Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

2bfe663182...2c.exe

windows7-x64

7

2bfe663182...2c.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    148s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/07/2024, 20:36

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2bfe663182d19fb2a224d40ffe026b46cae1afd3ef2abd77bf2671acc8008a2c.exe

  • Size

    1.1MB

  • MD5

    d211cd8df3e10621a5951f9059f469a3

  • SHA1

    42da17aedf134c5793d308c8f0cfabb292c61bde

  • SHA256

    2bfe663182d19fb2a224d40ffe026b46cae1afd3ef2abd77bf2671acc8008a2c

  • SHA512

    b9b3d6bd541f71e9e5426c168803faef8ab6f118e2c1f983372acfd8965bc93c3ff60db0e01b64c15229a41b6a50230bad7964ffc0b0f9e01bb04a711fc570c2

  • SSDEEP

    24576:aH0dl8myX9Bg42QoXFkrzkmplSgRDYo0lG4Z8r7Qfbkiu5Qt:acallSllG4ZM7QzMG

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2bfe663182d19fb2a224d40ffe026b46cae1afd3ef2abd77bf2671acc8008a2c.exe
    "C:\Users\Admin\AppData\Local\Temp\2bfe663182d19fb2a224d40ffe026b46cae1afd3ef2abd77bf2671acc8008a2c.exe"
    1⤵
    • Checks computer location settings
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1520
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
      2⤵
      • Checks computer location settings
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:1588
      • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
        3⤵
        • Deletes itself
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:1748
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
      2⤵
      • Checks computer location settings
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2324
      • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:3056

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
    Filesize

    753B

    MD5

    2e9897fecf52213da99b3d221bcd3fe4

    SHA1

    cc9c9039c24e1401cd648c960a5b5831a3fa955e

    SHA256

    2391e00c9ef4a134c69da656a17c57927f2509ea33b8b4e6bdb5e840cf1e4e53

    SHA512

    cb081075528a5ffe9619a4af32cd38170a1b4295ff616d7279a776edf1007e956f6d440bef5059cefece0b12ff01f3097c9c945c78eec251b9148df41261a1c0

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
    Filesize

    1.1MB

    MD5

    22b244f6da992b78b764191c93c9c416

    SHA1

    2f2ade540be4bc4d72dac34769306e94798e10f7

    SHA256

    5d459544c540790b20c9407bf65ebd0f14f16bc131ba76178bf90cb0682fab38

    SHA512

    27bd5596773b6f23992c2758286b129902a5b83dd396f99c0e8afe92eefa9f8e06ce405850961d7c1ab6ec4ad75cb88743a9f9263c6f95f393cee38c505098f9

    Download Submit

  • memory/1520-0-0x0000000000400000-0x000000000055F000-memory.dmp

    Filesize

    1.4MB

    Download

  • memory/1520-11-0x0000000000400000-0x000000000055F000-memory.dmp

    Filesize

    1.4MB

    Download

  • memory/1748-17-0x0000000000400000-0x000000000055F000-memory.dmp

    Filesize

    1.4MB

    Download

  • memory/3056-15-0x0000000000400000-0x000000000055F000-memory.dmp

    Filesize

    1.4MB

    Download

  • memory/3056-16-0x0000000000400000-0x000000000055F000-memory.dmp

    Filesize

    1.4MB

    Download