Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
10/07/2024, 00:12
Static task
static1
Behavioral task
behavioral1
Sample
a70afece8cbb0eb26ef86687904e0f60ffa48b90566ccd193803600d1210d3d3.exe
Resource
win7-20240705-en
General
-
Target
a70afece8cbb0eb26ef86687904e0f60ffa48b90566ccd193803600d1210d3d3.exe
-
Size
1.7MB
-
MD5
2fd5576b5e480b6436985460d720d68f
-
SHA1
14b5b57d5f25d93e637e2cf4e4fb7fa73f8f0549
-
SHA256
a70afece8cbb0eb26ef86687904e0f60ffa48b90566ccd193803600d1210d3d3
-
SHA512
0a8fc3b3a9e848811e1b784ce9ed931e56a8a7b863bc26089ea5928d6b6ffa37271b0d98922c24035296b589ca523da6da97e6bcb4d5113761a1dd900af6632d
-
SSDEEP
24576:s+jEjecTVp6fHlKnbbe/P1njg2x2beBcgpbiNatNvj999RM4Z+4CF:HAH7nbmBzXvZ2F
Malware Config
Signatures
-
Detect Blackmoon payload 5 IoCs
resource yara_rule behavioral2/memory/3044-0-0x00000000023F0000-0x000000000241F000-memory.dmp family_blackmoon behavioral2/memory/3044-6-0x00000000023F0000-0x000000000241F000-memory.dmp family_blackmoon behavioral2/memory/4436-7-0x0000000002470000-0x000000000249F000-memory.dmp family_blackmoon behavioral2/memory/1780-9-0x0000000002390000-0x00000000023BF000-memory.dmp family_blackmoon behavioral2/memory/1780-12-0x0000000002390000-0x00000000023BF000-memory.dmp family_blackmoon -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\Control Panel\International\Geo\Nation a70afece8cbb0eb26ef86687904e0f60ffa48b90566ccd193803600d1210d3d3.exe -
Executes dropped EXE 2 IoCs
pid Process 4436 WhKoDTHiK.exe 1780 WhKoDTHiK.exe -
resource yara_rule behavioral2/memory/1780-10-0x0000000000760000-0x000000000076B000-memory.dmp upx behavioral2/memory/1780-11-0x0000000000760000-0x000000000076B000-memory.dmp upx behavioral2/memory/1780-13-0x0000000000760000-0x000000000076B000-memory.dmp upx -
Drops desktop.ini file(s) 9 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\1048576891\desktop.ini a70afece8cbb0eb26ef86687904e0f60ffa48b90566ccd193803600d1210d3d3.exe File opened for modification C:\Users\Public\Downloads\1048576891\desktop.ini WhKoDTHiK.exe File opened for modification C:\Users\Public\Downloads\-1\desktop.ini WhKoDTHiK.exe File opened for modification C:\Users\Public\Downloads\1048576891\desktop.ini WhKoDTHiK.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\-1\desktop.ini a70afece8cbb0eb26ef86687904e0f60ffa48b90566ccd193803600d1210d3d3.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\0\desktop.ini a70afece8cbb0eb26ef86687904e0f60ffa48b90566ccd193803600d1210d3d3.exe File opened for modification C:\Users\Public\Downloads\-1\desktop.ini WhKoDTHiK.exe File opened for modification C:\Users\Public\Downloads\0\desktop.ini WhKoDTHiK.exe File opened for modification C:\Users\Public\Downloads\0\desktop.ini WhKoDTHiK.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
