Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
103s -
max time network
106s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
19/08/2024, 02:50
Static task
static1
Behavioral task
behavioral1
Sample
9b0304af83043446b7b44be3405ec340N.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
9b0304af83043446b7b44be3405ec340N.exe
Resource
win10v2004-20240802-en
General
-
Target
9b0304af83043446b7b44be3405ec340N.exe
-
Size
344KB
-
MD5
9b0304af83043446b7b44be3405ec340
-
SHA1
e163bcfd03dab1aaecb0b687cc6b3e1ce6921079
-
SHA256
f2d7f0dc2319cc63b4230a394968538002752093b302157d640282c1e4ba98d4
-
SHA512
1cd9226dfc0765645e804d7ccf5ed9495e5cd209008b7b94cd24529556f7f9f165ce66ae371ebc4eda996bddcfc1c34d616b60b3bfbff48aed598364d1cfccd2
-
SSDEEP
6144:JTz+WrPFZvTXb4RyW42vFlOloh2E+7pYUozDBRm1+gmN:JTBPFV0RyWl3h2E+7pYm0
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation 9b0304af83043446b7b44be3405ec340N.exe -
Executes dropped EXE 2 IoCs
pid Process 2184 lsassys.exe 3952 lsassys.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lsassys.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9b0304af83043446b7b44be3405ec340N.exe -
Modifies registry class 30 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\.exe 9b0304af83043446b7b44be3405ec340N.exe Set value (str) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\.exe\ = "halnt" 9b0304af83043446b7b44be3405ec340N.exe Set value (str) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\.exe\Content-Type = "application/x-msdownload" 9b0304af83043446b7b44be3405ec340N.exe Set value (str) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\.exe\shell\runas\command\ = "\"%1\" %*" 9b0304af83043446b7b44be3405ec340N.exe Key created \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings 9b0304af83043446b7b44be3405ec340N.exe Key created \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\halnt\shell\open\command 9b0304af83043446b7b44be3405ec340N.exe Set value (str) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\halnt\shell\open\command\IsolatedCommand = "\"%1\" %*" 9b0304af83043446b7b44be3405ec340N.exe Set value (str) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\halnt\ = "Application" 9b0304af83043446b7b44be3405ec340N.exe Key created \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\halnt\shell\open 9b0304af83043446b7b44be3405ec340N.exe Set value (str) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\halnt\shell\runas\command\ = "\"%1\" %*" 9b0304af83043446b7b44be3405ec340N.exe Set value (str) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\.exe\shell\open\command\IsolatedCommand = "\"%1\" %*" 9b0304af83043446b7b44be3405ec340N.exe Key created \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\.exe\shell\runas\command 9b0304af83043446b7b44be3405ec340N.exe Set value (str) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\halnt\Content-Type = "application/x-msdownload" 9b0304af83043446b7b44be3405ec340N.exe Set value (str) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\halnt\shell\runas\command\IsolatedCommand = "\"%1\" %*" 9b0304af83043446b7b44be3405ec340N.exe Key created \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\.exe\shell\open\command 9b0304af83043446b7b44be3405ec340N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 9b0304af83043446b7b44be3405ec340N.exe Key created \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\halnt 9b0304af83043446b7b44be3405ec340N.exe Key created \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\halnt\shell\runas\command 9b0304af83043446b7b44be3405ec340N.exe Set value (str) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\halnt\DefaultIcon\ = "%1" 9b0304af83043446b7b44be3405ec340N.exe Set value (str) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\halnt\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\XMMC\\lsassys.exe\" /START \"%1\" %*" 9b0304af83043446b7b44be3405ec340N.exe Key created \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\halnt\shell\runas 9b0304af83043446b7b44be3405ec340N.exe Key created \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\.exe\shell 9b0304af83043446b7b44be3405ec340N.exe Key created \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\.exe\shell\open 9b0304af83043446b7b44be3405ec340N.exe Key created \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\.exe\shell\runas 9b0304af83043446b7b44be3405ec340N.exe Key created \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\halnt\shell 9b0304af83043446b7b44be3405ec340N.exe Set value (str) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\.exe\DefaultIcon\ = "%1" 9b0304af83043446b7b44be3405ec340N.exe Key created \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\halnt\DefaultIcon 9b0304af83043446b7b44be3405ec340N.exe Key created \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\.exe\DefaultIcon 9b0304af83043446b7b44be3405ec340N.exe Set value (str) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\.exe\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\XMMC\\lsassys.exe\" /START \"%1\" %*" 9b0304af83043446b7b44be3405ec340N.exe Set value (str) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\.exe\shell\runas\command\IsolatedCommand = "\"%1\" %*" 9b0304af83043446b7b44be3405ec340N.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2184 lsassys.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4632 wrote to memory of 2184 4632 9b0304af83043446b7b44be3405ec340N.exe 86 PID 4632 wrote to memory of 2184 4632 9b0304af83043446b7b44be3405ec340N.exe 86 PID 4632 wrote to memory of 2184 4632 9b0304af83043446b7b44be3405ec340N.exe 86 PID 2184 wrote to memory of 3952 2184 lsassys.exe 87 PID 2184 wrote to memory of 3952 2184 lsassys.exe 87 PID 2184 wrote to memory of 3952 2184 lsassys.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\9b0304af83043446b7b44be3405ec340N.exe"C:\Users\Admin\AppData\Local\Temp\9b0304af83043446b7b44be3405ec340N.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Users\Admin\AppData\Roaming\Microsoft\XMMC\lsassys.exe"C:\Users\Admin\AppData\Roaming\Microsoft\XMMC\lsassys.exe" /START "C:\Users\Admin\AppData\Roaming\Microsoft\XMMC\lsassys.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Users\Admin\AppData\Roaming\Microsoft\XMMC\lsassys.exe"C:\Users\Admin\AppData\Roaming\Microsoft\XMMC\lsassys.exe"3⤵
- Executes dropped EXE
PID:3952
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
344KB
MD5183a776c49a95ac7f67d8810df31d209
SHA1402da424ac84575b27036c882b9ed644aca1e3b4
SHA2563c34d9c8e1afbb6f929d5221758ef75668a05433a9f9969da923f00ad651be87
SHA512a5a3e1ea7e5ced331b2be72b0fd05d431757d8736eefa01130e3383de5a6f3f7d117aafbb2c5068995aaaf997fb8b4576bc7b9e51b0e1419bf3227fe88214ef6