efa1f3a9a6f17d67900ffdc87967770c499987.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵PID:4100
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4400,i,16710585221322798697,8586257254049248207,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:81⤵PID:4464
-
C:\Users\Admin\AppData\Roaming\WinSocket\e0e46ed37837243b080af736c9efa1f3a9a6f17d67900ffdc87967770c499987.exeC:\Users\Admin\AppData\Roaming\WinSocket\e0e46ed37837243b080af736c9efa1f3a9a6f17d67900ffdc87967770c499987.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe2⤵PID:4536
-
-
C:\Users\Admin\AppData\Roaming\WinSocket\e0e46ed37837243b080af736c9efa1f3a9a6f17d67900ffdc87967770c499987.exeC:\Users\Admin\AppData\Roaming\WinSocket\e0e46ed37837243b080af736c9efa1f3a9a6f17d67900ffdc87967770c499987.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe2⤵PID:2536
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\WinSocket\e0e46ed37837243b080af736c9efa1f3a9a6f17d67900ffdc87967770c499987.exe
Filesize1.0MB
MD5075871f9bc9e82f769ac26bb9c6fb6b3
SHA19ac632584d336b025130af45da627c1c0bd68ba2
SHA256e0e45ed36736243b070af635c9efa1f3a8a5f16d56900ffdc76956660c498876
SHA51290a4089cf25493f7d0489caa0ee93b96cbac9e15d2596f1f7a03ec1e59c3dd85a63ea6a4c7cf9b40cbea87d15b0884c442f75a33cce53d6619bb33375f99b3f1
-
Filesize
35KB
MD57176e768438bdd83d532b74912cdfea4
SHA1bb5126ae337809ca711a7078f2eabb70024f757a
SHA256e824eb65ea436d3f0fd06dafb500cd0b4c524cbecd5ce5802c6af72d65f34ecf
SHA5123223a7fcaa0dd40d792b725e679896b28b4e86f08fad3387e040abf137d10c0c492152fe32727664639b5caecbf92410fb8391c555d5a5b2e666aff0271f0415