pid Process 3628 PING.EXE -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 3044 a70afece8cbb0eb26ef86687904e0f60ffa48b90566ccd193803600d1210d3d3.exe 3044 a70afece8cbb0eb26ef86687904e0f60ffa48b90566ccd193803600d1210d3d3.exe 3044 a70afece8cbb0eb26ef86687904e0f60ffa48b90566ccd193803600d1210d3d3.exe 3044 a70afece8cbb0eb26ef86687904e0f60ffa48b90566ccd193803600d1210d3d3.exe 3044 a70afece8cbb0eb26ef86687904e0f60ffa48b90566ccd193803600d1210d3d3.exe 3044 a70afece8cbb0eb26ef86687904e0f60ffa48b90566ccd193803600d1210d3d3.exe 4436 WhKoDTHiK.exe 4436 WhKoDTHiK.exe 4436 WhKoDTHiK.exe 4436 WhKoDTHiK.exe 4436 WhKoDTHiK.exe 4436 WhKoDTHiK.exe 1780 WhKoDTHiK.exe 1780 WhKoDTHiK.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 3044 a70afece8cbb0eb26ef86687904e0f60ffa48b90566ccd193803600d1210d3d3.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3044 a70afece8cbb0eb26ef86687904e0f60ffa48b90566ccd193803600d1210d3d3.exe 3044 a70afece8cbb0eb26ef86687904e0f60ffa48b90566ccd193803600d1210d3d3.exe 4436 WhKoDTHiK.exe 4436 WhKoDTHiK.exe 1780 WhKoDTHiK.exe 1780 WhKoDTHiK.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 3044 wrote to memory of 4436 3044 a70afece8cbb0eb26ef86687904e0f60ffa48b90566ccd193803600d1210d3d3.exe 84 PID 3044 wrote to memory of 4436 3044 a70afece8cbb0eb26ef86687904e0f60ffa48b90566ccd193803600d1210d3d3.exe 84 PID 3044 wrote to memory of 4436 3044 a70afece8cbb0eb26ef86687904e0f60ffa48b90566ccd193803600d1210d3d3.exe 84 PID 3044 wrote to memory of 2828 3044 a70afece8cbb0eb26ef86687904e0f60ffa48b90566ccd193803600d1210d3d3.exe 85 PID 3044 wrote to memory of 2828 3044 a70afece8cbb0eb26ef86687904e0f60ffa48b90566ccd193803600d1210d3d3.exe 85 PID 3044 wrote to memory of 2828 3044 a70afece8cbb0eb26ef86687904e0f60ffa48b90566ccd193803600d1210d3d3.exe 85 PID 4436 wrote to memory of 1780 4436 WhKoDTHiK.exe 87 PID 4436 wrote to memory of 1780 4436 WhKoDTHiK.exe 87 PID 4436 wrote to memory of 1780 4436 WhKoDTHiK.exe 87 PID 2828 wrote to memory of 3628 2828 cmd.exe 88 PID 2828 wrote to memory of 3628 2828 cmd.exe 88 PID 2828 wrote to memory of 3628 2828 cmd.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\a70afece8cbb0eb26ef86687904e0f60ffa48b90566ccd193803600d1210d3d3.exe"C:\Users\Admin\AppData\Local\Temp\a70afece8cbb0eb26ef86687904e0f60ffa48b90566ccd193803600d1210d3d3.exe"1⤵
- Checks computer location settings
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Users\Public\Downloads\WhKoDTHiK.exeyoDlyoutXDAvnBnJcnanmLER2⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4436 -
C:\Users\Public\Downloads\WhKoDTHiK.exeIVToiQwV3⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1780
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" cmd/c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\[email protected] > nul && exit2⤵
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.13⤵
- Runs ping.exe
PID:3628
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.7MB
MD52fd5576b5e480b6436985460d720d68f
SHA114b5b57d5f25d93e637e2cf4e4fb7fa73f8f0549
SHA256a70afece8cbb0eb26ef86687904e0f60ffa48b90566ccd193803600d1210d3d3
SHA5120a8fc3b3a9e848811e1b784ce9ed931e56a8a7b863bc26089ea5928d6b6ffa37271b0d98922c24035296b589ca523da6da97e6bcb4d5113761a1dd900af6632d