Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
135s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
16/08/2024, 20:17
Static task
static1
Behavioral task
behavioral1
Sample
f139f74a1decc22388c1a3940cd69e327177532fb64238bc54cdc60ffa9406c2.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
f139f74a1decc22388c1a3940cd69e327177532fb64238bc54cdc60ffa9406c2.exe
Resource
win10v2004-20240802-en
General
-
Target
f139f74a1decc22388c1a3940cd69e327177532fb64238bc54cdc60ffa9406c2.exe
-
Size
3.0MB
-
MD5
e33c707341cd2e87ad53c731503c2474
-
SHA1
e1ea5c178ea26230f9c482ae31080033b242ed1f
-
SHA256
f139f74a1decc22388c1a3940cd69e327177532fb64238bc54cdc60ffa9406c2
-
SHA512
3ac3a02e26dcc5b9e6a6f3b71854d1189f05526215396df6a7d6b6593d97c4be5eb0a5ab782c7c315a3cef9b4d3f416cc2685cd26ef0e8876716bd7763c79caf
-
SSDEEP
98304:+VODw+Hvv/7VcQaazHbFa6DA449UXFHO0WmZ:+VB2bVcEvA449UXI/
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 4356 Vwxyab.exe 3460 Vwxyab.exe -
Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\Vwxyab.exe f139f74a1decc22388c1a3940cd69e327177532fb64238bc54cdc60ffa9406c2.exe File opened for modification C:\Windows\SysWOW64\Vwxyab.exe f139f74a1decc22388c1a3940cd69e327177532fb64238bc54cdc60ffa9406c2.exe File opened for modification C:\Windows\SysWOW64\Vwxyab.exe -auto f139f74a1decc22388c1a3940cd69e327177532fb64238bc54cdc60ffa9406c2.exe -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Vwxyab.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f139f74a1decc22388c1a3940cd69e327177532fb64238bc54cdc60ffa9406c2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Vwxyab.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 4512 cmd.exe 952 PING.EXE -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Vwxyab.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz Vwxyab.exe -
Modifies data under HKEY_USERS 16 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie Vwxyab.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum\Version = "7" Vwxyab.exe Key created \REGISTRY\USER\.DEFAULT\Software\应用程序向导生成的本地应用程序\PlaneWar Vwxyab.exe Key created \REGISTRY\USER\.DEFAULT\Software\应用程序向导生成的本地应用程序\PlaneWar\Settings Vwxyab.exe Key created \REGISTRY\USER\.DEFAULT\MainDll\ Vwxyab.exe Key created \REGISTRY\USER\.DEFAULT\Software\应用程序向导生成的本地应用程序\PlaneWar\Recent File List Vwxyab.exe Key created \REGISTRY\USER\.DEFAULT\Software Vwxyab.exe Key created \REGISTRY\USER\.DEFAULT\Software\应用程序向导生成的本地应用程序 Vwxyab.exe Key created \REGISTRY\USER\.DEFAULT\Software\应用程序向导生成的本地应用程序\PlaneWar\Recent File List Vwxyab.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum Vwxyab.exe Key created \REGISTRY\USER\.DEFAULT\Software\应用程序向导生成的本地应用程序\PlaneWar Vwxyab.exe Key created \REGISTRY\USER\.DEFAULT\Software\应用程序向导生成的本地应用程序\PlaneWar\Settings Vwxyab.exe Key created \REGISTRY\USER\.DEFAULT\Software\应用程序向导生成的本地应用程序 Vwxyab.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft Vwxyab.exe Set value (str) \REGISTRY\USER\.DEFAULT\MainDll\ConnectGroup = "ĬÈÏ·Ö×é" Vwxyab.exe Set value (str) \REGISTRY\USER\.DEFAULT\MainDll\MarkTime = "2024-08-16 20:17" Vwxyab.