Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
299s -
max time network
300s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
05/07/2024, 15:43
Static task
static1
Behavioral task
behavioral1
Sample
ORDEN DE COMPRA URGENTEfdp..exe
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
ORDEN DE COMPRA URGENTEfdp..exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral3
Sample
ORDEN DE COMPRA URGENTEfdp..exe
Resource
win11-20240704-en
General
-
Target
ORDEN DE COMPRA URGENTEfdp..exe
-
Size
2.4MB
-
MD5
fea126096e142649211027c6edbb9832
-
SHA1
e5e259235d3d77065918b3c4c369f9d74f1868d7
-
SHA256
950a5c5455b3d7a4ee27ff5bc7cea2ade2d507770a3cc15106018bfedae9ca52
-
SHA512
1f50c406c59fa74b95d97596a04b2cc132ede28bbe00c306aaa1bd3056942713f99aa5e5cf93022d652abb2fcacf7d6e24feec4e572a9aaff64368d1b0d28293
-
SSDEEP
12288:SSR2wX/utnvc69mP51M1nkPpVys8b5V29HxJu5YF9Iv3dosUg7JZtY:SSHuRc69mP/M5kmL/aHxJZIv3W42
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ORDEN DE COMPRA URGENTEfdp..exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths ORDEN DE COMPRA URGENTEfdp..exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\ORDEN DE COMPRA URGENTEfdp..exe = "0" ORDEN DE COMPRA URGENTEfdp..exe -
Adds policy Run key to start application 2 TTPs 1 IoCs
description ioc Process Key created \Registry\User\S-1-5-21-2494989678-839960665-2515455429-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run sc.exe -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 4892 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000\Control Panel\International\Geo\Nation ORDEN DE COMPRA URGENTEfdp..exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths ORDEN DE COMPRA URGENTEfdp..exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions ORDEN DE COMPRA URGENTEfdp..exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\ORDEN DE COMPRA URGENTEfdp..exe = "0" ORDEN DE COMPRA URGENTEfdp..exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\K0X4KV = "C:\\Program Files (x86)\\Windows Media Player\\wmplayer.exe" sc.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ORDEN DE COMPRA URGENTEfdp..exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA ORDEN DE COMPRA URGENTEfdp..exe -
Suspicious use of SetThreadContext 5 IoCs
description pid Process procid_target PID 2408 set thread context of 3480 2408 ORDEN DE COMPRA URGENTEfdp..exe 88 PID 3480 set thread context of 3484 3480 wmplayer.exe 56 PID 3480 set thread context of 1908 3480 wmplayer.exe 96 PID 1908 set thread context of 3484 1908 sc.exe 56 PID 1908 set thread context of 388 1908 sc.exe 97 -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 1908 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Key created \Registry\User\S-1-5-21-2494989678-839960665-2515455429-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 sc.exe -
Runs regedit.exe 1 IoCs
pid Process 4760 regedit.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4892 powershell.exe 4892 powershell.exe 3480 wmplayer.exe 3480 wmplayer.exe 3480 wmplayer.exe 3480 wmplayer.exe 3480 wmplayer.exe 3480 wmplayer.exe 3480 wmplayer.exe 3480 wmplayer.exe 3480 wmplayer.exe 3480 wmplayer.exe 3480 wmplayer.exe 3480 wmplayer.exe 3480 wmplayer.exe 3480 wmplayer.exe 3480 wmplayer.exe 3480 wmplayer.exe 1908 sc.exe 1908 sc.exe 1908 sc.exe 1908 sc.exe 1908 sc.exe 1908 sc.exe 1908 sc.exe 1908 sc.exe 1908 sc.exe 1908 sc.exe 1908 sc.exe 1908 sc.exe 1908 sc.exe 1908 sc.exe 1908 sc.exe 1908 sc.exe 1908 sc.exe 1908 sc.exe 1908 sc.exe 1908 sc.exe 1908 sc.exe 1908 sc.exe 1908 sc.exe 1908 sc.exe 1908 sc.exe 1908 sc.exe 1908 sc.exe 1908 sc.exe 1908 sc.exe 1908 sc.exe 1908 sc.exe 1908 sc.exe 1908 sc.exe 1908 sc.exe 1908 sc.exe 1908 sc.exe 1908 sc.exe 1908 sc.exe 1908 sc.exe 1908 sc.exe 1908 sc.exe 1908 sc.exe 1908 sc.exe 1908 sc.exe 1908 sc.exe 1908 sc.exe -
