Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
17/06/2024, 00:10
Behavioral task
behavioral1
Sample
9a119ec39dd275392df608195a7c702acacf38bcbb1d1d7b12aa84acb7a5d2a4.exe
Resource
win7-20240508-en
General
-
Target
9a119ec39dd275392df608195a7c702acacf38bcbb1d1d7b12aa84acb7a5d2a4.exe
-
Size
47KB
-
MD5
6c6e9c9f402296784565bedfb1416d44
-
SHA1
f6914cdbe16cc6563fa89793a979ba8aab3484bb
-
SHA256
9a119ec39dd275392df608195a7c702acacf38bcbb1d1d7b12aa84acb7a5d2a4
-
SHA512
3be3e5c8ae08fcc88876aa524f0f9ad838b9e7b377af70d0ede5da3c5ff9703254c839833afc7e9b8dd8a5b88d7b8ff6bdd5161285a7fe84b4be3464254a55c9
-
SSDEEP
768:hX0gWvCzuw6Uj9uGi45XOPxV5HNWnnnl000e999vddddIyyyOOtttb2222v:6vCzuw6UD9Az5HNWnnn622222v
Malware Config
Signatures
-
Detects Windows executables referencing non-Windows User-Agents 6 IoCs
resource yara_rule behavioral2/memory/4760-0-0x0000000000400000-0x0000000000416000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral2/memory/3756-6-0x0000000000400000-0x0000000000416000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral2/memory/3756-7-0x0000000000400000-0x0000000000416000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral2/memory/3756-11-0x0000000000400000-0x0000000000416000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral2/memory/3756-14-0x0000000000400000-0x0000000000416000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral2/memory/3756-18-0x0000000000400000-0x0000000000416000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA -
UPX dump on OEP (original entry point) 7 IoCs
resource yara_rule behavioral2/memory/4760-0-0x0000000000400000-0x0000000000416000-memory.dmp UPX behavioral2/files/0x0008000000022f51-4.dat UPX behavioral2/memory/3756-6-0x0000000000400000-0x0000000000416000-memory.dmp UPX behavioral2/memory/3756-7-0x0000000000400000-0x0000000000416000-memory.dmp UPX behavioral2/memory/3756-11-0x0000000000400000-0x0000000000416000-memory.dmp UPX behavioral2/memory/3756-14-0x0000000000400000-0x0000000000416000-memory.dmp UPX behavioral2/memory/3756-18-0x0000000000400000-0x0000000000416000-memory.dmp UPX -
Sets file to hidden 1 TTPs 1 IoCs
Modifies file attributes to stop it showing in Explorer etc.
pid Process 764 attrib.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 9a119ec39dd275392df608195a7c702acacf38bcbb1d1d7b12aa84acb7a5d2a4.exe -
Executes dropped EXE 1 IoCs
pid Process 3756 puehost.exe -
resource yara_rule behavioral2/memory/4760-0-0x0000000000400000-0x0000000000416000-memory.dmp upx behavioral2/files/0x0008000000022f51-4.dat upx behavioral2/memory/3756-6-0x0000000000400000-0x0000000000416000-memory.dmp upx behavioral2/memory/3756-7-0x0000000000400000-0x0000000000416000-memory.dmp upx behavioral2/memory/3756-11-0x0000000000400000-0x0000000000416000-memory.dmp upx behavioral2/memory/3756-14-0x0000000000400000-0x0000000000416000-memory.dmp upx behavioral2/memory/3756-18-0x0000000000400000-0x0000000000416000-memory.dmp upx -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\Debug\puehost.exe 9a119ec39dd275392df608195a7c702acacf38bcbb1d1d7b12aa84acb7a5d2a4.exe File opened for modification C:\Windows\Debug\puehost.exe 9a119ec39dd275392df608195a7c702acacf38bcbb1d1d7b12aa84acb7a5d2a4.exe File opened for modification C:\Windows\Debug\puehost.exe attrib.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 4760 9a119ec39dd275392df608195a7c702acacf38bcbb1d1d7b12aa84acb7a5d2a4.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4760 wrote to memory of 764 4760 9a119ec39dd275392df608195a7c702acacf38bcbb1d1d7b12aa84acb7a5d2a4.exe 81 PID 4760 wrote to memory of 764 4760 9a119ec39dd275392df608195a7c702acacf38bcbb1d1d7b12aa84acb7a5d2a4.exe 81 PID 4760 wrote to memory of 764 4760 9a119ec39dd275392df608195a7c702acacf38bcbb1d1d7b12aa84acb7a5d2a4.exe 81 PID 4760 wrote to memory of 2232 4760 9a119ec39dd275392df608195a7c702acacf38bcbb1d1d7b12aa84acb7a5d2a4.exe 87 PID 4760 wrote to memory of 2232 4760 9a119ec39dd275392df608195a7c702acacf38bcbb1d1d7b12aa84acb7a5d2a4.exe 87 PID 4760 wrote to memory of 2232 4760 9a119ec39dd275392df608195a7c702acacf38bcbb1d1d7b12aa84acb7a5d2a4.exe 87 -
Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 764 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9a119ec39dd275392df608195a7c702acacf38bcbb1d1d7b12aa84acb7a5d2a4.exe"C:\Users\Admin\AppData\Local\Temp\9a119ec39dd275392df608195a7c702acacf38bcbb1d1d7b12aa84acb7a5d2a4.exe"1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Windows\SysWOW64\attrib.exeattrib +a +s +h +r C:\Windows\Debug\puehost.exe2⤵
- Sets file to hidden
- Drops file in Windows directory
- Views/modifies file attributes
PID:764
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\9A119E~1.EXE > nul2⤵PID:2232
-
-
C:\Windows\Debug\puehost.exeC:\Windows\Debug\puehost.exe1⤵
- Executes dropped EXE
PID:3756
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
47KB
MD5be39be0e1e6556391adf43224ec1fbb4
SHA199984d4ef1b142c3e2eeddba7f3d26378988383b
SHA2565b50a8e25211792b87dbf901c02cce513d643398748d47cb6e066e8cb73451f4
SHA5120e8c38aad1003ba635004e518fa5fabe32af1a9674fd675bb5eaa8f37af0d48dedf3417df29871f6d0c156d63262ef4e9cb94349fe60cf4c351aa9097ca7e2f6