Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
25/06/2024, 16:23
Static task
static1
Behavioral task
behavioral1
Sample
243630e4469d7601cae94bd9dc09488313845a009d679e135f0d43bd703cc89c.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
243630e4469d7601cae94bd9dc09488313845a009d679e135f0d43bd703cc89c.exe
Resource
win10v2004-20240611-en
General
-
Target
243630e4469d7601cae94bd9dc09488313845a009d679e135f0d43bd703cc89c.exe
-
Size
6.0MB
-
MD5
db692724da053d4853cc4ad602da9edc
-
SHA1
29ee8e69e979f9a5efb8c2ad10c6c5dd0570b54b
-
SHA256
243630e4469d7601cae94bd9dc09488313845a009d679e135f0d43bd703cc89c
-
SHA512
1ebce4fd3369a0b878d59799bbd5c92247496f8b9873d9f5d7b985a3b592dda7182d8ee2fc259fb6a1ecbfdb9ac5a541fbf6461ae4494ca22bd16a0d0ad66bed
-
SSDEEP
98304:fbdhDqohDS1F+CRcB27OgUWZHw8VQjr+/bJBAUZLb:fbdhDD23a2sWKjr+TJVX
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 4972 243630e4469d7601cae94bd9dc09488313845a009d679e135f0d43bd703cc89c.exe -
resource yara_rule behavioral2/memory/4972-0-0x0000000001150000-0x000000000115B000-memory.dmp upx behavioral2/memory/4972-8-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4972-22-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4972-37-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4972-49-0x0000000001150000-0x000000000115B000-memory.dmp upx behavioral2/memory/4972-47-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4972-46-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4972-45-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4972-43-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4972-41-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4972-39-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4972-33-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4972-31-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4972-29-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4972-27-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4972-23-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4972-25-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4972-18-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4972-16-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4972-14-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4972-12-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4972-10-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4972-6-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4972-4-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4972-3-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4972-2-0x0000000010000000-0x000000001003E000-memory.dmp upx -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 243630e4469d7601cae94bd9dc09488313845a009d679e135f0d43bd703cc89c.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4972 243630e4469d7601cae94bd9dc09488313845a009d679e135f0d43bd703cc89c.exe 4972 243630e4469d7601cae94bd9dc09488313845a009d679e135f0d43bd703cc89c.exe 4972 243630e4469d7601cae94bd9dc09488313845a009d679e135f0d43bd703cc89c.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4972 wrote to memory of 716 4972 243630e4469d7601cae94bd9dc09488313845a009d679e135f0d43bd703cc89c.exe 113 PID 4972 wrote to memory of 716 4972 243630e4469d7601cae94bd9dc09488313845a009d679e135f0d43bd703cc89c.exe 113
Processes
-
C:\Users\Admin\AppData\Local\Temp\243630e4469d7601cae94bd9dc09488313845a009d679e135f0d43bd703cc89c.exe"C:\Users\Admin\AppData\Local\Temp\243630e4469d7601cae94bd9dc09488313845a009d679e135f0d43bd703cc89c.exe"1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://changkongbao.lanzouq.com/ikW9T1cfeg5e2⤵PID:716
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4416,i,6870419347051655189,5491911050420577193,262144 --variations-seed-version --mojo-platform-channel-handle=4172 /prefetch:81⤵PID:3108
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --field-trial-handle=4404,i,6870419347051655189,5491911050420577193,262144 --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:11⤵PID:4508
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --field-trial-handle=3924,i,6870419347051655189,5491911050420577193,262144 --variations-seed-version --mojo-platform-channel-handle=2784 /prefetch:11⤵PID:3536
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=5152,i,6870419347051655189,5491911050420577193,262144 --variations-seed-version --mojo-platform-channel-handle=4128 /prefetch:81⤵PID:180
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --field-trial-handle=5312,i,6870419347051655189,5491911050420577193,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:81⤵PID:4968
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --field-trial-handle=5448,i,6870419347051655189,5491911050420577193,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:11⤵PID:4780
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --field-trial-handle=5628,i,6870419347051655189,5491911050420577193,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:11⤵PID:4560
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.5MB
MD5ef48d7cc52338513cc0ce843c5e3916b
SHA120965d86b7b358edf8b5d819302fa7e0e6159c18
SHA256835bfef980ad0cedf10d8ade0cf5671d9f56062f2b22d0a0547b07772ceb25a8
SHA512fd4602bd487eaad5febb5b3e9d8fe75f4190d1e44e538e7ae2d2129087f35b72b254c85d7335a81854aa2bdb4f0f2fa22e02a892ee23ac57b78cdd03a79259b9
-
Filesize
10KB
MD5842d9e10867153ad73a1a80d79afef13
SHA133a49d893273182e8aba6e9531c3077d4ab86516
SHA2562823197bddf0203ea011003a4e70f2687da234a3388b5090a76da2c2562d33e4
SHA512e6e10f63c7d3e65358bd6e66a7328f7d06d096b2ed936cd4504cfb8c6b5f4081dd55884bb915191156965b0eb9b3fda6a97b5b1a1eee45d59a41a4e375d1e518
-
Filesize
8KB
MD516ef8177433976c14d23f839a8c1152a
SHA12b653ca841498be9292cbbc8b5119504e225f56d
SHA2562a30dc50f2e6e73b059d7419b34924114bffcfa8d99f7703bfbdd4f9e5da8855
SHA5129cccf0eb97b898988e5da63584e195528dd3a0f34d0608844a33c6ac5928d83c8159151a7a15d5382a10114b819cb72d8c5840d254d9ac1023ad6ac22ac4833e
-
Filesize
189B
MD5322f59ce015ff2f1f00ecbe4fdfce380
SHA1eb4756a5bb023f6d1feacdbeac6e94013e15d5b0
SHA256c96ef901d8f23cb7626ef980c4cf5bece7aafeef9b2b8b28829d3a11a51562c1
SHA5122610ce1c0a55da67faa9ddaca26529a87bf5ebc6706621682d54024fa887ca9cd54cdc5b854f8b79ea99b02a5277d6931f633fa876107d9ec1bf503bee23a02c
-
Filesize
103B
MD562417cec773969a0ad264d73e8c06dd5
SHA1aaa287afa9bd45430a7708a67fdbca8984a55d92
SHA256b0600c7ab1c9a6c937713e8f71d712a1f6f9d6991a6078f1a36f420a3f07846b
SHA512a3788224ab0b1f3adb664820f0d6cb2cf2e38d5b0d09ed8678774b712a569e33d24bf1039edd941fa16ee765e36d348808cfd7b96a5f89b9d9756a481903a161
-
Filesize
246B
MD5b06ddcfdb64cc28ca0a0ef609de5f05f
SHA1bd95d141935795e249d2ab00824839fd42c8f505
SHA256da0a5d79dc6a120811b556885b704f9fd158b1f19dd5a9c595719feb56065f00
SHA512a1dd3cc527ce6a6c4b0ea2c369d4370f6f1bf332c9255e1a8eebfd5986c133dacc2e6c6a55071e5bcf4724f37ff2920f2e17567ca32571e664b458e526be72b5
-
Filesize
260B
MD5924bf7a4ce305dad87743ba3c5773aa9
SHA112d0fddb472394b23e5176ab4ede38974e723b81
SHA25601faf5e88442653bf38adc145d517f44d3495398e0aa666c7486b7030c126cbd
SHA5122380c957717d3bc97ae2de96aba9cd3b50a1774eb96dc47840add1b12ee13485ee6cc6c4d30953b8f42d32ae3b02657966229fcbe58a60843df0cbd6170eb44e