Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
105s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
26/07/2024, 10:07
Static task
static1
Behavioral task
behavioral1
Sample
be3c24755243df82d3f1cc1ed1bd3d70N.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
be3c24755243df82d3f1cc1ed1bd3d70N.exe
Resource
win10v2004-20240709-en
General
-
Target
be3c24755243df82d3f1cc1ed1bd3d70N.exe
-
Size
408KB
-
MD5
be3c24755243df82d3f1cc1ed1bd3d70
-
SHA1
a8c799ab3e7979672b199900b14ac7a960bf14b3
-
SHA256
2090d63e62edd2776154e999ca80010e5258c6a2337d4142d563ad2e52fa32db
-
SHA512
3eff60720d18e248d53e63258275e3f297ffc33509f3998fc72c2d8e39a5756769031e8876e6e0a150abadb71444b3d9cb55980bb9b08f22e7c9ce844ae3ef46
-
SSDEEP
6144:Dck18MipfIUaQYu8tbS6JBcj0U5hjX/Tvf8MjKFW8jb/HVbdsifRe9+fHrGJH:DX8Djadu8J4YSjX/THKxr1bBGsHrGJH
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\Control Panel\International\Geo\Nation be3c24755243df82d3f1cc1ed1bd3d70N.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IntelPowerAgent1 = "rundll32.exe shell32.dll, ShellExec_RunDLL C:\\PROGRA~3\\DBD0F4~1.EXE" svchost.exe -
Checks for any installed AV software in registry 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Software\WOW6432Node\Avira svchost.exe Key opened \REGISTRY\MACHINE\Software\WOW6432Node\AVAST Software\Avast svchost.exe Key opened \REGISTRY\MACHINE\Software\WOW6432Node\Eset\Nod svchost.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3624 set thread context of 3244 3624 be3c24755243df82d3f1cc1ed1bd3d70N.exe 88 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language be3c24755243df82d3f1cc1ed1bd3d70N.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3244 svchost.exe 3244 svchost.exe 3244 svchost.exe 3244 svchost.exe 3244 svchost.exe 3244 svchost.exe 3244 svchost.exe 3244 svchost.exe 3244 svchost.exe 3244 svchost.exe 3244 svchost.exe 3244 svchost.exe 3244 svchost.exe 3244 svchost.exe 3244 svchost.exe 3244 svchost.exe 3244 svchost.exe 3244 svchost.exe 3244 svchost.exe 3244 svchost.exe 3244 svchost.exe 3244 svchost.exe 3244 svchost.exe 3244 svchost.exe 3244 svchost.exe 3244 svchost.exe 3244 svchost.exe 3244 svchost.exe 3244 svchost.exe 3244 svchost.exe 3244 svchost.exe 3244 svchost.exe 3244 svchost.exe 3244 svchost.exe 3244 svchost.exe 3244 svchost.exe 3244 svchost.exe 3244 svchost.exe 3244 svchost.exe 3244 svchost.exe 3244 svchost.exe 3244 svchost.exe 3244 svchost.exe 3244 svchost.exe 3244 svchost.exe 3244 svchost.exe 3244 svchost.exe 3244 svchost.exe 3244 svchost.exe 3244 svchost.exe 3244 svchost.exe 3244 svchost.exe 3244 svchost.exe 3244 svchost.exe 3244 svchost.exe 3244 svchost.exe 3244 svchost.exe 3244 svchost.exe 3244 svchost.exe 3244 svchost.exe 3244 svchost.exe 3244 svchost.exe 3244 svchost.exe 3244 svchost.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 3624 wrote to memory of 3244 3624 be3c24755243df82d3f1cc1ed1bd3d70N.exe 88 PID 3624 wrote to memory of 3244 3624 be3c24755243df82d3f1cc1ed1bd3d70N.exe 88 PID 3624 wrote to memory of 3244 3624 be3c24755243df82d3f1cc1ed1bd3d70N.exe 88 PID 3624 wrote to memory of 3244 3624 be3c24755243df82d3f1cc1ed1bd3d70N.exe 88 PID 3624 wrote to memory of 3244 3624 be3c24755243df82d3f1cc1ed1bd3d70N.exe 88 PID 3624 wrote to memory of 3244 3624 be3c24755243df82d3f1cc1ed1bd3d70N.exe 88 PID 3624 wrote to memory of 3244 3624 be3c24755243df82d3f1cc1ed1bd3d70N.exe 88 PID 3624 wrote to memory of 3244 3624 be3c24755243df82d3f1cc1ed1bd3d70N.exe 88 PID 3624 wrote to memory of 3244 3624 be3c24755243df82d3f1cc1ed1bd3d70N.exe 88 PID 3624 wrote to memory of 3244 3624 be3c24755243df82d3f1cc1ed1bd3d70N.exe 88 PID 3624 wrote to memory of 3244 3624 be3c24755243df82d3f1cc1ed1bd3d70N.exe 88 PID 3244 wrote to memory of 3624 3244 svchost.exe 83 PID 3244 wrote to memory of 3624 3244 svchost.exe 83 PID 3244 wrote to memory of 3624 3244 svchost.exe 83 PID 3244 wrote to memory of 3624 3244 svchost.exe 83 PID 3244 wrote to memory of 3624 3244 svchost.exe 83 PID 3244 wrote to memory of 3624 3244 svchost.exe 83 PID 3244 wrote to memory of 3624 3244 svchost.exe 83 PID 3624 wrote to memory of 4396 3624 be3c24755243df82d3f1cc1ed1bd3d70N.exe 89 PID 3624 wrote to memory of 4396 3624 be3c24755243df82d3f1cc1ed1bd3d70N.exe 89 PID 3624 wrote to memory of 4396 3624 be3c24755243df82d3f1cc1ed1bd3d70N.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\be3c24755243df82d3f1cc1ed1bd3d70N.exe"C:\Users\Admin\AppData\Local\Temp\be3c24755243df82d3f1cc1ed1bd3d70N.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3624 -
C:\Windows\SysWOW64\svchost.exeC:\ProgramData\dbd0f404b8.exe2⤵
- Adds Run key to start application
- Checks for any installed AV software in registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3244
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\sgtCB83.tmp.bat" "C:\Users\Admin\AppData\Local\Temp\be3c24755243df82d3f1cc1ed1bd3d70N.exe""2⤵
- System Location Discovery: System Language Discovery
PID:4396
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
29B
MD5c42913fb526f7d62f01a1020419bdb5a
SHA10e643a62ea35e3b43b7a9e2f1409a429d444be38
SHA256ba902d9e6fc171c70b5855a3bac7b9e2f3491d8b119a06a2fdf1bd7d056fdfd4
SHA5124c61c5b12d60111151fdaa4f6a4c6df9c87bebce282f9f4cdb94baa9619056b50a656c0de58b9026adaf5d0298979f5bb50e873083d0413cfb69e5131902f55c