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 952 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4992 f139f74a1decc22388c1a3940cd69e327177532fb64238bc54cdc60ffa9406c2.exe 4992 f139f74a1decc22388c1a3940cd69e327177532fb64238bc54cdc60ffa9406c2.exe 4356 Vwxyab.exe 4356 Vwxyab.exe 3460 Vwxyab.exe 3460 Vwxyab.exe 3460 Vwxyab.exe 3460 Vwxyab.exe 3460 Vwxyab.exe 3460 Vwxyab.exe 3460 Vwxyab.exe 3460 Vwxyab.exe 3460 Vwxyab.exe 3460 Vwxyab.exe 3460 Vwxyab.exe 3460 Vwxyab.exe 3460 Vwxyab.exe 3460 Vwxyab.exe 3460 Vwxyab.exe 3460 Vwxyab.exe 3460 Vwxyab.exe 3460 Vwxyab.exe 3460 Vwxyab.exe 3460 Vwxyab.exe 3460 Vwxyab.exe 3460 Vwxyab.exe 3460 Vwxyab.exe 3460 Vwxyab.exe 3460 Vwxyab.exe 3460 Vwxyab.exe 3460 Vwxyab.exe 3460 Vwxyab.exe 3460 Vwxyab.exe 3460 Vwxyab.exe 3460 Vwxyab.exe 3460 Vwxyab.exe 3460 Vwxyab.exe 3460 Vwxyab.exe 3460 Vwxyab.exe 3460 Vwxyab.exe 3460 Vwxyab.exe 3460 Vwxyab.exe 3460 Vwxyab.exe 3460 Vwxyab.exe 3460 Vwxyab.exe 3460 Vwxyab.exe 3460 Vwxyab.exe 3460 Vwxyab.exe 3460 Vwxyab.exe 3460 Vwxyab.exe 3460 Vwxyab.exe 3460 Vwxyab.exe 3460 Vwxyab.exe 3460 Vwxyab.exe 3460 Vwxyab.exe 3460 Vwxyab.exe 3460 Vwxyab.exe 3460 Vwxyab.exe 3460 Vwxyab.exe 3460 Vwxyab.exe 3460 Vwxyab.exe 3460 Vwxyab.exe 3460 Vwxyab.exe 3460 Vwxyab.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 4992 f139f74a1decc22388c1a3940cd69e327177532fb64238bc54cdc60ffa9406c2.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 4992 f139f74a1decc22388c1a3940cd69e327177532fb64238bc54cdc60ffa9406c2.exe 4992 f139f74a1decc22388c1a3940cd69e327177532fb64238bc54cdc60ffa9406c2.exe 4356 Vwxyab.exe 4356 Vwxyab.exe 3460 Vwxyab.exe 3460 Vwxyab.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4992 wrote to memory of 4512 4992 f139f74a1decc22388c1a3940cd69e327177532fb64238bc54cdc60ffa9406c2.exe 95 PID 4992 wrote to memory of 4512 4992 f139f74a1decc22388c1a3940cd69e327177532fb64238bc54cdc60ffa9406c2.exe 95 PID 4992 wrote to memory of 4512 4992 f139f74a1decc22388c1a3940cd69e327177532fb64238bc54cdc60ffa9406c2.exe 95 PID 4356 wrote to memory of 3460 4356 Vwxyab.exe 96 PID 4356 wrote to memory of 3460 4356 Vwxyab.exe 96 PID 4356 wrote to memory of 3460 4356 Vwxyab.exe 96 PID 4512 wrote to memory of 952 4512 cmd.exe 98 PID 4512 wrote to memory of 952 4512 cmd.exe 98 PID 4512 wrote to memory of 952 4512 cmd.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\f139f74a1decc22388c1a3940cd69e327177532fb64238bc54cdc60ffa9406c2.exe"C:\Users\Admin\AppData\Local\Temp\f139f74a1decc22388c1a3940cd69e327177532fb64238bc54cdc60ffa9406c2.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\F139F7~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.13⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:952
-
-
-
C:\Windows\SysWOW64\Vwxyab.exeC:\Windows\SysWOW64\Vwxyab.exe -auto1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Windows\SysWOW64\Vwxyab.exeC:\Windows\SysWOW64\Vwxyab.exe -acsi2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3460
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4288,i,1729213506309163284,12809566808978835441,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:81⤵PID:656
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.0MB
MD5e33c707341cd2e87ad53c731503c2474
SHA1e1ea5c178ea26230f9c482ae31080033b242ed1f
SHA256f139f74a1decc22388c1a3940cd69e327177532fb64238bc54cdc60ffa9406c2
SHA5123ac3a02e26dcc5b9e6a6f3b71854d1189f05526215396df6a7d6b6593d97c4be5eb0a5ab782c7c315a3cef9b4d3f416cc2685cd26ef0e8876716bd7763c79caf