Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
135s -
max time network
109s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
29/08/2024, 08:08
Static task
static1
Behavioral task
behavioral1
Sample
f9ba6ee1f2c3b75871a97d6575d1aef83f996011ab227cfa34736d115dc1afe0.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
f9ba6ee1f2c3b75871a97d6575d1aef83f996011ab227cfa34736d115dc1afe0.exe
Resource
win10v2004-20240802-en
General
-
Target
f9ba6ee1f2c3b75871a97d6575d1aef83f996011ab227cfa34736d115dc1afe0.exe
-
Size
2.7MB
-
MD5
18f55e522b006a33ed823148b686a45b
-
SHA1
69d266fbc587d9384ab3c1a0145eec48528e91af
-
SHA256
f9ba6ee1f2c3b75871a97d6575d1aef83f996011ab227cfa34736d115dc1afe0
-
SHA512
0943d53038478dcc24508bfbde4341592ad6c19b7881fec988cf938694f14dd56b66de5aad7100ebaa4dd019ed3178dcf6ab968102e00ef538f935cfff3b2102
-
SSDEEP
49152:LWbPw9BM+0rYYgYYqW6Z4ivofcH2o5dqJKgUIbU4+a5sTW11qthC9BuT8gzpNVaW:mPwY+oWM4ilH2o5dqJKgUIbU4+a5sHCc
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation f9ba6ee1f2c3b75871a97d6575d1aef83f996011ab227cfa34736d115dc1afe0.exe -
Executes dropped EXE 2 IoCs
pid Process 4132 bnrbpwhgst.exe 3108 bnrbpwhgst.tmp -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 10 IoCs
description ioc Process File created C:\Program Files (x86)\MYPGNotes\is-4E50S.tmp bnrbpwhgst.tmp File created C:\Program Files (x86)\MYPGNotes\is-6QNRI.tmp bnrbpwhgst.tmp File created C:\Program Files (x86)\MYPGNotes\is-393LR.tmp bnrbpwhgst.tmp File opened for modification C:\Program Files (x86)\MYPGNotes\unins000.dat bnrbpwhgst.tmp File opened for modification C:\Program Files (x86)\MYPGNotes\AppleNote.exe bnrbpwhgst.tmp File created C:\Program Files (x86)\MYPGNotes\unins000.dat bnrbpwhgst.tmp File created C:\Program Files (x86)\MYPGNotes\is-KUA60.tmp bnrbpwhgst.tmp File created C:\Program Files (x86)\MYPGNotes\is-08T67.tmp bnrbpwhgst.tmp File opened for modification C:\Program Files (x86)\MYPGNotes\Qt5Concurrent.dll bnrbpwhgst.tmp File created C:\Program Files (x86)\MYPGNotes\is-RTKBL.tmp bnrbpwhgst.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f9ba6ee1f2c3b75871a97d6575d1aef83f996011ab227cfa34736d115dc1afe0.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnrbpwhgst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnrbpwhgst.tmp -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3688 f9ba6ee1f2c3b75871a97d6575d1aef83f996011ab227cfa34736d115dc1afe0.exe 3688 f9ba6ee1f2c3b75871a97d6575d1aef83f996011ab227cfa34736d115dc1afe0.exe 3688 f9ba6ee1f2c3b75871a97d6575d1aef83f996011ab227cfa34736d115dc1afe0.exe 3688 f9ba6ee1f2c3b75871a97d6575d1aef83f996011ab227cfa34736d115dc1afe0.exe 3108 bnrbpwhgst.tmp 3108 bnrbpwhgst.tmp -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3108 bnrbpwhgst.tmp -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 3688 wrote to memory of 4576 3688 f9ba6ee1f2c3b75871a97d6575d1aef83f996011ab227cfa34736d115dc1afe0.exe 84 PID 3688 wrote to memory of 4576 3688 f9ba6ee1f2c3b75871a97d6575d1aef83f996011ab227cfa34736d115dc1afe0.exe 84 PID 3688 wrote to memory of 4576 3688 f9ba6ee1f2c3b75871a97d6575d1aef83f996011ab227cfa34736d115dc1afe0.exe 84 PID 4576 wrote to memory of 4132 4576 cmd.exe 86 PID 4576 wrote to memory of 4132 4576 cmd.exe 86 PID 4576 wrote to memory of 4132 4576 cmd.exe 86 PID 4132 wrote to memory of 3108 4132 bnrbpwhgst.exe 88 PID 4132 wrote to memory of 3108 4132 bnrbpwhgst.exe 88 PID 4132 wrote to memory of 3108 4132 bnrbpwhgst.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\f9ba6ee1f2c3b75871a97d6575d1aef83f996011ab227cfa34736d115dc1afe0.exe"C:\Users\Admin\AppData\Local\Temp\f9ba6ee1f2c3b75871a97d6575d1aef83f996011ab227cfa34736d115dc1afe0.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3688 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\bnrbpwhgst.exe" /VERYSILENT2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\bnrbpwhgst.exe"C:\Users\Admin\AppData\Local\Temp\bnrbpwhgst.exe" /VERYSILENT3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4132 -
C:\Users\Admin\AppData\Local\Temp\is-B00UR.tmp\bnrbpwhgst.tmp"C:\Users\Admin\AppData\Local\Temp\is-B00UR.tmp\bnrbpwhgst.tmp" /SL5="$801E2,232785,54272,C:\Users\Admin\AppData\Local\Temp\bnrbpwhgst.exe" /VERYSILENT4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:3108
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
526KB
MD59beea33ea128fd25ad509ae7ff7bcff3
SHA13a87a124b47d68bf8eb1d1a4f9695fb2b2a52660
SHA256e0634bc21490c472b233aaec047438feae557f0d57ea5b78b3b48260916e2b4e
SHA512292996177bbb804ea3f6ad51fdb74707f1a1a35d50d8ae7b082d88cbb476bae1a883133c9e1dc4cefce78bc71f8d65276e5cdaeeef03088bc54beb41269dc5b3
-
Filesize
900KB
MD5f8b110dc2063d3b29502aa7042d26122
SHA11a0fd3db79eadc1ce714f6267d476ddbec0f5e79
SHA256e8730b0bf8f94cbb8babbfefb32cef8e8d19ec823f28c33a7d48c78589710762
SHA512f3125d3f575aff68105ebb3eadbce30547d34e12237d8ebbc555c6fe12bcc0a5ea85a38e26f2900d70af70ec07efde3b8cd65dc0fdada637496531245ea5052f