Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
110s -
max time network
107s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
23/08/2024, 19:06
Static task
static1
Behavioral task
behavioral1
Sample
9713e4828cb213187616e0fb93bdb330N.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
9713e4828cb213187616e0fb93bdb330N.exe
Resource
win10v2004-20240802-en
General
-
Target
9713e4828cb213187616e0fb93bdb330N.exe
-
Size
350KB
-
MD5
9713e4828cb213187616e0fb93bdb330
-
SHA1
2b1fc1a98e398cac76bfc236f9500870e2c4a353
-
SHA256
2cb254bd89b6683fe71587ecaeb53c517cb0cf9e630ee0366a338e5dc587c841
-
SHA512
d8651f1714b0e498b15cd5fcead4845e0eb45a0adc3563190d74861a91e0bdd7e22eb045abbc7bf599d5b5f95150e8109190dce8ce3e09fcbe60e449067440f1
-
SSDEEP
6144:AyH7xOc6H5c6HcT66vlmWTBHvnrSxHqHGTP+9IevMP41vAOhkqvcXq2ka3CUbpf1:AazBHvrSxHqHSehv2ka3Copfu0CXNmLz
Malware Config
Signatures
-
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE 3 IoCs
pid Process 4824 svchost.exe 5032 9713e4828cb213187616e0fb93bdb330N.exe 4468 svchost.exe -
Drops file in Program Files directory 38 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\7zG.exe svchost.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe svchost.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE svchost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe svchost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe svchost.exe File opened for modification C:\Program Files\7-Zip\7z.exe svchost.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe svchost.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe svchost.exe File opened for modification C:\Program Files\dotnet\dotnet.exe svchost.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\createdump.exe svchost.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\notification_helper.exe svchost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe svchost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe svchost.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe svchost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe svchost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe svchost.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe svchost.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe svchost.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe svchost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe svchost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe svchost.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe svchost.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE svchost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe svchost.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe svchost.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe svchost.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe svchost.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe svchost.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_pwa_launcher.exe svchost.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe svchost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe svchost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe svchost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe svchost.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe svchost.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe svchost.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe svchost.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe svchost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe svchost.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\svchost.exe 9713e4828cb213187616e0fb93bdb330N.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9713e4828cb213187616e0fb93bdb330N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9713e4828cb213187616e0fb93bdb330N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Modifies registry class 12 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\WOW6432Node 9713e4828cb213187616e0fb93bdb330N.exe Key created \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\WOW6432Node\CLSID 9713e4828cb213187616e0fb93bdb330N.exe Key created \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\WOW6432Node\CLSID\{24570356-0800-0000-0000-000000000000} 9713e4828cb213187616e0fb93bdb330N.exe Set value (str) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\WOW6432Node\CLSID\{24570356-0800-0000-0000-000000000000}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\9713e4828cb213187616e0fb93bdb330N.exe\" -ToastActivated" 9713e4828cb213187616e0fb93bdb330N.exe Key created \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\AppUserModelId\ASUS.FastChargeNotification 9713e4828cb213187616e0fb93bdb330N.exe Set value (str) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\AppUserModelId\ASUS.FastChargeNotification\CustomActivator = "{24570356-0800-0000-0000-000000000000}" 9713e4828cb213187616e0fb93bdb330N.exe Key created \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\WOW6432Node\CLSID\{24570356-0800-0000-0000-000000000000}\LocalServer32 9713e4828cb213187616e0fb93bdb330N.exe Key created \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\AppUserModelId 9713e4828cb213187616e0fb93bdb330N.exe Set value (str) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\AppUserModelId\ASUS.FastChargeNotification\DisplayName = "ASUS Fast Charge Notification" 9713e4828cb213187616e0fb93bdb330N.exe Set value (str) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\AppUserModelId\ASUS.FastChargeNotification\IconUri = "C:\\Users\\Admin\\AppData\\Local\\Temp\\notification_icon.png" 9713e4828cb213187616e0fb93bdb330N.exe Set value (str) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\AppUserModelId\ASUS.FastChargeNotification\IconBackgroundColor = "C:\\Users\\Admin\\AppData\\Local\\Temp\\notification_icon.png" 9713e4828cb213187616e0fb93bdb330N.exe Key deleted \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\AppUserModelId\ASUS.FastChargeNotification 9713e4828cb213187616e0fb93bdb330N.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 3396 wrote to memory of 4824 3396 9713e4828cb213187616e0fb93bdb330N.exe 84 PID 3396 wrote to memory of 4824 3396 9713e4828cb213187616e0fb93bdb330N.exe 84 PID 3396 wrote to memory of 4824 3396 9713e4828cb213187616e0fb93bdb330N.exe 84 PID 4824 wrote to memory of 5032 4824 svchost.exe 85 PID 4824 wrote to memory of 5032 4824 svchost.exe 85 PID 4824 wrote to memory of 5032 4824 svchost.exe 85 PID 5032 wrote to memory of 5072 5032 9713e4828cb213187616e0fb93bdb330N.exe 87 PID 5032 wrote to memory of 5072 5032 9713e4828cb213187616e0fb93bdb330N.exe 87 PID 5032 wrote to memory of 5072 5032 9713e4828cb213187616e0fb93bdb330N.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\9713e4828cb213187616e0fb93bdb330N.exe"C:\Users\Admin\AppData\Local\Temp\9713e4828cb213187616e0fb93bdb330N.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3396 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe" "C:\Users\Admin\AppData\Local\Temp\9713e4828cb213187616e0fb93bdb330N.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\Users\Admin\AppData\Local\Temp\9713e4828cb213187616e0fb93bdb330N.exe"C:\Users\Admin\AppData\Local\Temp\9713e4828cb213187616e0fb93bdb330N.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\windows\SysWOW64\cmd.exe"C:\windows\system32\cmd.exe"4⤵
- System Location Discovery: System Language Discovery
PID:5072
-
-
-
-
C:\Windows\svchost.exeC:\Windows\svchost.exe1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4468
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
315KB
MD577c5490cd07ee15b93c51edefdc1a4b3
SHA178079600de813e76af2d09762abaae03169bdd92
SHA25664a88ebd8bbddf00eaf035e1ceb7f76d5f5315e8af263f1fef61e30ffd6e5ab5
SHA5123513aed4b2b3b5957c7c7711a76aa5e50edaa744d9326ce037ce5ba3e9308abd21b09e1167c102ac888bd1c759a5a8800c014d50cc2b429b98e0096c2840b8e3
-
Filesize
35KB
MD59e3c13b6556d5636b745d3e466d47467
SHA12ac1c19e268c49bc508f83fe3d20f495deb3e538
SHA25620af03add533a6870d524a7c4753b42bfceb56cddd46016c051e23581ba743f8
SHA5125a07ba8a7fcb15f64b129fada2621252b8bc37eb34d4f614c075c064f8ac0d367301eba0c32c5e28b8aa633f6ab604f0dfcc363b34734ce0207ef0d4e8817c4b