Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
101s -
max time network
102s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
22/07/2024, 07:28
Static task
static1
Behavioral task
behavioral1
Sample
7bce0437d8dd3e343e1cd207ad71aa20N.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
7bce0437d8dd3e343e1cd207ad71aa20N.exe
Resource
win10v2004-20240709-en
General
-
Target
7bce0437d8dd3e343e1cd207ad71aa20N.exe
-
Size
490KB
-
MD5
7bce0437d8dd3e343e1cd207ad71aa20
-
SHA1
420576543e75f215ea357467a127058b94d1d136
-
SHA256
24d06d9db20ce0b44896ac3e02b99a032b7ad5b8c884ffa30046e1d41b7e9c6d
-
SHA512
c15735260e24768eb8881e37348cd4a90374f19d7f8c2c7e3d5380e86f4f216a249c2e3551be3169f7a34dc938b65d19ad29c81b7888aa63d29951d3e0da9a4f
-
SSDEEP
12288:hHJj3R/vGJl1xLdNb9l+FfeHO9HfxuvCM:hHx3R/voDpQCc2Z
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 7bce0437d8dd3e343e1cd207ad71aa20N.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\Control Panel\International\Geo\Nation 7bce0437d8dd3e343e1cd207ad71aa20N.exe -
Executes dropped EXE 1 IoCs
pid Process 2424 s5926.exe -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File created C:\Windows\assembly\Desktop.ini s5926.exe File opened for modification C:\Windows\assembly\Desktop.ini s5926.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\assembly\Desktop.ini s5926.exe File opened for modification C:\Windows\assembly s5926.exe File created C:\Windows\assembly\Desktop.ini s5926.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 4384 2756 WerFault.exe 82 -
Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS 7bce0437d8dd3e343e1cd207ad71aa20N.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer 7bce0437d8dd3e343e1cd207ad71aa20N.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2756 7bce0437d8dd3e343e1cd207ad71aa20N.exe 2756 7bce0437d8dd3e343e1cd207ad71aa20N.exe 2424 s5926.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2424 s5926.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2424 s5926.exe 2424 s5926.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 2756 wrote to memory of 2424 2756 7bce0437d8dd3e343e1cd207ad71aa20N.exe 84 PID 2756 wrote to memory of 2424 2756 7bce0437d8dd3e343e1cd207ad71aa20N.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\7bce0437d8dd3e343e1cd207ad71aa20N.exe"C:\Users\Admin\AppData\Local\Temp\7bce0437d8dd3e343e1cd207ad71aa20N.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks computer location settings
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\n5926\s5926.exe"C:\Users\Admin\AppData\Local\Temp\n5926\s5926.exe" ins.exe /t 5387a629561ca3d94e8b4704 /e 12738328 /u c2b30e9f-da98-11e3-8a58-80c16e6f498c /v "C:\Users\Admin\AppData\Local\Temp\7bce0437d8dd3e343e1cd207ad71aa20N.exe"2⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2424
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2756 -s 44722⤵
- Program crash
PID:4384
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2756 -ip 27561⤵PID:2972
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
284KB
MD59e24fe7dce5a39ec33319909e3e2e9de
SHA1492d86466cd12c98803a262672cb5171f341e8d1
SHA25605cdd536227ac4ebab76770ed3b2bbc364deb8cfdc1f6a6f598ecb86aa3d268f
SHA512155b353506ef81cf0149178f8dc4b75575dbd0a2d2912038dac1278d8db454fb80edfd84958ebfeb6a3ef9c5de19af1284224bf7bb4af7113c863c3b1be1f4e1