Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20240730-en -
resource tags
arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system -
submitted
02/08/2024, 00:34
Behavioral task
behavioral1
Sample
284ed435437a6ca4cf1deef2a2428fb0N.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
284ed435437a6ca4cf1deef2a2428fb0N.exe
Resource
win10v2004-20240730-en
General
-
Target
284ed435437a6ca4cf1deef2a2428fb0N.exe
-
Size
29KB
-
MD5
284ed435437a6ca4cf1deef2a2428fb0
-
SHA1
8df49eafb8b1fcf1d9662567048f208ba2b9cb30
-
SHA256
9727c4e7b5960987134b31e11d861a1d984918006c7e30aaf1f51d8d924edd3b
-
SHA512
7c05f3c396de7e915af07ec3e7d69b5c7d02ed57e1a2bf3c50e9db17b0cb30a443fda405c7c5ce378bfc70d08882ae01b2033ec8376e0f9cd76f4bbc26001ef9
-
SSDEEP
768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/S:AEwVs+0jNDY1qi/qq
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2564 services.exe -
resource yara_rule behavioral2/memory/3192-0-0x0000000000500000-0x0000000000510200-memory.dmp upx behavioral2/files/0x000a0000000234a0-4.dat upx behavioral2/memory/2564-7-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/3192-13-0x0000000000500000-0x0000000000510200-memory.dmp upx behavioral2/memory/2564-14-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/2564-19-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/2564-24-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/2564-26-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/2564-31-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/2564-36-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/2564-38-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/2564-43-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/2564-48-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/2564-50-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/3192-54-0x0000000000500000-0x0000000000510200-memory.dmp upx behavioral2/memory/2564-55-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/files/0x000400000001e740-65.dat upx -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe" 284ed435437a6ca4cf1deef2a2428fb0N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe" services.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\services.exe 284ed435437a6ca4cf1deef2a2428fb0N.exe File opened for modification C:\Windows\java.exe 284ed435437a6ca4cf1deef2a2428fb0N.exe File created C:\Windows\java.exe 284ed435437a6ca4cf1deef2a2428fb0N.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 284ed435437a6ca4cf1deef2a2428fb0N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language services.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3192 wrote to memory of 2564 3192 284ed435437a6ca4cf1deef2a2428fb0N.exe 83 PID 3192 wrote to memory of 2564 3192 284ed435437a6ca4cf1deef2a2428fb0N.exe 83 PID 3192 wrote to memory of 2564 3192 284ed435437a6ca4cf1deef2a2428fb0N.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\284ed435437a6ca4cf1deef2a2428fb0N.exe"C:\Users\Admin\AppData\Local\Temp\284ed435437a6ca4cf1deef2a2428fb0N.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3192 -
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2564
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
178KB
MD5811d6c0077b4cd5d74818f27a39a5bd9
SHA1771eebbb3f3f1c77d2c8e577798d774e3d521475
SHA2560a572384f86a5b54bf7a553c329af2e3bab88fb134492e5198d727156adf02e3
SHA5125799c5df8ee8491280d0aa533fed3c7c1e276cf28b69c781ab821f7313bd10baf2d56ee52f390b2ba5f6c29c596e9d3bc659bbfecbb7516c2b8ecba4fb9245bc
-
Filesize
29KB
MD5aedc882372aaeb8663540bfcef563e1c
SHA1b5ff41311fb6cb7d292c9c166a43b30c045fcaeb
SHA2568873733f06e6590fc185609b5118b0cd97fe4e5eaa7949976d563b43dcf1ca8d
SHA5129c2bec7a827bed64c178a356cceaef60368a2cf51164489f3fe10756776cfe728466138bfa4eefe024ffe9fab0450e4c2e4349297f1987ecdfd4e9b0227ce804
-
Filesize
352B
MD5f439a525437e6a4c5c9046c2a01bdaa4
SHA1b29a2760bfaa12d4d1b3c2125a8a04c56c717a5e
SHA256c150ce4b8c238941a84a2b58217d918b159a2b1b742a6731c5e2414c5ee6d86e
SHA51270d207efeadc80c9724bff23cd82019e1a01e877c33038311e780b0e308eda4cb54202d1b1f28a6ecae4daf0f94797c08ff3d6296b67e99a93963b21f4ac783c
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2