Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
107s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
18/08/2024, 04:07
Static task
static1
Behavioral task
behavioral1
Sample
7cdd9c652e445bc9c910f45f85b55c70N.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
7cdd9c652e445bc9c910f45f85b55c70N.exe
Resource
win10v2004-20240802-en
General
-
Target
7cdd9c652e445bc9c910f45f85b55c70N.exe
-
Size
63KB
-
MD5
7cdd9c652e445bc9c910f45f85b55c70
-
SHA1
17be3c4df55a1458df5b87f2491f67b098caa050
-
SHA256
149de51d84ee7800afc13f835beff271c10c5764a5f11b65d013220e77791454
-
SHA512
5b492c42fb386e24a9f01ab45a680a3a5382ec32514cae2ad7eebd177120ab9ddf77c804f23abedf79e411a95ad9656e468aa9a835733c1b40a1ba7bd20094ab
-
SSDEEP
1536:lAo0ej2d6rnJwwvlKlIUBP6vghzwYu7vih9GueIh9j2IoHAjUvJjWH0HNh3hOh67:lAo1lOwvlKlXBP6vghzwYu7vih9GueIO
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2576 microsofthelp.exe -
Executes dropped EXE 1 IoCs
pid Process 2576 microsofthelp.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\microsofthelp = "C:\\Windows\\microsofthelp.exe" 7cdd9c652e445bc9c910f45f85b55c70N.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\microsofthelp.exe 7cdd9c652e445bc9c910f45f85b55c70N.exe File created C:\Windows\HidePlugin.dll microsofthelp.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7cdd9c652e445bc9c910f45f85b55c70N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language microsofthelp.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1776 wrote to memory of 2576 1776 7cdd9c652e445bc9c910f45f85b55c70N.exe 84 PID 1776 wrote to memory of 2576 1776 7cdd9c652e445bc9c910f45f85b55c70N.exe 84 PID 1776 wrote to memory of 2576 1776 7cdd9c652e445bc9c910f45f85b55c70N.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\7cdd9c652e445bc9c910f45f85b55c70N.exe"C:\Users\Admin\AppData\Local\Temp\7cdd9c652e445bc9c910f45f85b55c70N.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Windows\microsofthelp.exe"C:\Windows\microsofthelp.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2576
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD57fb4f396798d557d38a5c62c0109264e
SHA1000de3dcace26fb44e0e0a5e6ca7c6ba3eb2a5cb
SHA256856878f95a91edd9927ef703d1103b42cd2391da969028c656e9c1531f12f619
SHA512688d8cac5a1e0fd5e4e3ce69b8cac9e80e25a316f80a2be76c6bba0e91630ea5ca5944c6f547da34de5ace76241b4254f6894a6640c43c17d3a4812c89ebd335