Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
10/07/2024, 06:48
Behavioral task
behavioral1
Sample
ec94acb3d9efe0688bf65b94880383e9cf6d94650525b060d77ec6e7e0fb21eb.exe
Resource
win7-20240705-en
General
-
Target
ec94acb3d9efe0688bf65b94880383e9cf6d94650525b060d77ec6e7e0fb21eb.exe
-
Size
1.3MB
-
MD5
bfa7e58897f5d9f4f1f7be28c98aa768
-
SHA1
62e09cb7194008106755301f73a892aa3e99000c
-
SHA256
ec94acb3d9efe0688bf65b94880383e9cf6d94650525b060d77ec6e7e0fb21eb
-
SHA512
e8bcc9510544a1d7268107fec4643caca1a16dc10b23587a458e867d565dd2abf61ab0b48a4a61d29a97aa225cff58e30a25e9228cc636e197d414344ebc0038
-
SSDEEP
24576:zQ5aILMCfmAUjzX6xQt+4En+bcMAOVMId03vDM5CZe0PZ0:E5aIwC+Agr6StVEnmcK9dFCfW
Malware Config
Signatures
-
KPOT Core Executable 1 IoCs
resource yara_rule behavioral2/files/0x0008000000023466-21.dat family_kpot -
Trickbot x86 loader 1 IoCs
Detected Trickbot's x86 loader that unpacks the x86 payload.
resource yara_rule behavioral2/memory/3172-15-0x0000000002200000-0x0000000002229000-memory.dmp trickbot_loader32 -
Executes dropped EXE 3 IoCs
pid Process 2912 ec94acb3d9efe0799bf76b94990393e9cf7d94760626b070d88ec7e8e0fb21eb.exe 1940 ec94acb3d9efe0799bf76b94990393e9cf7d94760626b070d88ec7e8e0fb21eb.exe 3592 ec94acb3d9efe0799bf76b94990393e9cf7d94760626b070d88ec7e8e0fb21eb.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeTcbPrivilege 1940 ec94acb3d9efe0799bf76b94990393e9cf7d94760626b070d88ec7e8e0fb21eb.exe Token: SeTcbPrivilege 3592 ec94acb3d9efe0799bf76b94990393e9cf7d94760626b070d88ec7e8e0fb21eb.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 3172 ec94acb3d9efe0688bf65b94880383e9cf6d94650525b060d77ec6e7e0fb21eb.exe 2912 ec94acb3d9efe0799bf76b94990393e9cf7d94760626b070d88ec7e8e0fb21eb.exe 1940 ec94acb3d9efe0799bf76b94990393e9cf7d94760626b070d88ec7e8e0fb21eb.exe 3592 ec94acb3d9efe0799bf76b94990393e9cf7d94760626b070d88ec7e8e0fb21eb.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3172 wrote to memory of 2912 3172 ec94acb3d9efe0688bf65b94880383e9cf6d94650525b060d77ec6e7e0fb21eb.exe 83 PID 3172 wrote to memory of 2912 3172 ec94acb3d9efe0688bf65b94880383e9cf6d94650525b060d77ec6e7e0fb21eb.exe 83 PID 3172 wrote to memory of 2912 3172 ec94acb3d9efe0688bf65b94880383e9cf6d94650525b060d77ec6e7e0fb21eb.exe 83 PID 2912 wrote to memory of 5036 2912 ec94acb3d9efe0799bf76b94990393e9cf7d94760626b070d88ec7e8e0fb21eb.exe 85 PID 2912 wrote to memory of 5036 2912 ec94acb3d9efe0799bf76b94990393e9cf7d94760626b070d88ec7e8e0fb21eb.exe 85 PID 2912 wrote to memory of 5036 2912 ec94acb3d9efe0799bf76b94990393e9cf7d94760626b070d88ec7e8e0fb21eb.exe 85 PID 2912 wrote to memory of 5036 2912 ec94acb3d9efe0799bf76b94990393e9cf7d94760626b070d88ec7e8e0fb21eb.exe 85 PID 2912 wrote to memory of 5036 2912 