Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
92s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
16/07/2024, 07:47
Static task
static1
Behavioral task
behavioral1
Sample
8d95a74a6d9f41b621b94b1b0de72b70N.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
8d95a74a6d9f41b621b94b1b0de72b70N.exe
Resource
win10v2004-20240709-en
General
-
Target
8d95a74a6d9f41b621b94b1b0de72b70N.exe
-
Size
86KB
-
MD5
8d95a74a6d9f41b621b94b1b0de72b70
-
SHA1
0bd5e5979bef3c41be208937685713346799a16e
-
SHA256
a48742dfd6dc4e2a52117e9e30c9a4b9d857cec60c084ce48545ee327ab5965f
-
SHA512
42e40a222e49b77a104cb0f25f8cc11926cc60d1152525c119495f9cd163ad8a0510d867010b8ba17f9d7e73a55b85b648689b2f59dcf72642df82c2f8e4f6ec
-
SSDEEP
1536:KlcPl/kojJ1AsgmPh1yLvsKKNClll85DathZ:KlcPlDj1y7sKKJpQ
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString dw20.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU dw20.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeRestorePrivilege 3468 dw20.exe Token: SeBackupPrivilege 3468 dw20.exe Token: SeBackupPrivilege 3468 dw20.exe Token: SeBackupPrivilege 3468 dw20.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 324 wrote to memory of 3468 324 8d95a74a6d9f41b621b94b1b0de72b70N.exe 85 PID 324 wrote to memory of 3468 324 8d95a74a6d9f41b621b94b1b0de72b70N.exe 85 PID 324 wrote to memory of 3468 324 8d95a74a6d9f41b621b94b1b0de72b70N.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\8d95a74a6d9f41b621b94b1b0de72b70N.exe"C:\Users\Admin\AppData\Local\Temp\8d95a74a6d9f41b621b94b1b0de72b70N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:324 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8362⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:3468
-