Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
09/06/2024, 04:14
Static task
static1
Behavioral task
behavioral1
Sample
8a69b67e8b8a981a35eec7a6165f968b9a48ff5f0ea2d9c7a2ad8d69c1807f69.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
8a69b67e8b8a981a35eec7a6165f968b9a48ff5f0ea2d9c7a2ad8d69c1807f69.exe
Resource
win10v2004-20240508-en
General
-
Target
8a69b67e8b8a981a35eec7a6165f968b9a48ff5f0ea2d9c7a2ad8d69c1807f69.exe
-
Size
34KB
-
MD5
fd767463478745f789f6195c82359c0a
-
SHA1
2764e736946ea17a453b015c5c086e21cf550566
-
SHA256
8a69b67e8b8a981a35eec7a6165f968b9a48ff5f0ea2d9c7a2ad8d69c1807f69
-
SHA512
12a1dd3fab74aa429c2a359e68c5bd2dd0d46f5acce6d753ab1c7d58600c69c9b91b698fed94bd4ec64ed75368b9c0f48a16f6bb0df03b34afc8a164993e40a2
-
SSDEEP
768:DqPJtsA6C1VqahohtgVRNToV7TtRu8rM0wYVFl2g5coW58dO0xXHV2EfKYfdhNhQ:DqMA6C1VqaqhtgVRNToV7TtRu8rM0wYw
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 116 microsofthelp.exe -
Executes dropped EXE 1 IoCs
pid Process 116 microsofthelp.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\microsofthelp = "C:\\Windows\\microsofthelp.exe" 8a69b67e8b8a981a35eec7a6165f968b9a48ff5f0ea2d9c7a2ad8d69c1807f69.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\microsofthelp.exe 8a69b67e8b8a981a35eec7a6165f968b9a48ff5f0ea2d9c7a2ad8d69c1807f69.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2160 wrote to memory of 116 2160 8a69b67e8b8a981a35eec7a6165f968b9a48ff5f0ea2d9c7a2ad8d69c1807f69.exe 83 PID 2160 wrote to memory of 116 2160 8a69b67e8b8a981a35eec7a6165f968b9a48ff5f0ea2d9c7a2ad8d69c1807f69.exe 83 PID 2160 wrote to memory of 116 2160 8a69b67e8b8a981a35eec7a6165f968b9a48ff5f0ea2d9c7a2ad8d69c1807f69.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\8a69b67e8b8a981a35eec7a6165f968b9a48ff5f0ea2d9c7a2ad8d69c1807f69.exe"C:\Users\Admin\AppData\Local\Temp\8a69b67e8b8a981a35eec7a6165f968b9a48ff5f0ea2d9c7a2ad8d69c1807f69.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Windows\microsofthelp.exe"C:\Windows\microsofthelp.exe"2⤵
- Deletes itself
- Executes dropped EXE
PID:116
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
35KB
MD55548a18a3150b7fddd7b99116c7b79bd
SHA106050c9566066811e1538b3e3db240ccfc8f62c2
SHA2569a4dd5a01f331d28ca65eb15bcaa361c25c90993c5ad7ed6f6242a5dbbcd741c
SHA5127c6101c2b139d8242c2301115077b6624e759927891a562145b5a76178219649e7339ffa5b52437b69421737327057c0ac85f2a14b59172b567670bc48fc391c