Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
02/08/2024, 20:06
Static task
static1
Behavioral task
behavioral1
Sample
c96809f6331441516a186ca43cdf9b90N.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
c96809f6331441516a186ca43cdf9b90N.exe
Resource
win10v2004-20240802-en
General
-
Target
c96809f6331441516a186ca43cdf9b90N.exe
-
Size
60KB
-
MD5
c96809f6331441516a186ca43cdf9b90
-
SHA1
7964037ac96463dd742fc33dbaeb7ecd6159c5f9
-
SHA256
82597ba16b24fa97cd5d9ac608e68a8e9994a828bac9961e9084c368ca35c628
-
SHA512
530c2c922b87fdea59e2d5edaac04e35285f363b6476235704b7ab168d38e6da9840f42e0b7421a9de71f8e6a378b71ffc532ab2a684bf9d6d5f919b06b09d47
-
SSDEEP
1536:NAo0Tj2d6rnJwwvl4ulkP6v8tvGE9UHrSdghj8bvHRIkhbUIchUh80mhDhNIhH+Z:NAoglOwvl4ulkP6v8tvGE9UHrSdghj8q
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 4572 microsofthelp.exe -
Executes dropped EXE 1 IoCs
pid Process 4572 microsofthelp.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\microsofthelp = "C:\\Windows\\microsofthelp.exe" c96809f6331441516a186ca43cdf9b90N.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\microsofthelp.exe c96809f6331441516a186ca43cdf9b90N.exe File created C:\Windows\HidePlugin.dll microsofthelp.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c96809f6331441516a186ca43cdf9b90N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language microsofthelp.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4840 wrote to memory of 4572 4840 c96809f6331441516a186ca43cdf9b90N.exe 82 PID 4840 wrote to memory of 4572 4840 c96809f6331441516a186ca43cdf9b90N.exe 82 PID 4840 wrote to memory of 4572 4840 c96809f6331441516a186ca43cdf9b90N.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\c96809f6331441516a186ca43cdf9b90N.exe"C:\Users\Admin\AppData\Local\Temp\c96809f6331441516a186ca43cdf9b90N.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\Windows\microsofthelp.exe"C:\Windows\microsofthelp.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4572
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60KB
MD5dc6c20aee501f757cddbcb30a02070cb
SHA1b01fc07f670d97a8b65e5bf0b2bbd821be776ef9
SHA25620200852aa942dea824b89386b75b8fec2533c324ea3f6f5f491e672143365cc
SHA512454ae235eb34630ac5dd9c856a299d6313a80f3320e4cad1931e15c70ff36f7addf32e172fdacca0f65fd4048bfcb6b00dbf26aaf85dcbdb6ebd426fabde2ada