ec94acb3d9efe0799bf76b94990393e9cf7d94760626b070d88ec7e8e0fb21eb.exe 85 PID 2912 wrote to memory of 5036 2912 ec94acb3d9efe0799bf76b94990393e9cf7d94760626b070d88ec7e8e0fb21eb.exe 85 PID 2912 wrote to memory of 5036 2912 ec94acb3d9efe0799bf76b94990393e9cf7d94760626b070d88ec7e8e0fb21eb.exe 85 PID 2912 wrote to memory of 5036 2912 ec94acb3d9efe0799bf76b94990393e9cf7d94760626b070d88ec7e8e0fb21eb.exe 85 PID 2912 wrote to memory of 5036 2912 ec94acb3d9efe0799bf76b94990393e9cf7d94760626b070d88ec7e8e0fb21eb.exe 85 PID 2912 wrote to memory of 5036 2912 ec94acb3d9efe0799bf76b94990393e9cf7d94760626b070d88ec7e8e0fb21eb.exe 85 PID 2912 wrote to memory of 5036 2912 ec94acb3d9efe0799bf76b94990393e9cf7d94760626b070d88ec7e8e0fb21eb.exe 85 PID 2912 wrote to memory of 5036 2912 ec94acb3d9efe0799bf76b94990393e9cf7d94760626b070d88ec7e8e0fb21eb.exe 85 PID 2912 wrote to memory of 5036 2912 ec94acb3d9efe0799bf76b94990393e9cf7d94760626b070d88ec7e8e0fb21eb.exe 85 PID 2912 wrote to memory of 5036 2912 ec94acb3d9efe0799bf76b94990393e9cf7d94760626b070d88ec7e8e0fb21eb.exe 85 PID 2912 wrote to memory of 5036 2912 ec94acb3d9efe0799bf76b94990393e9cf7d94760626b070d88ec7e8e0fb21eb.exe 85 PID 2912 wrote to memory of 5036 2912 ec94acb3d9efe0799bf76b94990393e9cf7d94760626b070d88ec7e8e0fb21eb.exe 85 PID 2912 wrote to memory of 5036 2912 ec94acb3d9efe0799bf76b94990393e9cf7d94760626b070d88ec7e8e0fb21eb.exe 85 PID 2912 wrote to memory of 5036 2912 ec94acb3d9efe0799bf76b94990393e9cf7d94760626b070d88ec7e8e0fb21eb.exe 85 PID 2912 wrote to memory of 5036 2912 ec94acb3d9efe0799bf76b94990393e9cf7d94760626b070d88ec7e8e0fb21eb.exe 85 PID 2912 wrote to memory of 5036 2912 ec94acb3d9efe0799bf76b94990393e9cf7d94760626b070d88ec7e8e0fb21eb.exe 85 PID 2912 wrote to memory of 5036 2912 ec94acb3d9efe0799bf76b94990393e9cf7d94760626b070d88ec7e8e0fb21eb.exe 85 PID 2912 wrote to memory of 5036 2912 ec94acb3d9efe0799bf76b94990393e9cf7d94760626b070d88ec7e8e0fb21eb.exe 85 PID 2912 wrote to memory of 5036 2912 ec94acb3d9efe0799bf76b94990393e9cf7d94760626b070d88ec7e8e0fb21eb.exe 85 PID 2912 wrote to memory of 5036 2912 ec94acb3d9efe0799bf76b94990393e9cf7d94760626b070d88ec7e8e0fb21eb.exe 85 PID 2912 wrote to memory of 5036 2912 ec94acb3d9efe0799bf76b94990393e9cf7d94760626b070d88ec7e8e0fb21eb.exe 85 PID 2912 wrote to memory of 5036 2912 ec94acb3d9efe0799bf76b94990393e9cf7d94760626b070d88ec7e8e0fb21eb.exe 85 PID 1940 wrote to memory of 3100 1940 ec94acb3d9efe0799bf76b94990393e9cf7d94760626b070d88ec7e8e0fb21eb.exe 88 PID 1940 wrote to memory of 3100 1940 ec94acb3d9efe0799bf76b94990393e9cf7d94760626b070d88ec7e8e0fb21eb.exe 88 PID 1940 wrote to memory of 3100 1940 ec94acb3d9efe0799bf76b94990393e9cf7d94760626b070d88ec7e8e0fb21eb.exe 88 PID 1940 