Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
96s -
max time network
100s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
08/09/2024, 10:39
Behavioral task
behavioral1
Sample
1325616808efbd6d8b95f40b3eb5eca0N.exe
Resource
win7-20240903-en
General
-
Target
1325616808efbd6d8b95f40b3eb5eca0N.exe
-
Size
38KB
-
MD5
1325616808efbd6d8b95f40b3eb5eca0
-
SHA1
be8ea41e71eeba1110657558c71a247e887c6475
-
SHA256
059c666ad1ca23d638a4e67f38c0aecb743fe830283fffe6fbdd6e147b37bac8
-
SHA512
0917207cb2ae44603f73745a70eb1873df4dc5df308aa45ac75dac148286f56dd020d02e9c188cc3f1d5cf6c6654867926d4e0a7fa417821a697f2bf9515a462
-
SSDEEP
768:Nzj1JegVa3Gry+uELEmITCs/NUZ6nZdYbCLECkrQoP9fmF2f1cOGu:NWQa2TLEmITcoQxfllfmS1cOt
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 4444 smss.exe -
resource yara_rule behavioral2/memory/768-0-0x0000000000400000-0x0000000000422000-memory.dmp upx behavioral2/files/0x0009000000023426-5.dat upx behavioral2/memory/768-11-0x0000000000400000-0x0000000000422000-memory.dmp upx behavioral2/memory/4444-13-0x0000000000400000-0x0000000000422000-memory.dmp upx -
Drops file in System32 directory 3 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\1230\smss.exe 1325616808efbd6d8b95f40b3eb5eca0N.exe File opened for modification C:\Windows\SysWOW64\1230\smss.exe smss.exe File opened for modification C:\Windows\SysWOW64\Service.exe smss.exe -
Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 4972 sc.exe 3064 sc.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1325616808efbd6d8b95f40b3eb5eca0N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language smss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 768 1325616808efbd6d8b95f40b3eb5eca0N.exe 4444 smss.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 768 wrote to memory of 4972 768 1325616808efbd6d8b95f40b3eb5eca0N.exe 83 PID 768 wrote to memory of 4972 768 1325616808efbd6d8b95f40b3eb5eca0N.exe 83 PID 768 wrote to memory of 4972 768 1325616808efbd6d8b95f40b3eb5eca0N.exe 83 PID 768 wrote to memory of 4444 768 1325616808efbd6d8b95f40b3eb5eca0N.exe 85 PID 768 wrote to memory of 4444 768 1325616808efbd6d8b95f40b3eb5eca0N.exe 85 PID 768 wrote to memory of 4444 768 1325616808efbd6d8b95f40b3eb5eca0N.exe 85 PID 4444 wrote to memory of 3064 4444 smss.exe 86 PID 4444 wrote to memory of 3064 4444 smss.exe 86 PID 4444 wrote to memory of 3064 4444 smss.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\1325616808efbd6d8b95f40b3eb5eca0N.exe"C:\Users\Admin\AppData\Local\Temp\1325616808efbd6d8b95f40b3eb5eca0N.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:768 -
C:\Windows\SysWOW64\sc.exeC:\Windows\system32\sc.exe stop wscsvc2⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:4972
-
-
C:\Windows\SysWOW64\1230\smss.exeC:\Windows\system32\1230\smss.exe -d2⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Windows\SysWOW64\sc.exeC:\Windows\system32\sc.exe stop wscsvc3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:3064
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
38KB
MD537d735d1d9a9f62540393950b84b1fec
SHA15d5835fb77024c77a9fedcb1a84fa43c2c434692
SHA256e2673c28fcc602b5bc2ea0eb3b746a1e659782012a41e68dfc5b08bacd00b3db
SHA512fc6f75385a7b65f24f6bd8ce3208d3c2e03decefd80e672c4a4823a9ab41e4288e2a7340280e75a1c3b79bc6ee2b91f66bcba2966b9f06e53bb4f14ca1dfb7b4