Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
09/06/2024, 07:02
Static task
static1
Behavioral task
behavioral1
Sample
b0daffd432373323979bb917d9ef91a53fa097cfee6e33194c0166981c7d6a69.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
b0daffd432373323979bb917d9ef91a53fa097cfee6e33194c0166981c7d6a69.exe
Resource
win10v2004-20240226-en
General
-
Target
b0daffd432373323979bb917d9ef91a53fa097cfee6e33194c0166981c7d6a69.exe
-
Size
12KB
-
MD5
7806a8806149ee00b896686c0f679b50
-
SHA1
6e8f67ebb0b728c46dcbf9e758e0a3824b3d658c
-
SHA256
b0daffd432373323979bb917d9ef91a53fa097cfee6e33194c0166981c7d6a69
-
SHA512
2686af62d3a767323642e11d7c2edcc1861bbb9c30de6a6b4a42e88f1572ffc81dfb36967bd9f9fb1858452f726853ef4cc8a09422caf0b0fce3be0b433b1796
-
SSDEEP
384:+L7li/2zHq2DcEQvdhcJKLTp/NK9xaJ4:oLM/Q9cJ4
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation b0daffd432373323979bb917d9ef91a53fa097cfee6e33194c0166981c7d6a69.exe -
Deletes itself 1 IoCs
pid Process 1764 tmpE7B1.tmp.exe -
Executes dropped EXE 1 IoCs
pid Process 1764 tmpE7B1.tmp.exe -
Uses the VBS compiler for execution 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 656 b0daffd432373323979bb917d9ef91a53fa097cfee6e33194c0166981c7d6a69.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 656 wrote to memory of 1424 656 b0daffd432373323979bb917d9ef91a53fa097cfee6e33194c0166981c7d6a69.exe 92 PID 656 wrote to memory of 1424 656 b0daffd432373323979bb917d9ef91a53fa097cfee6e33194c0166981c7d6a69.exe 92 PID 656 wrote to memory of 1424 656 b0daffd432373323979bb917d9ef91a53fa097cfee6e33194c0166981c7d6a69.exe 92 PID 1424 wrote to memory of 2068 1424 vbc.exe 94 PID 1424 wrote to memory of 2068 1424 vbc.exe 94 PID 1424 wrote to memory of 2068 1424 vbc.exe 94 PID 656 wrote to memory of 1764 656 b0daffd432373323979bb917d9ef91a53fa097cfee6e33194c0166981c7d6a69.exe 95 PID 656 wrote to memory of 1764 656 b0daffd432373323979bb917d9ef91a53fa097cfee6e33194c0166981c7d6a69.exe 95 PID 656 wrote to memory of 1764 656 b0daffd432373323979bb917d9ef91a53fa097cfee6e33194c0166981c7d6a69.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\b0daffd432373323979bb917d9ef91a53fa097cfee6e33194c0166981c7d6a69.exe"C:\Users\Admin\AppData\Local\Temp\b0daffd432373323979bb917d9ef91a53fa097cfee6e33194c0166981c7d6a69.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:656 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\myjalmya\myjalmya.cmdline"2⤵
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3B4.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcED0A5D98747B433BB76124DDD3FC63C.TMP"3⤵PID:2068
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmpE7B1.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE7B1.tmp.exe" C:\Users\Admin\AppData\Local\Temp\b0daffd432373323979bb917d9ef91a53fa097cfee6e33194c0166981c7d6a69.exe2⤵
- Deletes itself
- Executes dropped EXE
PID:1764
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3096 --field-trial-handle=2284,i,15722001240173834669,15048020084704567542,262144 --variations-seed-version /prefetch:81⤵PID:4944
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD541388ddb1f85f5116ee9927215d49a8c
SHA1b2d04229b21b457849a0ccce2c0e3aadbbbf3b2b
SHA256973e878d38d8e4155949dfa3a3f81db2246884ee637bd4de94faca5fe0c3387e
SHA51221c5f5fc300c67b5601e90a46322a6d6f44cc85bec9f158b5eae85497f8088456b4275bd60f352527e49c597ff14a35032e8b1cbc0f2659648a7a736016e28dd
-
Filesize
1KB
MD5ed70e94029d799be9ca0b5f1e5445c67
SHA1487baee41027133579a1dacce4b642a760e7cde0
SHA256f547efb2563057f916c3f4f97bb5bfa3e6a7437707479107b153787994598655
SHA512d23366b2e80e3b6084db0120811d1349fded9bfb513668318760b34072c455c987708b9486ed42bbd51b1fb8170cfcfd6d05dea694229892147b572706b6700b
-
Filesize
2KB
MD5f071aaf780452b2fd06982f91b5d321b
SHA1ac78d596a24fb0ab9881f125762427ab42d76f2c
SHA256709a0280a76d6e09b2b1848b97602d1e7e1a57441675ba33cf97ce1ac0c2c4a7
SHA5127c142de876183d0539640d64d85e60dc8bc6e13edf41675d2f5204e0992b54f28e068d23bc74534b61960ac1ea8921fe1b93bfb116303c786ad7a9419fac62f8
-
Filesize
273B
MD5a483a86dab0c8220c12997ee29267287
SHA141bd3e61d1d363c11bb629d9edc962196eaf02e0
SHA256b392124274ce00cf5d528eba341b6a9be0348fa6562ff67e407245f35324a534
SHA5121c601d543f53e077d8c621d68315e5547c05901e822294e40c473a83113f0658aa620eb322b4def2a432fc991890a71e82de541a8f123f574c0682b07e11b323
-
Filesize
12KB
MD59b5cff4009f08fc0553450df5124c7ca
SHA180c165ea60efb2307481660a44a391abe4051e75
SHA25696c2567f33afe9cdbd119f741a87db120e0b105d8ad877ebbe0747cf564b8ce2
SHA5122d024cf9c315c5ed4aff3218a0d82a5cc020464a42b6a5a574ec993f988ff06c740d9d4c3e32efe0fb5530c994510c31f82ab2c3397c718f51d9e5020a3baa0b
-
Filesize
1KB
MD5fe2f8d24313afa7aa685dcd605d50e6e
SHA16071a2b06e44962c9873db5ffb221d7fcff44de4
SHA2561b477af0fb9f24c465f5f0cbcfcd903065d2df8f3efefe0139aa19bf4d043aab
SHA51262022aa4a73a51867be5761ab4b695aaa5af0e3f411b4a6ac302468f858ad58766b2bd3b42566e06645955c99318e2a45c01427769d38e1ce18df71cce0bbada