Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
04/09/2024, 09:06
Static task
static1
Behavioral task
behavioral1
Sample
bd82f3fcb69a21ea2ababbc4ad626190N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
bd82f3fcb69a21ea2ababbc4ad626190N.exe
Resource
win10v2004-20240802-en
General
-
Target
bd82f3fcb69a21ea2ababbc4ad626190N.exe
-
Size
63KB
-
MD5
bd82f3fcb69a21ea2ababbc4ad626190
-
SHA1
bc89a6b09f0593d46582b7d21202e19fa85b4fea
-
SHA256
59e1ba4b7b24bc16220e1269c0f9789f2d7d91249e867e655b8676847cac33b5
-
SHA512
eb6e0a2ebc48fde43ddf3bc97d0e9557e2bb6949fd7fe348c6b5c1ac912917ab25b87a48f4b6ecce1b681d0431266730d985990effae170e958c0235c0f732a4
-
SSDEEP
1536:NAo0Tj2d6rnJwwvl4ulkP6vghzwYu7vih9GueIh9j2IoHAjUvJQ/johleHhvGh4u:NAoglOwvl4ulkP6vghzwYu7vih9GueIu
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1760 microsofthelp.exe -
Executes dropped EXE 1 IoCs
pid Process 1760 microsofthelp.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\microsofthelp = "C:\\Windows\\microsofthelp.exe" bd82f3fcb69a21ea2ababbc4ad626190N.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\HidePlugin.dll microsofthelp.exe File created C:\Windows\microsofthelp.exe bd82f3fcb69a21ea2ababbc4ad626190N.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bd82f3fcb69a21ea2ababbc4ad626190N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language microsofthelp.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3088 wrote to memory of 1760 3088 bd82f3fcb69a21ea2ababbc4ad626190N.exe 83 PID 3088 wrote to memory of 1760 3088 bd82f3fcb69a21ea2ababbc4ad626190N.exe 83 PID 3088 wrote to memory of 1760 3088 bd82f3fcb69a21ea2ababbc4ad626190N.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\bd82f3fcb69a21ea2ababbc4ad626190N.exe"C:\Users\Admin\AppData\Local\Temp\bd82f3fcb69a21ea2ababbc4ad626190N.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3088 -
C:\Windows\microsofthelp.exe"C:\Windows\microsofthelp.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1760
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD5dd7bcdef0554b9d80988fee5fd0ac7e8
SHA1f93bb8c67e35af29276fa2e80607daa3cbde8bb7
SHA256881967c9bc2a55ae937e35b44af8b6e4fd7613b522c18b6c1fc8df061fe5c1d4
SHA512a29857a7687ae774e71139ed1cbe5409e365201d0ad80727b77e43248966a6b1cc93411f4eacb737dbd0b3b40dc763ccb7c425ee502113b4d09d465cf4afc78e