Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
118s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
17/08/2024, 15:27
Static task
static1
Behavioral task
behavioral1
Sample
d7513faa25b3030731bd4610c74f2050N.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
d7513faa25b3030731bd4610c74f2050N.exe
Resource
win10v2004-20240802-en
General
-
Target
d7513faa25b3030731bd4610c74f2050N.exe
-
Size
64KB
-
MD5
d7513faa25b3030731bd4610c74f2050
-
SHA1
63abbe97e10222ca0245b4d5d9d1d92fab5690cb
-
SHA256
cc330e80886b0b1cbb10112116ec9ac9c009796b4153da021af298435426933c
-
SHA512
a9bbafc6d065025b053b3e3334d885b94ffcf01820d419fbe07258fb5c4cbfbc1618ded8f8f11ab5fe07414217b8ac349878d1abf38740f6a8ad57baaf92aff4
-
SSDEEP
1536:NAo0Tj2d6rnJwwvl4ulkP6vghzwYu7vih9GueIh9j2IoHAjU+EmkcU+uhIehXeh4:NAoglOwvl4ulkP6vghzwYu7vih9GueIc
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1376 microsofthelp.exe -
Executes dropped EXE 1 IoCs
pid Process 1376 microsofthelp.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\microsofthelp = "C:\\Windows\\microsofthelp.exe" d7513faa25b3030731bd4610c74f2050N.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\microsofthelp.exe d7513faa25b3030731bd4610c74f2050N.exe File created C:\Windows\HidePlugin.dll microsofthelp.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d7513faa25b3030731bd4610c74f2050N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language microsofthelp.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2952 wrote to memory of 1376 2952 d7513faa25b3030731bd4610c74f2050N.exe 84 PID 2952 wrote to memory of 1376 2952 d7513faa25b3030731bd4610c74f2050N.exe 84 PID 2952 wrote to memory of 1376 2952 d7513faa25b3030731bd4610c74f2050N.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\d7513faa25b3030731bd4610c74f2050N.exe"C:\Users\Admin\AppData\Local\Temp\d7513faa25b3030731bd4610c74f2050N.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Windows\microsofthelp.exe"C:\Windows\microsofthelp.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1376
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD5d8de0621053863c4c5d4d4f2998ea6f3
SHA175516cbccd893c2067aaedc1cd36cc3467027c96
SHA256177e4f9820ed6b18b244c6a15265cd7444a64bfd76366bd02bdeb2b66c44c727
SHA512783e4037761257d3d1f01c10657eda978bff5b176fca504223e4a79636d1984c5ccc90a9d88576940681b24af97978626751fd1e6a72cdbc373bac0dfe877bec