Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
14/06/2024, 01:40
Static task
static1
Behavioral task
behavioral1
Sample
9c581c4cec9f25a55ee985d08ad3ba40a268aff6ea05aebff399c31f86b98065.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
9c581c4cec9f25a55ee985d08ad3ba40a268aff6ea05aebff399c31f86b98065.exe
Resource
win10v2004-20240508-en
General
-
Target
9c581c4cec9f25a55ee985d08ad3ba40a268aff6ea05aebff399c31f86b98065.exe
-
Size
3.3MB
-
MD5
1869978103ed372145fbf14975f8c56e
-
SHA1
a15f53cb65e2ecfd3c5112711cceb30b9ab88257
-
SHA256
9c581c4cec9f25a55ee985d08ad3ba40a268aff6ea05aebff399c31f86b98065
-
SHA512
b306f831e52bc468ee862afc5909dd6e98f3fab2dca12cb2536f2f4dcdfd919bdf6290dee8dc9c5bffc5a52d808834a5489cb3f403af053bb805d66ce6ecd6a6
-
SSDEEP
24576:0Ln4nHjmrtOSkcMfMFQtpHv85qvdE/ta/7SyI:0LnUHjmb0EFQtpHE5qvdE/ADSb
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 9c581c4cec9f25a55ee985d08ad3ba40a268aff6ea05aebff399c31f86b98065.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths 9c581c4cec9f25a55ee985d08ad3ba40a268aff6ea05aebff399c31f86b98065.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\9c581c4cec9f25a55ee985d08ad3ba40a268aff6ea05aebff399c31f86b98065.exe = "0" 9c581c4cec9f25a55ee985d08ad3ba40a268aff6ea05aebff399c31f86b98065.exe -
Detects executables packed with or use KoiVM 1 IoCs
resource yara_rule behavioral2/memory/2068-3-0x00000155C3250000-0x00000155C32EA000-memory.dmp INDICATOR_EXE_Packed_KoiVM -
Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \Registry\User\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run grpconv.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\MRJ8YPRPZPT = "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe" grpconv.exe -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2744 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 9c581c4cec9f25a55ee985d08ad3ba40a268aff6ea05aebff399c31f86b98065.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths 9c581c4cec9f25a55ee985d08ad3ba40a268aff6ea05aebff399c31f86b98065.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions 9c581c4cec9f25a55ee985d08ad3ba40a268aff6ea05aebff399c31f86b98065.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\9c581c4cec9f25a55ee985d08ad3ba40a268aff6ea05aebff399c31f86b98065.exe = "0" 9c581c4cec9f25a55ee985d08ad3ba40a268aff6ea05aebff399c31f86b98065.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 9c581c4cec9f25a55ee985d08ad3ba40a268aff6ea05aebff399c31f86b98065.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 9c581c4cec9f25a55ee985d08ad3ba40a268aff6ea05aebff399c31f86b98065.exe -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 2068 set thread context of 4192 2068 9c581c4cec9f25a55ee985d08ad3ba40a268aff6ea05aebff399c31f86b98065.exe 88 PID 4192 set thread context of 3404 4192 iexplore.exe 56 PID 4192 set thread context of 3376 4192 iexplore.exe 94 PID 3376 set thread context of 3404 3376 grpconv.exe 56 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2744 powershell.exe 2744 powershell.exe 4192 iexplore.exe 4192 iexplore.exe 4192 iexplore.exe 4192 iexplore.exe 4192 iexplore.exe 4192 iexplore.exe 4192 iexplore.exe 4192 iexplore.exe 4192 iexplore.exe 4192 iexplore.exe 4192 iexplore.exe 4192 iexplore.exe 4192 iexplore.exe 4192 iexplore.exe 4192 iexplore.exe 4192 iexplore.exe 3376 grpconv.exe 3376 