wrote to memory of 3100 1940 ec94acb3d9efe0799bf76b94990393e9cf7d94760626b070d88ec7e8e0fb21eb.exe 88 PID 1940 wrote to memory of 3100 1940 ec94acb3d9efe0799bf76b94990393e9cf7d94760626b070d88ec7e8e0fb21eb.exe 88 PID 1940 wrote to memory of 3100 1940 ec94acb3d9efe0799bf76b94990393e9cf7d94760626b070d88ec7e8e0fb21eb.exe 88 PID 1940 wrote to memory of 3100 1940 ec94acb3d9efe0799bf76b94990393e9cf7d94760626b070d88ec7e8e0fb21eb.exe 88 PID 1940 wrote to memory of 3100 1940 ec94acb3d9efe0799bf76b94990393e9cf7d94760626b070d88ec7e8e0fb21eb.exe 88 PID 1940 wrote to memory of 3100 1940 ec94acb3d9efe0799bf76b94990393e9cf7d94760626b070d88ec7e8e0fb21eb.exe 88 PID 1940 wrote to memory of 3100 1940 ec94acb3d9efe0799bf76b94990393e9cf7d94760626b070d88ec7e8e0fb21eb.exe 88 PID 1940 wrote to memory of 3100 1940 ec94acb3d9efe0799bf76b94990393e9cf7d94760626b070d88ec7e8e0fb21eb.exe 88 PID 1940 wrote to memory of 3100 1940 ec94acb3d9efe0799bf76b94990393e9cf7d94760626b070d88ec7e8e0fb21eb.exe 88 PID 1940 wrote to memory of 3100 1940 ec94acb3d9efe0799bf76b94990393e9cf7d94760626b070d88ec7e8e0fb21eb.exe 88 PID 1940 wrote to memory of 3100 1940 ec94acb3d9efe0799bf76b94990393e9cf7d94760626b070d88ec7e8e0fb21eb.exe 88 PID 1940 wrote to memory of 3100 1940 ec94acb3d9efe0799bf76b94990393e9cf7d94760626b070d88ec7e8e0fb21eb.exe 88 PID 1940 wrote to memory of 3100 1940 ec94acb3d9efe0799bf76b94990393e9cf7d94760626b070d88ec7e8e0fb21eb.exe 88 PID 1940 wrote to memory of 3100 1940 ec94acb3d9efe0799bf76b94990393e9cf7d94760626b070d88ec7e8e0fb21eb.exe 88 PID 1940 wrote to memory of 3100 1940 ec94acb3d9efe0799bf76b94990393e9cf7d94760626b070d88ec7e8e0fb21eb.exe 88 PID 1940 wrote to memory of 3100 1940 ec94acb3d9efe0799bf76b94990393e9cf7d94760626b070d88ec7e8e0fb21eb.exe 88 PID 1940 wrote to memory of 3100 1940 ec94acb3d9efe0799bf76b94990393e9cf7d94760626b070d88ec7e8e0fb21eb.exe 88 PID 1940 wrote to memory of 3100 1940 ec94acb3d9efe0799bf76b94990393e9cf7d94760626b070d88ec7e8e0fb21eb.exe 88 PID 1940 wrote to memory of 3100 1940 ec94acb3d9efe0799bf76b94990393e9cf7d94760626b070d88ec7e8e0fb21eb.exe 88 PID 1940 wrote to memory of 3100 1940 ec94acb3d9efe0799bf76b94990393e9cf7d94760626b070d88ec7e8e0fb21eb.exe 88 PID 1940 wrote to memory of 3100 1940 ec94acb3d9efe0799bf76b94990393e9cf7d94760626b070d88ec7e8e0fb21eb.exe 88 PID 1940 wrote to memory of 3100 1940 ec94acb3d9efe0799bf76b94990393e9cf7d94760626b070d88ec7e8e0fb21eb.exe 88 PID 1940 wrote to memory of 3100 1940 ec94acb3d9efe0799bf76b94990393e9cf7d94760626b070d88ec7e8e0fb21eb.exe 88 PID 3592 wrote to memory of 2780 3592 ec94acb3d9efe0799bf76b94990393e9cf7d94760626b070d88ec7e8e0fb21eb.exe 90 PID 3592 wrote to memory of 2780 3592 ec94acb3d9efe0799bf76b94990393e9cf7d94760626b070d88ec7e8e0fb21eb.exe 