Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
97s -
max time network
104s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
01/09/2024, 13:44
Static task
static1
Behavioral task
behavioral1
Sample
c72839924b296de9d93bf0d0f0b0ae90N.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
c72839924b296de9d93bf0d0f0b0ae90N.exe
Resource
win10v2004-20240802-en
General
-
Target
c72839924b296de9d93bf0d0f0b0ae90N.exe
-
Size
68KB
-
MD5
c72839924b296de9d93bf0d0f0b0ae90
-
SHA1
4d89a886b6edd2d6d8cf0f3c9252d40fda5d4f11
-
SHA256
79a0c053eb1b1ebbf36faf5a6464a3e20ad9dd36c317212a9ff7c4ae8de08224
-
SHA512
ffab585da975174372dd537a03436b4a01abef81b1a16a5dbfc04383694859c05a75658e6cd61c734b1ad4751a744f645af5d21a76989dcdc9fc60886d23e003
-
SSDEEP
1536:Htq94hUwA6CTC7ckEtCJTmHH5jXHdQ/JoUJsV44cpU:xS6CGAkESQ5jHdQBJs
Malware Config
Signatures
-
Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run c72839924b296de9d93bf0d0f0b0ae90N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\llajyn_df = "C:\\Windows\\system\\lljyn090101.exe" c72839924b296de9d93bf0d0f0b0ae90N.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation c72839924b296de9d93bf0d0f0b0ae90N.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\system\llbjyn32bb.dll c72839924b296de9d93bf0d0f0b0ae90N.exe File created C:\Windows\system\llbjyn32bb.dll c72839924b296de9d93bf0d0f0b0ae90N.exe File created C:\Windows\system\lljyn090101.exe c72839924b296de9d93bf0d0f0b0ae90N.exe File opened for modification C:\Windows\system\lljyn090101.exe c72839924b296de9d93bf0d0f0b0ae90N.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c72839924b296de9d93bf0d0f0b0ae90N.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 1192 PING.EXE -
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Check_Associations = "no" c72839924b296de9d93bf0d0f0b0ae90N.exe Key created \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "764777082" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31128693" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "760402149" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "760402149" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31128693" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431963259" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{58EBA8FD-6868-11EF-939B-62A6B307388A} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31128693" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 1192 PING.EXE -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4932 c72839924b296de9d93bf0d0f0b0ae90N.exe 4932 c72839924b296de9d93bf0d0f0b0ae90N.exe 4932 c72839924b296de9d93bf0d0f0b0ae90N.exe 4932 c72839924b296de9d93bf0d0f0b0ae90N.exe 4932 c72839924b296de9d93bf0d0f0b0ae90N.exe 4932 c72839924b296de9d93bf0d0f0b0ae90N.exe 4932 c72839924b296de9d93bf0d0f0b0ae90N.exe 4932 c72839924b296de9d93bf0d0f0b0ae90N.exe 4932 c72839924b296de9d93bf0d0f0b0ae90N.exe 4932 c72839924b296de9d93bf0d0f0b0ae90N.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4932 c72839924b296de9d93bf0d0f0b0ae90N.exe Token: SeDebugPrivilege 4932 c72839924b296de9d93bf0d0f0b0ae90N.exe Token: SeDebugPrivilege 4932 c72839924b296de9d93bf0d0f0b0ae90N.exe Token: SeDebugPrivilege 4932 c72839924b296de9d93bf0d0f0b0ae90N.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 5104 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 5104 iexplore.exe 5104 iexplore.exe 1660 IEXPLORE.EXE 1660 IEXPLORE.EXE 1660 IEXPLORE.EXE 1660 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 4932 wrote to memory of 5104 4932 c72839924b296de9d93bf0d0f0b0ae90N.exe 95 PID 4932 wrote to memory of 5104 4932 c72839924b296de9d93bf0d0f0b0ae90N.exe 95 PID 5104 wrote to memory of 1660 5104 iexplore.exe 96 PID 5104 wrote to memory of 1660 5104 iexplore.exe 96 PID 5104 wrote to memory of 1660 5104 iexplore.exe 96 PID 4932 wrote to memory of 5104 4932 c72839924b296de9d93bf0d0f0b0ae90N.exe 95 PID 4932 wrote to memory of 1260 4932 c72839924b296de9d93bf0d0f0b0ae90N.exe 97 PID 4932 wrote to memory of 1260 4932 c72839924b296de9d93bf0d0f0b0ae90N.exe 97 PID 4932 wrote to memory of 1260 4932 c72839924b296de9d93bf0d0f0b0ae90N.exe 97 PID 1260 wrote to memory of 1192 1260 cmd.exe 99 PID 1260 wrote to memory of 1192 1260 cmd.exe 99 PID 1260 wrote to memory of 1192 1260 cmd.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\c72839924b296de9d93bf0d0f0b0ae90N.exe"C:\Users\Admin\AppData\Local\Temp\c72839924b296de9d93bf0d0f0b0ae90N.exe"1⤵
- Adds policy Run key to start application
- Checks computer location settings
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\program files\internet explorer\iexplore.exe"C:\program files\internet explorer\iexplore.exe"2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5104 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1660
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\dfDelmlljy.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1260 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:1192
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
85B
MD59fce7039e13215513a7fa2bf693bd6f3
SHA11188012bf423dc1730f1dfe8fa7c613967a14305
SHA256929674867dff75548664ef62a39d27d38522ecb1bae8d4fc2b3c2ea9333e2d85
SHA512cfeb816ebdb625f30a14147cc2aacc8e43a2f429e61fd7600b2ffba508d43a6578f6e83479df179c5bdfea636f6dc944a13433f6a23538783274449c4b23a9ca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize471B
MD51c7226fea3dc2059287a4a2ae7519102
SHA1ddf68a29afc928251f9743341d5fe0be207479ad
SHA256ccaab5444ee41ed3c94268a55693fe4157f72e980d2dc3687ac98bab1a265396
SHA512b646d2a7d9d8fbc5846f8ecc8a69e7913c603cbad1a488f24b75a0e371e3e367c596dc3fbae2ebbfb486e17b5f248ee4c47d34c6b5e7cdd7cc387d184e8366e1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize404B
MD547f5c1ba0327c834e872e2ff91e63811
SHA1bbf707c4528fd6fbb420243c9d4aedd61ecd90e4
SHA25696a0a23f7b7c1155d3d41a320c353a1fb0c9a2463cd58f3042a0a5372ea7225b
SHA512464b3d07bf6250b19daf9da9178c85c937ef3ebf49510e4c3713581dd2e169ab6a67c2ea7341e1c88874060bd7babafa7fd98938856f40fb77a6b8b12f8b32ee
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
Filesize
207B
MD522187c81105b43ae78940848cea05cb4
SHA1ac62d6e506a7353881bc9cf827895d93ac987d38
SHA25673b0158ee44a774981a7fe2d30f89adb0d590126dadb95c0e6bbad9a1cb02a04
SHA512b00d1d924314b49e1c3d3d37f28cc3f82583afebc55d546d549b58486bf9ec9ffd15d0f0fc970643989215a069a0965bb8702c04468e8991015c11dbb6a12377