Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
105s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
23/08/2024, 16:57
Static task
static1
Behavioral task
behavioral1
Sample
990068d6ecf89555129d82e0953d88c0N.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
990068d6ecf89555129d82e0953d88c0N.exe
Resource
win10v2004-20240802-en
General
-
Target
990068d6ecf89555129d82e0953d88c0N.exe
-
Size
37KB
-
MD5
990068d6ecf89555129d82e0953d88c0
-
SHA1
9b1e9b93c1d4fad939b239a22b6d638ac6073f33
-
SHA256
edafcf46b28b7bf2c6dc0ae85c460d120c670a7a50447ea5b5c1400c24cae63f
-
SHA512
9b39e3a7b11335d5f4ee318e894d75acb036453364f78d281ed20e4e9a1fc04da99c48bb3ad00020a2f3a96c80e4be6a58216c0c32cb7a746277ce729f39cc36
-
SSDEEP
768:ePyFZFASe0Ep0EpHZplRpqpd6rqxn4p6vghzwYu7vih9GueIh9j2IoHAcBHUIFvg:e6q10k0EFjed6rqJ+6vghzwYu7vih9Gq
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 4856 microsofthelp.exe -
Executes dropped EXE 1 IoCs
pid Process 4856 microsofthelp.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\microsofthelp = "C:\\Windows\\microsofthelp.exe" 990068d6ecf89555129d82e0953d88c0N.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\microsofthelp.exe 990068d6ecf89555129d82e0953d88c0N.exe File created C:\Windows\HidePlugin.dll microsofthelp.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 990068d6ecf89555129d82e0953d88c0N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language microsofthelp.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 5052 wrote to memory of 4856 5052 990068d6ecf89555129d82e0953d88c0N.exe 84 PID 5052 wrote to memory of 4856 5052 990068d6ecf89555129d82e0953d88c0N.exe 84 PID 5052 wrote to memory of 4856 5052 990068d6ecf89555129d82e0953d88c0N.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\990068d6ecf89555129d82e0953d88c0N.exe"C:\Users\Admin\AppData\Local\Temp\990068d6ecf89555129d82e0953d88c0N.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Windows\microsofthelp.exe"C:\Windows\microsofthelp.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4856
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
38KB
MD59bfee2792570584a31edb1f1c51d5dea
SHA1975fc46cc663bb9cd04e4aae424373438b6679db
SHA256127d8933850cf82728efca001686130045a0fcc63ccb866e65cd641974034a49
SHA5124a3d5d44f8d9af8c0695180489074a0c6d059d490ea2cab213000b632edb429e775e988d87b803fac51815739d29e6d380eff9a0ee421c64cfb9c11413605f3e