Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
15/07/2024, 20:36
Static task
static1
Behavioral task
behavioral1
Sample
2bfe663182d19fb2a224d40ffe026b46cae1afd3ef2abd77bf2671acc8008a2c.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2bfe663182d19fb2a224d40ffe026b46cae1afd3ef2abd77bf2671acc8008a2c.exe
Resource
win10v2004-20240709-en
General
-
Target
2bfe663182d19fb2a224d40ffe026b46cae1afd3ef2abd77bf2671acc8008a2c.exe
-
Size
1.1MB
-
MD5
d211cd8df3e10621a5951f9059f469a3
-
SHA1
42da17aedf134c5793d308c8f0cfabb292c61bde
-
SHA256
2bfe663182d19fb2a224d40ffe026b46cae1afd3ef2abd77bf2671acc8008a2c
-
SHA512
b9b3d6bd541f71e9e5426c168803faef8ab6f118e2c1f983372acfd8965bc93c3ff60db0e01b64c15229a41b6a50230bad7964ffc0b0f9e01bb04a711fc570c2
-
SSDEEP
24576:aH0dl8myX9Bg42QoXFkrzkmplSgRDYo0lG4Z8r7Qfbkiu5Qt:acallSllG4ZM7QzMG
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation 2bfe663182d19fb2a224d40ffe026b46cae1afd3ef2abd77bf2671acc8008a2c.exe -
Deletes itself 1 IoCs
pid Process 1748 svchcst.exe -
Executes dropped EXE 2 IoCs
pid Process 1748 svchcst.exe 3056 svchcst.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ WScript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ WScript.exe Key created \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000_Classes\Local Settings 2bfe663182d19fb2a224d40ffe026b46cae1afd3ef2abd77bf2671acc8008a2c.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1520 2bfe663182d19fb2a224d40ffe026b46cae1afd3ef2abd77bf2671acc8008a2c.exe 1520 2bfe663182d19fb2a224d40ffe026b46cae1afd3ef2abd77bf2671acc8008a2c.exe 1520 2bfe663182d19fb2a224d40ffe026b46cae1afd3ef2abd77bf2671acc8008a2c.exe 1520 2bfe663182d19fb2a224d40ffe026b46cae1afd3ef2abd77bf2671acc8008a2c.exe 1748 svchcst.exe 1748 svchcst.exe 1748 svchcst.exe 1748 svchcst.exe 1748 svchcst.exe 1748 svchcst.exe 1748 svchcst.exe 1748 svchcst.exe 1748 svchcst.exe 1748 svchcst.exe 1748 svchcst.exe 1748 svchcst.exe 1748 svchcst.exe 1748 svchcst.exe 1748 svchcst.exe 1748 svchcst.exe 1748 svchcst.exe 1748 svchcst.exe 1748 svchcst.exe 1748 svchcst.exe 1748 svchcst.exe 1748 svchcst.exe 1748 svchcst.exe 1748 svchcst.exe 1748 svchcst.exe 1748 svchcst.exe 1748 svchcst.exe 1748 svchcst.exe 1748 svchcst.exe 1748 svchcst.exe 1748 svchcst.exe 1748 svchcst.exe 1748 svchcst.exe 1748 svchcst.exe 1748 svchcst.exe 1748 svchcst.exe 1748 svchcst.exe 1748 svchcst.exe 1748 svchcst.exe 1748 svchcst.exe 1748 svchcst.exe 1748 svchcst.exe 1748 svchcst.exe 1748 svchcst.exe 1748 svchcst.exe 1748 svchcst.exe 1748 svchcst.exe 1748 svchcst.exe 1748 svchcst.exe 1748 svchcst.exe 1748 svchcst.exe 1748 svchcst.exe 1748 svchcst.exe 1748 svchcst.exe 1748 svchcst.exe 1748 svchcst.exe 1748 svchcst.exe 1748 svchcst.exe 1748 svchcst.exe 1748 svchcst.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1520 2bfe663182d19fb2a224d40ffe026b46cae1afd3ef2abd77bf2671acc8008a2c.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1520 2bfe663182d19fb2a224d40ffe026b46cae1afd3ef2abd77bf2671acc8008a2c.exe 1520 2bfe663182d19fb2a224d40ffe026b46cae1afd3ef2abd77bf2671acc8008a2c.exe 3056 svchcst.exe 1748 svchcst.exe 1748 svchcst.exe 3056 svchcst.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1520 wrote to memory of 1588 1520 2bfe663182d19fb2a224d40ffe026b46cae1afd3ef2abd77bf2671acc8008a2c.exe 85 PID 1520 wrote to memory of 1588 1520 2bfe663182d19fb2a224d40ffe026b46cae1afd3ef2abd77bf2671acc8008a2c.exe 85 PID 1520 wrote to memory of 1588 1520 2bfe663182d19fb2a224d40ffe026b46cae1afd3ef2abd77bf2671acc8008a2c.exe 85 PID 1520 wrote to memory of 2324 1520 2bfe663182d19fb2a224d40ffe026b46cae1afd3ef2abd77bf2671acc8008a2c.exe 86 PID 1520 wrote to memory of 2324 1520 2bfe663182d19fb2a224d40ffe026b46cae1afd3ef2abd77bf2671acc8008a2c.exe 86 PID 1520 wrote to memory of 2324 1520 2bfe663182d19fb2a224d40ffe026b46cae1afd3ef2abd77bf2671acc8008a2c.exe 86 PID 1588 wrote to memory of 1748 1588 WScript.exe 90 PID 2324 wrote to memory of 3056 2324 WScript.exe 89 PID 2324 wrote to memory of 3056 2324 WScript.exe 89 PID 2324 wrote to memory of 3056 2324 WScript.exe 89 PID 1588 wrote to memory of 1748 1588 WScript.exe 90 PID 1588 wrote to memory of 1748 1588 WScript.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\2bfe663182d19fb2a224d40ffe026b46cae1afd3ef2abd77bf2671acc8008a2c.exe"C:\Users\Admin\AppData\Local\Temp\2bfe663182d19fb2a224d40ffe026b46cae1afd3ef2abd77bf2671acc8008a2c.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"2⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1588 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"3⤵
- Deletes itself
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1748
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"2⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3056
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
753B
MD52e9897fecf52213da99b3d221bcd3fe4
SHA1cc9c9039c24e1401cd648c960a5b5831a3fa955e
SHA2562391e00c9ef4a134c69da656a17c57927f2509ea33b8b4e6bdb5e840cf1e4e53
SHA512cb081075528a5ffe9619a4af32cd38170a1b4295ff616d7279a776edf1007e956f6d440bef5059cefece0b12ff01f3097c9c945c78eec251b9148df41261a1c0
-
Filesize
1.1MB
MD522b244f6da992b78b764191c93c9c416
SHA12f2ade540be4bc4d72dac34769306e94798e10f7
SHA2565d459544c540790b20c9407bf65ebd0f14f16bc131ba76178bf90cb0682fab38
SHA51227bd5596773b6f23992c2758286b129902a5b83dd396f99c0e8afe92eefa9f8e06ce405850961d7c1ab6ec4ad75cb88743a9f9263c6f95f393cee38c505098f9