Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
102s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
21/08/2024, 13:06
Static task
static1
Behavioral task
behavioral1
Sample
c83c1a67a2d39dd131ba716842b83010N.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
c83c1a67a2d39dd131ba716842b83010N.exe
Resource
win10v2004-20240802-en
General
-
Target
c83c1a67a2d39dd131ba716842b83010N.exe
-
Size
63KB
-
MD5
c83c1a67a2d39dd131ba716842b83010
-
SHA1
9e2b7ad2af2559464affc6dd64ddd32d441c18ca
-
SHA256
b6888b8925cbcfc980e4e0ea8a9d68ff2e7a1289ed456abdfdc8f614312abd62
-
SHA512
42a4b9416773bedb16bf45e55c3ef6a8854e6b958cbb133e785b6950ab1e59290929657760bc23480942a58e9b11220381b3a37f955e2e37d37f8cfb45462e6d
-
SSDEEP
1536:lAo0ej2d6rnJwwvlKlIUBP6v8tvGE9UHrSdghj8bvHRIkhbUIchUh80mhDoOho8F:lAo1lOwvlKlXBP6v8tvGE9UHrSdghj8e
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 4048 microsofthelp.exe -
Executes dropped EXE 1 IoCs
pid Process 4048 microsofthelp.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\microsofthelp = "C:\\Windows\\microsofthelp.exe" c83c1a67a2d39dd131ba716842b83010N.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\HidePlugin.dll microsofthelp.exe File created C:\Windows\microsofthelp.exe c83c1a67a2d39dd131ba716842b83010N.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c83c1a67a2d39dd131ba716842b83010N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language microsofthelp.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2620 wrote to memory of 4048 2620 c83c1a67a2d39dd131ba716842b83010N.exe 84 PID 2620 wrote to memory of 4048 2620 c83c1a67a2d39dd131ba716842b83010N.exe 84 PID 2620 wrote to memory of 4048 2620 c83c1a67a2d39dd131ba716842b83010N.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\c83c1a67a2d39dd131ba716842b83010N.exe"C:\Users\Admin\AppData\Local\Temp\c83c1a67a2d39dd131ba716842b83010N.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Windows\microsofthelp.exe"C:\Windows\microsofthelp.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4048
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
63KB
MD51f601ac3338ef1097b802d3449737151
SHA10b2c4b44776ed1294ed23efc08f67db5ed5c67b3
SHA256237907b25a42e1c2156493e64fb28b650c8d310228383da066cdf5fbc253f627
SHA5122c13747d6eea693caba4e6513062faf462d4a97716958454297dd8e10cff0802b9374283ef952a21b6b6744685d64b5f0de6175068d144dd9b8549f63c34bb2a