grpconv.exe 3376 grpconv.exe 3376 grpconv.exe 3376 grpconv.exe 3376 grpconv.exe 3376 grpconv.exe 3376 grpconv.exe 3376 grpconv.exe 3376 grpconv.exe 3376 grpconv.exe 3376 grpconv.exe 3376 grpconv.exe 3376 grpconv.exe 3376 grpconv.exe 3376 grpconv.exe 3376 grpconv.exe 3376 grpconv.exe 3376 grpconv.exe 3376 grpconv.exe 3376 grpconv.exe 3376 grpconv.exe 3376 grpconv.exe 3376 grpconv.exe 3376 grpconv.exe 3376 grpconv.exe 3376 grpconv.exe 3376 grpconv.exe 3376 grpconv.exe 3376 grpconv.exe 3376 grpconv.exe 3376 grpconv.exe 3376 grpconv.exe 3376 grpconv.exe 3376 grpconv.exe 3376 grpconv.exe 3376 grpconv.exe 3376 grpconv.exe 3376 grpconv.exe 3376 grpconv.exe 3376 grpconv.exe 3376 grpconv.exe 3376 grpconv.exe 3376 grpconv.exe 3376 grpconv.exe 3376 grpconv.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 4192 iexplore.exe 3404 Explorer.EXE 3404 Explorer.EXE 3376 grpconv.exe 3376 grpconv.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2744 powershell.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 3404 Explorer.EXE 3404 Explorer.EXE 3404 Explorer.EXE -
Suspicious use of SendNotifyMessage 3 IoCs
pid Process 3404 Explorer.EXE 3404 Explorer.EXE 3404 Explorer.EXE -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 3404 Explorer.EXE -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2068 wrote to memory of 2744 2068 9c581c4cec9f25a55ee985d08ad3ba40a268aff6ea05aebff399c31f86b98065.exe 86 PID 2068 wrote to memory of 2744 2068 9c581c4cec9f25a55ee985d08ad3ba40a268aff6ea05aebff399c31f86b98065.exe 86 PID 2068 wrote to memory of 4192 2068 9c581c4cec9f25a55ee985d08ad3ba40a268aff6ea05aebff399c31f86b98065.exe 88 PID 2068 wrote to memory of 4192 2068 9c581c4cec9f25a55ee985d08ad3ba40a268aff6ea05aebff399c31f86b98065.exe 88 PID 2068 wrote to memory of 4192 2068 9c581c4cec9f25a55ee985d08ad3ba40a268aff6ea05aebff399c31f86b98065.exe 88 PID 2068 wrote to memory of 4192 2068 9c581c4cec9f25a55ee985d08ad3ba40a268aff6ea05aebff399c31f86b98065.exe 88 PID 2068 wrote to memory of 4192 2068 9c581c4cec9f25a55ee985d08ad3ba40a268aff6ea05aebff399c31f86b98065.exe 88 PID 2068 wrote to memory of 4192 2068 9c581c4cec9f25a55ee985d08ad3ba40a268aff6ea05aebff399c31f86b98065.exe 88 PID 3404 wrote to memory of 3376 3404 Explorer.EXE 94 PID 3404 wrote to memory of 3376 3404 Explorer.EXE 94 PID 3404 wrote to memory of 3376 3404 Explorer.EXE 94 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 9c581c4cec9f25a55ee985d08ad3ba40a268aff6ea05aebff399c31f86b98065.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3404 -
C:\Users\Admin\AppData\Local\Temp\9c581c4cec9f25a55ee985d08ad3ba40a268aff6ea05aebff399c31f86b98065.exe"C:\Users\Admin\AppData\Local\Temp\9c581c4cec9f25a55ee985d08ad3ba40a268aff6ea05aebff399c31f86b98065.exe"2⤵
- UAC bypass
- Windows security bypass
- Checks computer location settings
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2068 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\9c581c4cec9f25a55ee985d08ad3ba40a268aff6ea05aebff399c31f86b98065.exe" -Force3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2744
-
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4192
-
-
-
C:\Windows\SysWOW64\grpconv.exe"C:\Windows\SysWOW64\grpconv.exe"2⤵
- Adds policy Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3376
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82