Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
105s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
01/09/2024, 01:58
Static task
static1
Behavioral task
behavioral1
Sample
04cb5f7d7619e932171404f322304850N.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
04cb5f7d7619e932171404f322304850N.exe
Resource
win10v2004-20240802-en
General
-
Target
04cb5f7d7619e932171404f322304850N.exe
-
Size
78KB
-
MD5
04cb5f7d7619e932171404f322304850
-
SHA1
6a9ef0e97087d8e3eec2d9dce52006b3fe0c6244
-
SHA256
a38b00b34a7d41bf1f9c5821f128dfd2fb39246d949a9b3f79ea2f6f498bdc45
-
SHA512
d186737ceb7d7c744b7b2b9da19ae939f818f1686b285ffce9992f0cfc2490d10154ada709b5f7e5ee302daeb9840e281dc1cbbdd61d85c3d30eb70307a994c2
-
SSDEEP
1536:86RAo0ej2d6rnJwwvlNlIUBvsI7hrhEh9cpDN/qhAvPHG3GvUhCHi1X5GoOvmHOL:xAo1lOwvlNlXBvsI7hrhEh9cpDN/qhAd
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1920 microsofthelp.exe -
Executes dropped EXE 1 IoCs
pid Process 1920 microsofthelp.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\microsofthelp = "C:\\Windows\\microsofthelp.exe" 04cb5f7d7619e932171404f322304850N.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\microsofthelp.exe 04cb5f7d7619e932171404f322304850N.exe File created C:\Windows\HidePlugin.dll microsofthelp.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 04cb5f7d7619e932171404f322304850N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language microsofthelp.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4540 wrote to memory of 1920 4540 04cb5f7d7619e932171404f322304850N.exe 84 PID 4540 wrote to memory of 1920 4540 04cb5f7d7619e932171404f322304850N.exe 84 PID 4540 wrote to memory of 1920 4540 04cb5f7d7619e932171404f322304850N.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\04cb5f7d7619e932171404f322304850N.exe"C:\Users\Admin\AppData\Local\Temp\04cb5f7d7619e932171404f322304850N.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\Windows\microsofthelp.exe"C:\Windows\microsofthelp.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1920
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
78KB
MD505d1125afdcc3fa6349e8701fec78e6a
SHA17a003653524ae114154c3965476018d675d6c218
SHA256288e300867b52da92168a7c67f751770615acfeebea026db2e178eb744c76f56
SHA51276858b018aac2ce4a6d934d563a43c360d6153dca75ab3d06ddb578de4fcf227e9c9afdb18de7ace56498026e691b3c80ac65e5e1b763733b3b1e50d5ae9156e