Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
149s -
platform
windows11-21h2_x64 -
resource
win11-20240611-en -
resource tags
arch:x64arch:x86image:win11-20240611-enlocale:en-usos:windows11-21h2-x64system -
submitted
15/06/2024, 07:48
Behavioral task
behavioral1
Sample
1f2e39728d627019c482b270eabb614d39100ed910797c6884fc405ae6514412.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral2
Sample
1f2e39728d627019c482b270eabb614d39100ed910797c6884fc405ae6514412.exe
Resource
win11-20240611-en
General
-
Target
1f2e39728d627019c482b270eabb614d39100ed910797c6884fc405ae6514412.exe
-
Size
48KB
-
MD5
7f0bf23db6496335d9adf01fb50ec091
-
SHA1
92ba1a47b40306bf5e4027506c7683ab3577fb73
-
SHA256
1f2e39728d627019c482b270eabb614d39100ed910797c6884fc405ae6514412
-
SHA512
f62a8b136cec137784692547bb7259e36592dd474c16914683f872ab30f482d8acf6a2064c996515c1c99b3337c15b4d0c85fe971cd599c8e9aa54b5822f40df
-
SSDEEP
768:zynb12Aw5J6HC4kq5Jp9bjAzhyY55J+NStcEeUlyqgZl4p67ThPC:Ub1MsHz3JDwhyWr+N95OTga6I
Malware Config
Signatures
-
Sets DLL path for service in the registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Remocte1\Parameters\ServiceDll = "C:\\Users\\Admin\\AppData\\Local\\Temp\\240624375.dll" 1f2e39728d627019c482b270eabb614d39100ed910797c6884fc405ae6514412.exe -
Executes dropped EXE 1 IoCs
pid Process 3612 Remocte1.exe -
Loads dropped DLL 3 IoCs
pid Process 2924 1f2e39728d627019c482b270eabb614d39100ed910797c6884fc405ae6514412.exe 2016 svchost.exe 3612 Remocte1.exe -
Creates a Windows Service
-
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\Remocte1.exe svchost.exe File opened for modification C:\Windows\SysWOW64\Remocte1.exe svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2912 PING.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2924 1f2e39728d627019c482b270eabb614d39100ed910797c6884fc405ae6514412.exe 2924 1f2e39728d627019c482b270eabb614d39100ed910797c6884fc405ae6514412.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2924 1f2e39728d627019c482b270eabb614d39100ed910797c6884fc405ae6514412.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2924 1f2e39728d627019c482b270eabb614d39100ed910797c6884fc405ae6514412.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2924 wrote to memory of 3940 2924 1f2e39728d627019c482b270eabb614d39100ed910797c6884fc405ae6514412.exe 81 PID 2924 wrote to memory of 3940 2924 1f2e39728d627019c482b270eabb614d39100ed910797c6884fc405ae6514412.exe 81 PID 2924 wrote to memory of 3940 2924 1f2e39728d627019c482b270eabb614d39100ed910797c6884fc405ae6514412.exe 81 PID 3940 wrote to memory of 2912 3940 cmd.exe 83 PID 3940 wrote to memory of 2912 3940 cmd.exe 83 PID 3940 wrote to memory of 2912 3940 cmd.exe 83 PID 2016 wrote to memory of 3612 2016 svchost.exe 84 PID 2016 wrote to memory of 3612 2016 svchost.exe 84 PID 2016 wrote to memory of 3612 2016 svchost.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\1f2e39728d627019c482b270eabb614d39100ed910797c6884fc405ae6514412.exe"C:\Users\Admin\AppData\Local\Temp\1f2e39728d627019c482b270eabb614d39100ed910797c6884fc405ae6514412.exe"1⤵
- Sets DLL path for service in the registry
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 1 && del /f/q "C:\Users\Admin\AppData\Local\Temp\1f2e39728d627019c482b270eabb614d39100ed910797c6884fc405ae6514412.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3940 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 13⤵
- Runs ping.exe
PID:2912
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "Remocte1"1⤵PID:4756
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "Remocte1"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Windows\SysWOW64\Remocte1.exeC:\Windows\system32\Remocte1.exe "c:\users\admin\appdata\local\temp\240624375.dll",MainThread2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3612
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
25KB
MD57058a766ab64adf883745d749cd0319f
SHA152f41f3df9b376345e669cc445da51e4d0647a17
SHA256e433fea139b4bc81961a73df3159211c6a20475d798d53bfd3c11b77850caa5b
SHA5128452538215ad6a6a793fc820be306acb9a0412b63e679375c2f0c56c4ba95a2b45bcc8520bbfeca8b8489c660c5a6a861707dee54104d796a294148e8fc2047c
-
Filesize
40KB
MD522bb5bd901d8b25ac5b41edbb7d5053e
SHA18a935dd8d7e104fc553ff7e8b54a404f7b079334
SHA2568dcaeeebef9b9f3d41d295db145ffb3850f309d089c08125c7fa7034db5fd80e
SHA512cc3fb68fd6791a08e4a7d1a8db8d07cfcc8c9b9dceec10b53f0cb7ee86473303a19be4f23e379f84c59e02d0568e7c066e21cd1300f6032dac4ba52f609f62e7