90 PID 3592 wrote to memory of 2780 3592 ec94acb3d9efe0799bf76b94990393e9cf7d94760626b070d88ec7e8e0fb21eb.exe 90 PID 3592 wrote to memory of 2780 3592 ec94acb3d9efe0799bf76b94990393e9cf7d94760626b070d88ec7e8e0fb21eb.exe 90 PID 3592 wrote to memory of 2780 3592 ec94acb3d9efe0799bf76b94990393e9cf7d94760626b070d88ec7e8e0fb21eb.exe 90 PID 3592 wrote to memory of 2780 3592 ec94acb3d9efe0799bf76b94990393e9cf7d94760626b070d88ec7e8e0fb21eb.exe 90 PID 3592 wrote to memory of 2780 3592 ec94acb3d9efe0799bf76b94990393e9cf7d94760626b070d88ec7e8e0fb21eb.exe 90 PID 3592 wrote to memory of 2780 3592 ec94acb3d9efe0799bf76b94990393e9cf7d94760626b070d88ec7e8e0fb21eb.exe 90 PID 3592 wrote to memory of 2780 3592 ec94acb3d9efe0799bf76b94990393e9cf7d94760626b070d88ec7e8e0fb21eb.exe 90 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\ec94acb3d9efe0688bf65b94880383e9cf6d94650525b060d77ec6e7e0fb21eb.exe"C:\Users\Admin\AppData\Local\Temp\ec94acb3d9efe0688bf65b94880383e9cf6d94650525b060d77ec6e7e0fb21eb.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3172 -
C:\Users\Admin\AppData\Roaming\WinSocket\ec94acb3d9efe0799bf76b94990393e9cf7d94760626b070d88ec7e8e0fb21eb.exeC:\Users\Admin\AppData\Roaming\WinSocket\ec94acb3d9efe0799bf76b94990393e9cf7d94760626b070d88ec7e8e0fb21eb.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵PID:5036
-
-
-
C:\Users\Admin\AppData\Roaming\WinSocket\ec94acb3d9efe0799bf76b94990393e9cf7d94760626b070d88ec7e8e0fb21eb.exeC:\Users\Admin\AppData\Roaming\WinSocket\ec94acb3d9efe0799bf76b94990393e9cf7d94760626b070d88ec7e8e0fb21eb.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe2⤵PID:3100
-
-
C:\Users\Admin\AppData\Roaming\WinSocket\ec94acb3d9efe0799bf76b94990393e9cf7d94760626b070d88ec7e8e0fb21eb.exeC:\Users\Admin\AppData\Roaming\WinSocket\ec94acb3d9efe0799bf76b94990393e9cf7d94760626b070d88ec7e8e0fb21eb.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3592 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe2⤵PID:2780
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\WinSocket\ec94acb3d9efe0799bf76b94990393e9cf7d94760626b070d88ec7e8e0fb21eb.exe
Filesize1.3MB
MD5bfa7e58897f5d9f4f1f7be28c98aa768
SHA162e09cb7194008106755301f73a892aa3e99000c
SHA256ec94acb3d9efe0688bf65b94880383e9cf6d94650525b060d77ec6e7e0fb21eb
SHA512e8bcc9510544a1d7268107fec4643caca1a16dc10b23587a458e867d565dd2abf61ab0b48a4a61d29a97aa225cff58e30a25e9228cc636e197d414344ebc0038
-
Filesize
23KB
MD5cfe013fd4558ce7fee16b7a7bdbabde9
SHA1eb704acf5072b0b387659f88e5999a5f3b79dd57
SHA256d4169f3b432a7d1978363f4020a17717380f355e5a78bfe9a040cd90f2a3153b
SHA5127a70d13d9febf16a907a4a4024166c7abed736931a1b5adab5e528b27e79525bf852b9bec9d1a336169fac305b8932a8d35eb46432cb47bcc23e6df6c3453551