Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
23s -
max time network
102s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
29/05/2024, 20:04
Static task
static1
Behavioral task
behavioral1
Sample
2d8e470786747dcaae274468c01402626471b0d450791ab5564c47cdfa1680ba.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2d8e470786747dcaae274468c01402626471b0d450791ab5564c47cdfa1680ba.exe
Resource
win10v2004-20240508-en
General
-
Target
2d8e470786747dcaae274468c01402626471b0d450791ab5564c47cdfa1680ba.exe
-
Size
538KB
-
MD5
483646523ab5bb962d62c958147b2e30
-
SHA1
bb7c4a49be3c49f788102c63743c7a4f2692122c
-
SHA256
2d8e470786747dcaae274468c01402626471b0d450791ab5564c47cdfa1680ba
-
SHA512
9bc2dd0751789c23c1efa19f65b9b0620b6a369e218c060b63d30590300f8946c5b9d5227f166ded057b04180aeda5a88e93261a8e6fc86da358d4eff0efd790
-
SSDEEP
12288:wlbk+h1gL5pRTcAkS/3hzN8qE43fm78Vd:Wbk+w5jcAkSYqyEd
Malware Config
Signatures
-
UPX dump on OEP (original entry point) 8 IoCs
resource yara_rule behavioral2/memory/3408-0-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral2/files/0x00090000000233fa-3.dat UPX behavioral2/memory/4468-8-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral2/memory/3408-10-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral2/files/0x0007000000023404-21.dat UPX behavioral2/memory/1804-23-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral2/memory/2560-20-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral2/memory/4468-24-0x0000000000400000-0x000000000041B000-memory.dmp UPX -
Executes dropped EXE 4 IoCs
pid Process 4468 MSWDM.EXE 1804 MSWDM.EXE 3024 2D8E470786747DCAAE274468C01402626471B0D450791AB5564C47CDFA1680BA.EXE 2560 MSWDM.EXE -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE" 2d8e470786747dcaae274468c01402626471b0d450791ab5564c47cdfa1680ba.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE" 2d8e470786747dcaae274468c01402626471b0d450791ab5564c47cdfa1680ba.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE" MSWDM.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE" MSWDM.EXE -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\WINDOWS\MSWDM.EXE 2d8e470786747dcaae274468c01402626471b0d450791ab5564c47cdfa1680ba.exe File opened for modification C:\Windows\dev42E5.tmp 2d8e470786747dcaae274468c01402626471b0d450791ab5564c47cdfa1680ba.exe File opened for modification C:\Windows\dev42E5.tmp MSWDM.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1804 MSWDM.EXE 1804 MSWDM.EXE -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 3408 wrote to memory of 4468 3408 2d8e470786747dcaae274468c01402626471b0d450791ab5564c47cdfa1680ba.exe 83 PID 3408 wrote to memory of 4468 3408 2d8e470786747dcaae274468c01402626471b0d450791ab5564c47cdfa1680ba.exe 83 PID 3408 wrote to memory of 4468 3408 2d8e470786747dcaae274468c01402626471b0d450791ab5564c47cdfa1680ba.exe 83 PID 3408 wrote to memory of 1804 3408 2d8e470786747dcaae274468c01402626471b0d450791ab5564c47cdfa1680ba.exe 84 PID 3408 wrote to memory of 1804 3408 2d8e470786747dcaae274468c01402626471b0d450791ab5564c47cdfa1680ba.exe 84 PID 3408 wrote to memory of 1804 3408 2d8e470786747dcaae274468c01402626471b0d450791ab5564c47cdfa1680ba.exe 84 PID 1804 wrote to memory of 3024 1804 MSWDM.EXE 85 PID 1804 wrote to memory of 3024 1804 MSWDM.EXE 85 PID 1804 wrote to memory of 2560 1804 MSWDM.EXE 87 PID 1804 wrote to memory of 2560 1804 MSWDM.EXE 87 PID 1804 wrote to memory of 2560 1804 MSWDM.EXE 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\2d8e470786747dcaae274468c01402626471b0d450791ab5564c47cdfa1680ba.exe"C:\Users\Admin\AppData\Local\Temp\2d8e470786747dcaae274468c01402626471b0d450791ab5564c47cdfa1680ba.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\WINDOWS\MSWDM.EXE"C:\WINDOWS\MSWDM.EXE"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:4468
-
-
C:\WINDOWS\MSWDM.EXE-r!C:\Windows\dev42E5.tmp!C:\Users\Admin\AppData\Local\Temp\2d8e470786747dcaae274468c01402626471b0d450791ab5564c47cdfa1680ba.exe! !2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\2D8E470786747DCAAE274468C01402626471B0D450791AB5564C47CDFA1680BA.EXE
- Executes dropped EXE
PID:3024
-
-
C:\WINDOWS\MSWDM.EXE-e!C:\Windows\dev42E5.tmp!C:\Users\Admin\AppData\Local\Temp\2D8E470786747DCAAE274468C01402626471B0D450791AB5564C47CDFA1680BA.EXE!3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2560
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\2D8E470786747DCAAE274468C01402626471B0D450791AB5564C47CDFA1680BA.EXE
Filesize538KB
MD516c2c1ad899ed91db1e77f88820e8d2a
SHA1131e8ee1e9c5049cd385e178b324af2439a58072
SHA2569e30b395f1a32733798c41c53b3d0646ca771474633edfaf7ea0e9c9cee5d975
SHA512db517d85bdca2b291dba455c9856581f2ef5a22f8f8033807a25b7f264c5b18f484ce2d6e51d26f9bad898b8d5d4e9e4a1591bfc4b6d7cdeca37ec7c984c9561
-
Filesize
80KB
MD54ab094d42560608f8a0d136b7f1dec09
SHA16d767dbadf7ce1283eba38cfe72f4b26c3df4b9c
SHA256966657fe798be044425b81c853a453e33c6d98b9a2060d26a7e4b460770c5080
SHA51256fa8e60b391ebd7e08a774b0c82388f55967f9260f4b46ea6737ab73b8c6fef059e2be5c646cb3be75af21d58ca1ca534cb2f45eee0c49f6ed77c21bb647701
-
Filesize
458KB
MD5619f7135621b50fd1900ff24aade1524
SHA16c7ea8bbd435163ae3945cbef30ef6b9872a4591
SHA256344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2
SHA5122c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628