Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
153s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
16/06/2024, 04:46 UTC
Static task
static1
Behavioral task
behavioral1
Sample
ff0415f2605d5b93f55327f7f147c0ef57e6b66df55800a678b3e0d3a980d1ed.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
ff0415f2605d5b93f55327f7f147c0ef57e6b66df55800a678b3e0d3a980d1ed.exe
Resource
win10v2004-20240226-en
General
-
Target
ff0415f2605d5b93f55327f7f147c0ef57e6b66df55800a678b3e0d3a980d1ed.exe
-
Size
35KB
-
MD5
5054031c57c59471b4cfb7aa8b06fa63
-
SHA1
7479f580e89b74533f911796ecc2dcca2d5d6378
-
SHA256
ff0415f2605d5b93f55327f7f147c0ef57e6b66df55800a678b3e0d3a980d1ed
-
SHA512
43dc4c6515082a3ce0dbaf436484fd991c6294a8ac60c23ba597ca8cdd9c38ad7a298d642282bcd6c5a313054cdee79b4b31bba69727ae4404c04bd2b1ddcf2a
-
SSDEEP
768:DqPJtsA6C1VqahohtgVRNToV7TtRu8rM0wYVFl2g5coW58dO0xXHV2EfKYfdhNhi:DqMA6C1VqaqhtgVRNToV7TtRu8rM0wYC
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 3212 microsofthelp.exe -
Executes dropped EXE 1 IoCs
pid Process 3212 microsofthelp.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\microsofthelp = "C:\\Windows\\microsofthelp.exe" ff0415f2605d5b93f55327f7f147c0ef57e6b66df55800a678b3e0d3a980d1ed.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\microsofthelp.exe ff0415f2605d5b93f55327f7f147c0ef57e6b66df55800a678b3e0d3a980d1ed.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4068 wrote to memory of 3212 4068 ff0415f2605d5b93f55327f7f147c0ef57e6b66df55800a678b3e0d3a980d1ed.exe 90 PID 4068 wrote to memory of 3212 4068 ff0415f2605d5b93f55327f7f147c0ef57e6b66df55800a678b3e0d3a980d1ed.exe 90 PID 4068 wrote to memory of 3212 4068 ff0415f2605d5b93f55327f7f147c0ef57e6b66df55800a678b3e0d3a980d1ed.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\ff0415f2605d5b93f55327f7f147c0ef57e6b66df55800a678b3e0d3a980d1ed.exe"C:\Users\Admin\AppData\Local\Temp\ff0415f2605d5b93f55327f7f147c0ef57e6b66df55800a678b3e0d3a980d1ed.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4068 -
C:\Windows\microsofthelp.exe"C:\Windows\microsofthelp.exe"2⤵
- Deletes itself
- Executes dropped EXE
PID:3212
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3692 --field-trial-handle=2244,i,11878111470816612087,2265290141962607370,262144 --variations-seed-version /prefetch:81⤵PID:1564
Network
-
Remote address:8.8.8.8:53Request217.106.137.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request0.205.248.87.in-addr.arpaIN PTRResponse0.205.248.87.in-addr.arpaIN PTRhttps-87-248-205-0lgwllnwnet
-
Remote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request196.249.167.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request241.150.49.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request183.142.211.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request26.165.165.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request171.39.242.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request35.15.31.184.in-addr.arpaIN PTRResponse35.15.31.184.in-addr.arpaIN PTRa184-31-15-35deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request172.210.232.199.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request11.227.111.52.in-addr.arpaIN PTRResponse
-
73 B 147 B 1 1
DNS Request
217.106.137.52.in-addr.arpa
-
71 B 116 B 1 1
DNS Request
0.205.248.87.in-addr.arpa
-
73 B 144 B 1 1
DNS Request
95.221.229.192.in-addr.arpa
-
73 B 147 B 1 1
DNS Request
196.249.167.52.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
241.150.49.20.in-addr.arpa
-
73 B 159 B 1 1
DNS Request
183.142.211.20.in-addr.arpa
-
72 B 146 B 1 1
DNS Request
26.165.165.52.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
171.39.242.20.in-addr.arpa
-
71 B 135 B 1 1
DNS Request
35.15.31.184.in-addr.arpa
-
74 B 128 B 1 1
DNS Request
172.210.232.199.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
11.227.111.52.in-addr.arpa
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
36KB
MD5abd3209c5a21230e04d16795826b68ae
SHA14f5a4e98b2f7c0955fc05b9c0fc0076c62e56b6b
SHA256b410006e9ada3ceb44500c2e7a2ca41fed816a51a0541c352db5a109d04b95a1
SHA5121464b14d9caa5fce0fd2c1241f7a5c8124f047524507ab4d193b45f7eaff8ed720ec32a0419f8b99cc8db951b67c345659d989a070eccbb922c3b735bd9483e4