Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
29/08/2024, 00:11
Static task
static1
Behavioral task
behavioral1
Sample
b30c6f131fccd02d6b75a7a6dcdbba60fbcbb8af3efec5d3765da6d6714ed68b.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
b30c6f131fccd02d6b75a7a6dcdbba60fbcbb8af3efec5d3765da6d6714ed68b.exe
Resource
win10v2004-20240802-en
General
-
Target
b30c6f131fccd02d6b75a7a6dcdbba60fbcbb8af3efec5d3765da6d6714ed68b.exe
-
Size
1.1MB
-
MD5
dea323fdfa8ced4e017ab4b97f71808d
-
SHA1
f010c27b75cb3531fc81881e03bc008e0d0bd20f
-
SHA256
b30c6f131fccd02d6b75a7a6dcdbba60fbcbb8af3efec5d3765da6d6714ed68b
-
SHA512
3137360ead4a7eec174273c31a4a6ac414554166e0b5630060d0f81b89b165c3922acc7712cbc31dc0629464761e11dfd273abbbb47e038c9fae2e6ff8098523
-
SSDEEP
24576:CH0dl8myX9Bg42QoXFkrzkmmlSgRDko0lG4Z8r7Qfbkiu5QL:CcaClSFlG4ZM7QzMc
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation b30c6f131fccd02d6b75a7a6dcdbba60fbcbb8af3efec5d3765da6d6714ed68b.exe -
Deletes itself 1 IoCs
pid Process 416 svchcst.exe -
Executes dropped EXE 2 IoCs
pid Process 3468 svchcst.exe 416 svchcst.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b30c6f131fccd02d6b75a7a6dcdbba60fbcbb8af3efec5d3765da6d6714ed68b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchcst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchcst.exe -
Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings b30c6f131fccd02d6b75a7a6dcdbba60fbcbb8af3efec5d3765da6d6714ed68b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ WScript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ WScript.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4920 b30c6f131fccd02d6b75a7a6dcdbba60fbcbb8af3efec5d3765da6d6714ed68b.exe 4920 b30c6f131fccd02d6b75a7a6dcdbba60fbcbb8af3efec5d3765da6d6714ed68b.exe 4920 b30c6f131fccd02d6b75a7a6dcdbba60fbcbb8af3efec5d3765da6d6714ed68b.exe 4920 b30c6f131fccd02d6b75a7a6dcdbba60fbcbb8af3efec5d3765da6d6714ed68b.exe 416 svchcst.exe 416 svchcst.exe 416 svchcst.exe 416 svchcst.exe 416 svchcst.exe 416 svchcst.exe 416 svchcst.exe 416 svchcst.exe 416 svchcst.exe 416 svchcst.exe 416 svchcst.exe 416 svchcst.exe 416 svchcst.exe 416 svchcst.exe 416 svchcst.exe 416 svchcst.exe 416 svchcst.exe 416 svchcst.exe 416 svchcst.exe 416 svchcst.exe 416 svchcst.exe 416 svchcst.exe 416 svchcst.exe 416 svchcst.exe 416 svchcst.exe 416 svchcst.exe 416 svchcst.exe 416 svchcst.exe 416 svchcst.exe 416 svchcst.exe 416 svchcst.exe 416 svchcst.exe 416 svchcst.exe 416 svchcst.exe 416 svchcst.exe 416 svchcst.exe 416 svchcst.exe 416 svchcst.exe 416 svchcst.exe 416 svchcst.exe 416 svchcst.exe 416 svchcst.exe 416 svchcst.exe 416 svchcst.exe 416 svchcst.exe 416 svchcst.exe 416 svchcst.exe 416 svchcst.exe 416 svchcst.exe 416 svchcst.exe 416 svchcst.exe 416 svchcst.exe 416 svchcst.exe 416 svchcst.exe 416 svchcst.exe 416 svchcst.exe 416 svchcst.exe 416 svchcst.exe 416 svchcst.exe 416 svchcst.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 4920 b30c6f131fccd02d6b75a7a6dcdbba60fbcbb8af3efec5d3765da6d6714ed68b.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 4920 b30c6f131fccd02d6b75a7a6dcdbba60fbcbb8af3efec5d3765da6d6714ed68b.exe 4920 b30c6f131fccd02d6b75a7a6dcdbba60fbcbb8af3efec5d3765da6d6714ed68b.exe 416 svchcst.exe 416 svchcst.exe 3468 svchcst.exe 3468 svchcst.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 4920 wrote to memory of 4676 4920 b30c6f131fccd02d6b75a7a6dcdbba60fbcbb8af3efec5d3765da6d6714ed68b.exe 95 PID 4920 wrote to memory of 4676 4920 b30c6f131fccd02d6b75a7a6dcdbba60fbcbb8af3efec5d3765da6d6714ed68b.exe 95 PID 4920 wrote to memory of 4676 4920 b30c6f131fccd02d6b75a7a6dcdbba60fbcbb8af3efec5d3765da6d6714ed68b.exe 95 PID 4920 wrote to memory of 4640 4920 b30c6f131fccd02d6b75a7a6dcdbba60fbcbb8af3efec5d3765da6d6714ed68b.exe 96 PID 4920 wrote to memory of 4640 4920 b30c6f131fccd02d6b75a7a6dcdbba60fbcbb8af3efec5d3765da6d6714ed68b.exe 96 PID 4920 wrote to memory of 4640 4920 b30c6f131fccd02d6b75a7a6dcdbba60fbcbb8af3efec5d3765da6d6714ed68b.exe 96 PID 4640 wrote to memory of 3468 4640 WScript.exe 103 PID 4640 wrote to memory of 3468 4640 WScript.exe 103 PID 4640 wrote to memory of 3468 4640 WScript.exe 103 PID 4676 wrote to memory of 416 4676 WScript.exe 104 PID 4676 wrote to memory of 416 4676 WScript.exe 104 PID 4676 wrote to memory of 416 4676 WScript.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\b30c6f131fccd02d6b75a7a6dcdbba60fbcbb8af3efec5d3765da6d6714ed68b.exe"C:\Users\Admin\AppData\Local\Temp\b30c6f131fccd02d6b75a7a6dcdbba60fbcbb8af3efec5d3765da6d6714ed68b.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"3⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:416
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3468
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4172,i,8548254608087149642,10333768245962368401,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:81⤵PID:3996
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
753B
MD5a1f2105987210f84ad461e613ea45bb0
SHA1122e800ff2d02f1afa4927aefef30e07a003e159
SHA2563d9774a313a7220ecc5a0ad35372797c48e18476a2abfa6c60c32f7d5ef41bb9
SHA51217652d76b2256d4523d0096b7c831245d6b538748b95a324dd12e2998ab9c305425221ee5105b126c8ee8d7601e22b6720c53fa495d4a21e60ccfce9d4bf9281
-
Filesize
1.1MB
MD5204ac1aae2164bc8559ed0ea7077b7e0
SHA17b5de25de569ec5a360c558df206889c0cc2d47b
SHA256a3191654877a423d4ac099ed2a4c0bb6aacef843c4d1e94a4b9c82b8899fa903
SHA512a711e05be9ae9e69405a9e25d3ab9ac81632bb117ecb232862ffe82956985245173099eb02398d784a7e278f79b544f46fc3e710712544fe44d77a57f2dd095c