Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
01/09/2024, 11:33
Static task
static1
Behavioral task
behavioral1
Sample
356f56cabcc406f1600831cbd209f3b177037986443a6e3681a54f1b6b25ce61.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
356f56cabcc406f1600831cbd209f3b177037986443a6e3681a54f1b6b25ce61.exe
Resource
win10v2004-20240802-en
General
-
Target
356f56cabcc406f1600831cbd209f3b177037986443a6e3681a54f1b6b25ce61.exe
-
Size
2.7MB
-
MD5
15fbc3057d25e308e0832ad1a7d62e26
-
SHA1
c90180b2360b4f12a32630f007b3e560d06be558
-
SHA256
356f56cabcc406f1600831cbd209f3b177037986443a6e3681a54f1b6b25ce61
-
SHA512
9ce05267bfdfdaa8f20670b885530aac0c7a13cfe01f8b15b5624318f5948462b6cdd7bc523b3fda3ed06ddaacc81d85a99d36af4f6b711d396f03018204f14a
-
SSDEEP
49152:g7XlYr35b3BZENDqOwwKUv9sZ76Sq+m0Zaupr7/EDXhFlD:4Xl839jEYOwPg+KsEbhP
Malware Config
Signatures
-
Modifies Windows Firewall 2 TTPs 2 IoCs
pid Process 848 netsh.exe 896 netsh.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation 356f56cabcc406f1600831cbd209f3b177037986443a6e3681a54f1b6b25ce61.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\356f56cabcc406f1600831cbd209f3b177037986443a6e3681a54f1b6b25ce61.lnk 356f56cabcc406f1600831cbd209f3b177037986443a6e3681a54f1b6b25ce61.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\356f56cabcc406f1600831cbd209f3b177037986443a6e3681a54f1b6b25ce61 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\356f56cabcc406f1600831cbd209f3b177037986443a6e3681a54f1b6b25ce61.exe\"" 356f56cabcc406f1600831cbd209f3b177037986443a6e3681a54f1b6b25ce61.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\356f56cabcc406f1600831cbd209f3b177037986443a6e3681a54f1b6b25ce61 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\356f56cabcc406f1600831cbd209f3b177037986443a6e3681a54f1b6b25ce61.exe\"" 356f56cabcc406f1600831cbd209f3b177037986443a6e3681a54f1b6b25ce61.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
flow ioc 18 6.tcp.ngrok.io 72 6.tcp.ngrok.io 103 6.tcp.ngrok.io -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2236 schtasks.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1280 wrote to memory of 848 1280 356f56cabcc406f1600831cbd209f3b177037986443a6e3681a54f1b6b25ce61.exe 84 PID 1280 wrote to memory of 848 1280 356f56cabcc406f1600831cbd209f3b177037986443a6e3681a54f1b6b25ce61.exe 84 PID 1280 wrote to memory of 896 1280 356f56cabcc406f1600831cbd209f3b177037986443a6e3681a54f1b6b25ce61.exe 89 PID 1280 wrote to memory of 896 1280 356f56cabcc406f1600831cbd209f3b177037986443a6e3681a54f1b6b25ce61.exe 89 PID 1280 wrote to memory of 2236 1280 356f56cabcc406f1600831cbd209f3b177037986443a6e3681a54f1b6b25ce61.exe 91 PID 1280 wrote to memory of 2236 1280 356f56cabcc406f1600831cbd209f3b177037986443a6e3681a54f1b6b25ce61.exe 91 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\356f56cabcc406f1600831cbd209f3b177037986443a6e3681a54f1b6b25ce61.exe"C:\Users\Admin\AppData\Local\Temp\356f56cabcc406f1600831cbd209f3b177037986443a6e3681a54f1b6b25ce61.exe"1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Windows\SYSTEM32\netsh.exenetsh firewall add allowedprogram"C:\Users\Admin\AppData\Local\Temp\356f56cabcc406f1600831cbd209f3b177037986443a6e3681a54f1b6b25ce61.exe" "356f56cabcc406f1600831cbd209f3b177037986443a6e3681a54f1b6b25ce61" ENABLE2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:848
-
-
C:\Windows\SYSTEM32\netsh.exenetsh firewall add allowedprogram"C:\Users\Admin\AppData\Local\Temp\356f56cabcc406f1600831cbd209f3b177037986443a6e3681a54f1b6b25ce61.exe" "356f56cabcc406f1600831cbd209f3b177037986443a6e3681a54f1b6b25ce61" ENABLE2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:896
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "356f56cabcc406f1600831cbd209f3b177037986443a6e3681a54f1b6b25ce61" /tr "C:\Users\Admin\AppData\Local\Temp\356f56cabcc406f1600831cbd209f3b177037986443a6e3681a54f1b6b25ce61.exe"2⤵
- Scheduled Task/Job: Scheduled Task
PID:2236
-
-
C:\Users\Admin\AppData\Local\Temp\356f56cabcc406f1600831cbd209f3b177037986443a6e3681a54f1b6b25ce61.exeC:\Users\Admin\AppData\Local\Temp\356f56cabcc406f1600831cbd209f3b177037986443a6e3681a54f1b6b25ce61.exe1⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\356f56cabcc406f1600831cbd209f3b177037986443a6e3681a54f1b6b25ce61.exeC:\Users\Admin\AppData\Local\Temp\356f56cabcc406f1600831cbd209f3b177037986443a6e3681a54f1b6b25ce61.exe1⤵PID:4776
-
C:\Users\Admin\AppData\Local\Temp\356f56cabcc406f1600831cbd209f3b177037986443a6e3681a54f1b6b25ce61.exeC:\Users\Admin\AppData\Local\Temp\356f56cabcc406f1600831cbd209f3b177037986443a6e3681a54f1b6b25ce61.exe1⤵PID:4464
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\356f56cabcc406f1600831cbd209f3b177037986443a6e3681a54f1b6b25ce61.exe.log
Filesize1KB
MD5a8a147915e3a996fdbe10b3a3f1e1bb2
SHA1abc564c1be468d57e700913e7b6cf8f62d421263
SHA2568b96a8557deea66696837af011843d6a82451ba57c8f9b5a2726a70818d6fc7e
SHA51217b42f17ef60a9f625703172763f692e5ed2ca93564a97853dfa72bb0ac6305ef3267aea0b205938e3aa8eac10156d9d4f322b30d0329d92d647bcec6372731c