Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
15/07/2024, 12:13
Static task
static1
Behavioral task
behavioral1
Sample
d6c76ad4feae66d438c107543d715d90N.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
d6c76ad4feae66d438c107543d715d90N.exe
Resource
win10v2004-20240709-en
General
-
Target
d6c76ad4feae66d438c107543d715d90N.exe
-
Size
39KB
-
MD5
d6c76ad4feae66d438c107543d715d90
-
SHA1
23aec32de3b695a0ea1c32e1d9521868217b09c4
-
SHA256
47411c4508903ce82c06eaa0653d3517d04e1ab6d95c3a4f32a122cc1fd5ca3b
-
SHA512
46005b9bf89184d3a8962f49ffdc113b72fd4d847ea7a0f3175c302bc0fc952c2928dab9584b0b4c7f6412aa71e84a1f2ce49bc7fd8a0ff44a8a6d64c3d167dc
-
SSDEEP
768:DqPJtsA6C1VqahohtgVRNToV7TtRu8rM0wYVFl2g5coW58dO0xXHV2EfKYfdhNhR:DqMA6C1VqaqhtgVRNToV7TtRu8rM0wYx
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 212 microsofthelp.exe -
Executes dropped EXE 1 IoCs
pid Process 212 microsofthelp.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\microsofthelp = "C:\\Windows\\microsofthelp.exe" d6c76ad4feae66d438c107543d715d90N.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\microsofthelp.exe d6c76ad4feae66d438c107543d715d90N.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 208 wrote to memory of 212 208 d6c76ad4feae66d438c107543d715d90N.exe 83 PID 208 wrote to memory of 212 208 d6c76ad4feae66d438c107543d715d90N.exe 83 PID 208 wrote to memory of 212 208 d6c76ad4feae66d438c107543d715d90N.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\d6c76ad4feae66d438c107543d715d90N.exe"C:\Users\Admin\AppData\Local\Temp\d6c76ad4feae66d438c107543d715d90N.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:208 -
C:\Windows\microsofthelp.exe"C:\Windows\microsofthelp.exe"2⤵
- Deletes itself
- Executes dropped EXE
PID:212
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
39KB
MD5a38d2357c9394950bf12d2d3b078c276
SHA1180f2bc8077ce471e388a6c818acf22de97f9108
SHA2564270549ee406986fca3ff1b1d19bb74e1aa1e3214f64ca6f7b43a2f3aacaac3c
SHA51272eb687947dcd42724ce9d40fd71c4dcba1dab2032e2bdbb034283d47916c03938d662655f14651e7bfea1bedb6a6c34d1ca91b59668ab01ff682d26f84e1d19