Suspicious behavior: MapViewOfSection 7 IoCs
pid Process 3480 wmplayer.exe 3484 Explorer.EXE 3484 Explorer.EXE 1908 sc.exe 1908 sc.exe 1908 sc.exe 1908 sc.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4892 powershell.exe Token: SeShutdownPrivilege 3484 Explorer.EXE Token: SeCreatePagefilePrivilege 3484 Explorer.EXE -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 2408 wrote to memory of 4892 2408 ORDEN DE COMPRA URGENTEfdp..exe 85 PID 2408 wrote to memory of 4892 2408 ORDEN DE COMPRA URGENTEfdp..exe 85 PID 2408 wrote to memory of 4760 2408 ORDEN DE COMPRA URGENTEfdp..exe 87 PID 2408 wrote to memory of 4760 2408 ORDEN DE COMPRA URGENTEfdp..exe 87 PID 2408 wrote to memory of 4760 2408 ORDEN DE COMPRA URGENTEfdp..exe 87 PID 2408 wrote to memory of 4760 2408 ORDEN DE COMPRA URGENTEfdp..exe 87 PID 2408 wrote to memory of 3480 2408 ORDEN DE COMPRA URGENTEfdp..exe 88 PID 2408 wrote to memory of 3480 2408 ORDEN DE COMPRA URGENTEfdp..exe 88 PID 2408 wrote to memory of 3480 2408 ORDEN DE COMPRA URGENTEfdp..exe 88 PID 2408 wrote to memory of 3480 2408 ORDEN DE COMPRA URGENTEfdp..exe 88 PID 2408 wrote to memory of 3480 2408 ORDEN DE COMPRA URGENTEfdp..exe 88 PID 2408 wrote to memory of 3480 2408 ORDEN DE COMPRA URGENTEfdp..exe 88 PID 2408 wrote to memory of 2844 2408 ORDEN DE COMPRA URGENTEfdp..exe 89 PID 2408 wrote to memory of 2844 2408 ORDEN DE COMPRA URGENTEfdp..exe 89 PID 2408 wrote to memory of 2844 2408 ORDEN DE COMPRA URGENTEfdp..exe 89 PID 3484 wrote to memory of 1908 3484 Explorer.EXE 96 PID 3484 wrote to memory of 1908 3484 Explorer.EXE 96 PID 3484 wrote to memory of 1908 3484 Explorer.EXE 96 PID 1908 wrote to memory of 388 1908 sc.exe 97 PID 1908 wrote to memory of 388 1908 sc.exe 97 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ORDEN DE COMPRA URGENTEfdp..exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3484 -
C:\Users\Admin\AppData\Local\Temp\ORDEN DE COMPRA URGENTEfdp..exe"C:\Users\Admin\AppData\Local\Temp\ORDEN DE COMPRA URGENTEfdp..exe"2⤵
- UAC bypass
- Windows security bypass
- Checks computer location settings
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2408 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\ORDEN DE COMPRA URGENTEfdp..exe" -Force3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4892
-
-
C:\Windows\regedit.exe"C:\Windows\regedit.exe"3⤵
- Runs regedit.exe
PID:4760
-
-
C:\Program Files (x86)\Windows Media Player\wmplayer.exe"C:\Program Files (x86)\Windows Media Player\wmplayer.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3480
-
-
C:\Program Files (x86)\Windows Media Player\wmplayer.exe"C:\Program Files (x86)\Windows Media Player\wmplayer.exe"3⤵PID:2844
-
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\SysWOW64\sc.exe"2⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Launches sc.exe
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:388
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82