Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
101s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
12/07/2024, 12:26
Behavioral task
behavioral1
Sample
623daaca6c7b1589d304f6d850c25480N.exe
Resource
win7-20240705-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
623daaca6c7b1589d304f6d850c25480N.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
623daaca6c7b1589d304f6d850c25480N.exe
-
Size
12KB
-
MD5
623daaca6c7b1589d304f6d850c25480
-
SHA1
46127fb6bea8f97484d95d68b0ca3af95be2acfe
-
SHA256
d517ab4c7d58147fcfb815b98a51a5c4036db312ab370cb5ccbf39bbf3b63736
-
SHA512
f2d654697f291260a37a9796ee9e8787072715f09ec9a5d62cdd8094880c23d6f795898d59e0de4427e276d3d84e8edeb3faea162359777aba49f9ae63146c4d
-
SSDEEP
192:zjUWFh4fvYGIQnsA6psQt8FaNJhLkwcud2DH9VwGfctu55EJN:vKE7p3oaNJawcudoD7US5EJN
Score
7/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation 623daaca6c7b1589d304f6d850c25480N.exe -
Executes dropped EXE 1 IoCs
pid Process 880 WAMain.exe -
resource yara_rule behavioral2/memory/540-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x00090000000234db-16.dat upx behavioral2/memory/880-23-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/540-27-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/880-28-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows WA = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\WAMain.exe" reg.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 880 WAMain.exe Token: SeDebugPrivilege 880 WAMain.exe Token: SeDebugPrivilege 880 WAMain.exe Token: SeDebugPrivilege 880 WAMain.exe Token: SeDebugPrivilege 880 WAMain.exe Token: SeDebugPrivilege 880 WAMain.exe Token: SeDebugPrivilege 880 WAMain.exe Token: SeDebugPrivilege 880 WAMain.exe Token: SeDebugPrivilege 880 WAMain.exe Token: SeDebugPrivilege 880 WAMain.exe Token: SeDebugPrivilege 880 WAMain.exe Token: SeDebugPrivilege 880 WAMain.exe Token: SeDebugPrivilege 880 WAMain.exe Token: SeDebugPrivilege 880 WAMain.exe Token: SeDebugPrivilege 880 WAMain.exe Token: SeDebugPrivilege 880 WAMain.exe Token: SeDebugPrivilege 880 WAMain.exe Token: SeDebugPrivilege 880 WAMain.exe Token: SeDebugPrivilege 880 WAMain.exe Token: SeDebugPrivilege 880 WAMain.exe Token: SeDebugPrivilege 880 WAMain.exe Token: SeDebugPrivilege 880 WAMain.exe Token: SeDebugPrivilege 880 WAMain.exe Token: SeDebugPrivilege 880 WAMain.exe Token: SeDebugPrivilege 880 WAMain.exe Token: SeDebugPrivilege 880 WAMain.exe Token: SeDebugPrivilege 880 WAMain.exe Token: SeDebugPrivilege 880 WAMain.exe Token: SeDebugPrivilege 880 WAMain.exe Token: SeDebugPrivilege 880 WAMain.exe Token: SeDebugPrivilege 880 WAMain.exe Token: SeDebugPrivilege 880 WAMain.exe Token: SeDebugPrivilege 880 WAMain.exe Token: SeDebugPrivilege 880 WAMain.exe Token: SeDebugPrivilege 880 WAMain.exe Token: SeDebugPrivilege 880 WAMain.exe Token: SeDebugPrivilege 880 WAMain.exe Token: SeDebugPrivilege 880 WAMain.exe Token: SeDebugPrivilege 880 WAMain.exe Token: SeDebugPrivilege 880 WAMain.exe Token: SeDebugPrivilege 880 WAMain.exe Token: SeDebugPrivilege 880 WAMain.exe Token: SeDebugPrivilege 880 WAMain.exe Token: SeDebugPrivilege 880 WAMain.exe Token: SeDebugPrivilege 880 WAMain.exe Token: SeDebugPrivilege 880 WAMain.exe Token: SeDebugPrivilege 880 WAMain.exe Token: SeDebugPrivilege 880 WAMain.exe Token: SeDebugPrivilege 880 WAMain.exe Token: SeDebugPrivilege 880 WAMain.exe Token: SeDebugPrivilege 880 WAMain.exe Token: SeDebugPrivilege 880 WAMain.exe Token: SeDebugPrivilege 880 WAMain.exe Token: SeDebugPrivilege 880 WAMain.exe Token: SeDebugPrivilege 880 WAMain.exe Token: SeDebugPrivilege 880 WAMain.exe Token: SeDebugPrivilege 880 WAMain.exe Token: SeDebugPrivilege 880 WAMain.exe Token: SeDebugPrivilege 880 WAMain.exe Token: SeDebugPrivilege 880 WAMain.exe Token: SeDebugPrivilege 880 WAMain.exe Token: SeDebugPrivilege 880 WAMain.exe Token: SeDebugPrivilege 880 WAMain.exe Token: SeDebugPrivilege 880 WAMain.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 540 623daaca6c7b1589d304f6d850c25480N.exe 880 WAMain.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 540 wrote to memory of 1632 540 623daaca6c7b1589d304f6d850c25480N.exe 86 PID 540 wrote to memory of 1632 540 623daaca6c7b1589d304f6d850c25480N.exe 86 PID 540 wrote to memory of 1632 540 623daaca6c7b1589d304f6d850c25480N.exe 86 PID 1632 wrote to memory of 4132 1632 cmd.exe 89 PID 1632 wrote to memory of 4132 1632 cmd.exe 89 PID 1632 wrote to memory of 4132 1632 cmd.exe 89 PID 540 wrote to memory of 880 540 623daaca6c7b1589d304f6d850c25480N.exe 90 PID 540 wrote to memory of 880 540 623daaca6c7b1589d304f6d850c25480N.exe 90 PID 540 wrote to memory of 880 540 623daaca6c7b1589d304f6d850c25480N.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\623daaca6c7b1589d304f6d850c25480N.exe"C:\Users\Admin\AppData\Local\Temp\623daaca6c7b1589d304f6d850c25480N.exe"1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:540 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FLYKS.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows WA" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe" /f3⤵
- Adds Run key to start application
PID:4132
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe"C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:880
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
148B
MD53a4614705555abb049c3298e61170b7f
SHA1c8686410756f346d9551256a5b878b04770950ba
SHA256cff0663c8cfadf83b80583a871c313ffc5d950cb503809cb4a482f400c5d846b
SHA51265ce6fec00e6934f21635e7ccd74757f31ed4b0ddb52bd80d3ea9abeba56340128d23151ef7d9f5daacb5d61e4a4cca50dbb3a43132e350522311ee06e829007
-
Filesize
12KB
MD594129a9aee7f3c927b820595565a962c
SHA1a478874cefb24490e4ac537bb46b775d2767d628
SHA25695e3caa0a8fd93efc4fe76936443bdc9f619a79773b1db7bc377e8fef20fd936
SHA51240280a882ad3ec7b9e3ae5c629f196daf88077c029de0afeb4b0396577df54ef8e1af33d4736011ccc84792f8d8dd508072dd174a10be727a47f85a7abd1dba9