Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
109s -
max time network
110s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
04/09/2024, 00:38 UTC
Static task
static1
Behavioral task
behavioral1
Sample
2c4180a225d071508ac5656717a9cb30N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2c4180a225d071508ac5656717a9cb30N.exe
Resource
win10v2004-20240802-en
General
-
Target
2c4180a225d071508ac5656717a9cb30N.exe
-
Size
4.1MB
-
MD5
2c4180a225d071508ac5656717a9cb30
-
SHA1
d194c4ccbdaee11c4bae4f23b6214a9fe0b40815
-
SHA256
2bc671285340102bb3c1b4d1249786a651ee5ca7a13ee9f6b62daf7e7bea7f3d
-
SHA512
cbda49d38c9daa0f0a74e7ff60cb14de346d8b428ab6ce432011f957a9c4d913c6b2610b9a7e38ac7dbfe6e098b3c760fee1cb928c9d5d68e6811c1338e0b24a
-
SSDEEP
98304:0w2CYJJBGb5A9dGpQkiSNEVA0qss9du/akQrBB:fw0ASCcIm9du/MrB
Malware Config
Signatures
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 2c4180a225d071508ac5656717a9cb30N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2c4180a225d071508ac5656717a9cb30N.exe -
Modifies registry class 11 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0} 2c4180a225d071508ac5656717a9cb30N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}\idex = "327babbaa383426f214b7738e81a72f0" 2c4180a225d071508ac5656717a9cb30N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}\idno = "1" 2c4180a225d071508ac5656717a9cb30N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79B5BC47-CEA1-4772-B433-7D1B3139F278} 2c4180a225d071508ac5656717a9cb30N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79B5BC47-CEA1-4772-B433-7D1B3139F278}\Implemented Categories 2c4180a225d071508ac5656717a9cb30N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79B5BC47-CEA1-4772-B433-7D1B3139F278}\Implemented Categories\{607568DD-B059-434b-B7E7-38EC51998F8E}\did = "C386EA9F7399D6B72099390A1E662679" 2c4180a225d071508ac5656717a9cb30N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5} 2c4180a225d071508ac5656717a9cb30N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node 2c4180a225d071508ac5656717a9cb30N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID 2c4180a225d071508ac5656717a9cb30N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories 2c4180a225d071508ac5656717a9cb30N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79B5BC47-CEA1-4772-B433-7D1B3139F278}\Implemented Categories\{607568DD-B059-434b-B7E7-38EC51998F8E} 2c4180a225d071508ac5656717a9cb30N.exe -
Suspicious use of FindShellTrayWindow 5 IoCs
pid Process 1452 2c4180a225d071508ac5656717a9cb30N.exe 1452 2c4180a225d071508ac5656717a9cb30N.exe 1452 2c4180a225d071508ac5656717a9cb30N.exe 1452 2c4180a225d071508ac5656717a9cb30N.exe 1452 2c4180a225d071508ac5656717a9cb30N.exe -
Suspicious use of SendNotifyMessage 5 IoCs
pid Process 1452 2c4180a225d071508ac5656717a9cb30N.exe 1452 2c4180a225d071508ac5656717a9cb30N.exe 1452 2c4180a225d071508ac5656717a9cb30N.exe 1452 2c4180a225d071508ac5656717a9cb30N.exe 1452 2c4180a225d071508ac5656717a9cb30N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2c4180a225d071508ac5656717a9cb30N.exe"C:\Users\Admin\AppData\Local\Temp\2c4180a225d071508ac5656717a9cb30N.exe"1⤵
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1452
Network
-
Remote address:8.8.8.8:53Request2398.35go.netIN AResponse2398.35go.netIN CNAME2398.35go.net.c.cdnhwc1.com2398.35go.net.c.cdnhwc1.comIN CNAMEhcdnd101.gslb.c.cdnhwc2.comhcdnd101.gslb.c.cdnhwc2.comIN A218.12.76.154hcdnd101.gslb.c.cdnhwc2.comIN A218.12.76.157hcdnd101.gslb.c.cdnhwc2.comIN A221.194.141.158hcdnd101.gslb.c.cdnhwc2.comIN A221.194.141.155
-
