Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
28/08/2024, 19:23
Static task
static1
Behavioral task
behavioral1
Sample
182fa8751291fab0c72a7634e8c7456410a3a4ac6dbbd17ffe6af30d4d52124c.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
182fa8751291fab0c72a7634e8c7456410a3a4ac6dbbd17ffe6af30d4d52124c.exe
Resource
win10v2004-20240802-en
General
-
Target
182fa8751291fab0c72a7634e8c7456410a3a4ac6dbbd17ffe6af30d4d52124c.exe
-
Size
576KB
-
MD5
8c76b929ddab15068a9ac089fded0f81
-
SHA1
b222afc7e6c4473a624d140d6b6f7abacb4713a7
-
SHA256
182fa8751291fab0c72a7634e8c7456410a3a4ac6dbbd17ffe6af30d4d52124c
-
SHA512
9c3c240f275be257b8f5fddf173f9ee562b3a41c75ff499d84623eb78bb08bbc4de06744cd267eb371a5a7c939e0902522deca8d85c9c5d63c3cd5f8609d5ec9
-
SSDEEP
12288:sYIW0p98Oh8P7h8IGLbPC3YaBeZmj/Kvo/u:gW298E8u/LbKIiUmj/Kvo/u
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation 8879.tmp -
Executes dropped EXE 1 IoCs
pid Process 4512 8879.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 182fa8751291fab0c72a7634e8c7456410a3a4ac6dbbd17ffe6af30d4d52124c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8879.tmp -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 4512 8879.tmp -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings 8879.tmp -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 4056 WINWORD.EXE 4056 WINWORD.EXE -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 4512 8879.tmp -
Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 4056 WINWORD.EXE 4056 WINWORD.EXE 4056 WINWORD.EXE 4056 WINWORD.EXE 4056 WINWORD.EXE 4056 WINWORD.EXE 4056 WINWORD.EXE 4056 WINWORD.EXE 4056 WINWORD.EXE 4056 WINWORD.EXE -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 2776 wrote to memory of 4512 2776 182fa8751291fab0c72a7634e8c7456410a3a4ac6dbbd17ffe6af30d4d52124c.exe 84 PID 2776 wrote to memory of 4512 2776 182fa8751291fab0c72a7634e8c7456410a3a4ac6dbbd17ffe6af30d4d52124c.exe 84 PID 2776 wrote to memory of 4512 2776 182fa8751291fab0c72a7634e8c7456410a3a4ac6dbbd17ffe6af30d4d52124c.exe 84 PID 4512 wrote to memory of 4056 4512 8879.tmp 88 PID 4512 wrote to memory of 4056 4512 8879.tmp 88 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\182fa8751291fab0c72a7634e8c7456410a3a4ac6dbbd17ffe6af30d4d52124c.exe"C:\Users\Admin\AppData\Local\Temp\182fa8751291fab0c72a7634e8c7456410a3a4ac6dbbd17ffe6af30d4d52124c.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\8879.tmp"C:\Users\Admin\AppData\Local\Temp\8879.tmp" --pingC:\Users\Admin\AppData\Local\Temp\182fa8751291fab0c72a7634e8c7456410a3a4ac6dbbd17ffe6af30d4d52124c.exe DB29F3A9F6175E92EC665EE0EB80234AFA067A337153991953220143AAE22404A0072BC0002763F1AB939F2A1677215C265064ABC7C65FAAFE88C8F9D6A8DCFF2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Modifies registry class
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\182fa8751291fab0c72a7634e8c7456410a3a4ac6dbbd17ffe6af30d4d52124c.docx" /o ""3⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4056
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\182fa8751291fab0c72a7634e8c7456410a3a4ac6dbbd17ffe6af30d4d52124c.docx
Filesize21KB
MD57079891932a64f097abafd233055a1e9
SHA1246d95feafe67689d49a5a4cadba18d3ac1914e5
SHA256c97189b50e5e92be09966d4732b6d61a2e435b2935d60c09989e555ae442e7a1
SHA5126e9ee6427d7cc2474dc634b088cf3f35d06dfb734d2b63fbbc794f4083b4b5754379daff4804bf5024b1b430aa5e50fa6d839d3473ceeed3043d373c85e9862a
-
Filesize
576KB
MD598dae15e54abd3ada415cfae87c76a36
SHA1096eea8475f852117dae18cc3064c55f5ddd899e
SHA256cb8a82e1c1f782b14d1bfb42d614dd84e5f281415b0e2bf7ef9c59555182f049
SHA512fda639f98a1cfc68ce50efc9e9df736e9dd1b7fcc7adcc39a111d66aeacc57b1bb40c3fedf4faa9f85dbfadd0c27b70333af920828a350f515885f17837c0e65