Remote address:8.8.8.8:53Request97.17.167.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request172.214.232.199.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request136.32.126.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Requestinfoc0.duba.netIN AResponseinfoc0.duba.netIN CNAMEinfoc2.ksmobile.cominfoc2.ksmobile.comIN A139.9.35.91infoc2.ksmobile.comIN A139.9.36.107infoc2.ksmobile.comIN A139.9.44.129infoc2.ksmobile.comIN A139.9.36.178infoc2.ksmobile.comIN A139.9.43.42infoc2.ksmobile.comIN A139.9.43.12infoc2.ksmobile.comIN A139.9.45.227infoc2.ksmobile.comIN A121.37.247.153infoc2.ksmobile.comIN A139.9.37.26
-
Remote address:8.8.8.8:53Request86.23.85.13.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request198.187.3.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Requestdubacdn.cmcmcdn.comIN AResponsedubacdn.cmcmcdn.comIN CNAMEdubacdn.cmcmcdn.com.943e270b.cdnhwchcg02.comdubacdn.cmcmcdn.com.943e270b.cdnhwchcg02.comIN CNAMEhcdnw101.vip.cdnhwcbzj102.comhcdnw101.vip.cdnhwcbzj102.comIN A221.194.141.165hcdnw101.vip.cdnhwcbzj102.comIN A36.42.77.166hcdnw101.vip.cdnhwcbzj102.comIN A120.233.178.92hcdnw101.vip.cdnhwcbzj102.comIN A36.42.77.170hcdnw101.vip.cdnhwcbzj102.comIN A218.12.76.169hcdnw101.vip.cdnhwcbzj102.comIN A120.233.178.91hcdnw101.vip.cdnhwcbzj102.comIN A221.194.141.171
-
Remote address:8.8.8.8:53Request240.221.184.93.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Requestconfig.i.duba.netIN AResponseconfig.i.duba.netIN CNAMEconfig.i.duba.net.0ba44e8c.c.cdnhwc1.comconfig.i.duba.net.0ba44e8c.c.cdnhwc1.comIN CNAMEhcdnd101.gslb.c.cdnhwc2.comhcdnd101.gslb.c.cdnhwc2.comIN A221.194.141.158hcdnd101.gslb.c.cdnhwc2.comIN A221.194.141.155hcdnd101.gslb.c.cdnhwc2.comIN A218.12.76.157hcdnd101.gslb.c.cdnhwc2.comIN A218.12.76.154
-
Remote address:8.8.8.8:53Request29.243.111.52.in-addr.arpaIN PTRResponse
-
-
-
156 B 3
-
104 B 2
-
104 B 2
-
52 B 1
-
156 B 3
-
-
-
104 B 2
-
104 B 2
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
156 B 3
-
-
-
104 B 2
-
104 B 2
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
156 B 3
-
-
-
104 B 2
-
104 B 2
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
156 B 3
-
-
-
104 B 2
-
104 B 2
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
156 B 3
-
-
-
104 B 2
-
104 B 2
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
156 B 3
-
-
-
104 B 2
-
104 B 2
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
156 B 3
-
-
-
104 B 2
-
104 B 2
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
156 B 3
-
-
-
104 B 2
-
104 B 2
-
52 B 1
-
156 B 3
-
-
-
104 B 2
-
104 B 2
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
156 B 3
-
-
-
104 B 2
-
104 B 2
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
59 B 202 B 1 1
DNS Request
2398.35go.net
DNS Response
218.12.76.154218.12.76.157221.194.141.158221.194.141.155
-
71 B 145 B 1 1
DNS Request
97.17.167.52.in-addr.arpa
-
74 B 128 B 1 1
DNS Request
172.214.232.199.in-addr.arpa
-
73 B 144 B 1 1
DNS Request
95.221.229.192.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
136.32.126.40.in-addr.arpa
-
61 B 238 B 1 1
DNS Request
infoc0.duba.net
DNS Response
139.9.35.91139.9.36.107139.9.44.129139.9.36.178139.9.43.42139.9.43.12139.9.45.227121.37.247.153139.9.37.26
-
70 B 144 B 1 1
DNS Request
86.23.85.13.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
198.187.3.20.in-addr.arpa
-
65 B 272 B 1 1
DNS Request
dubacdn.cmcmcdn.com
DNS Response
221.194.141.16536.42.77.166120.233.178.9236.42.77.170218.12.76.169120.233.178.91221.194.141.171
-
73 B 144 B 1 1
DNS Request
240.221.184.93.in-addr.arpa
-
63 B 219 B 1 1
DNS Request
config.i.duba.net
DNS Response
221.194.141.158221.194.141.155218.12.76.157218.12.76.154
-
72 B 158 B 1 1
DNS Request
29.243.111.52.in-addr.arpa