Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
11/09/2024, 04:26
Static task
static1
Behavioral task
behavioral1
Sample
4378bb8f232c3880cf5ef0e14c56afe0N.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
4378bb8f232c3880cf5ef0e14c56afe0N.exe
Resource
win10v2004-20240802-en
General
-
Target
4378bb8f232c3880cf5ef0e14c56afe0N.exe
-
Size
45KB
-
MD5
4378bb8f232c3880cf5ef0e14c56afe0
-
SHA1
f17205fd6c862363dc4596e4d778e10537679bdd
-
SHA256
6103c52e6ad7880896a3fea7613a18e0de0b1c9825601d5aa966965c9df5854a
-
SHA512
854fe7c9831a3f61a372bd9b399fd4170f1967e177acf74d3d53c360293e076782a654979dbb40a56fc40428892d36522c5dc36b0879f13e4574e7bfe5ed4010
-
SSDEEP
768:DqPJtsA6C1VqahohtgVRNToV7TtRu8rM0wYVFl2g5coW58dO0xXHV2EfKYfdhNh0:DqMA6C1VqaqhtgVRNToV7TtRu8rM0wYU
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 4804 microsofthelp.exe -
Executes dropped EXE 1 IoCs
pid Process 4804 microsofthelp.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\microsofthelp = "C:\\Windows\\microsofthelp.exe" 4378bb8f232c3880cf5ef0e14c56afe0N.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\microsofthelp.exe 4378bb8f232c3880cf5ef0e14c56afe0N.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4378bb8f232c3880cf5ef0e14c56afe0N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language microsofthelp.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 464 wrote to memory of 4804 464 4378bb8f232c3880cf5ef0e14c56afe0N.exe 83 PID 464 wrote to memory of 4804 464 4378bb8f232c3880cf5ef0e14c56afe0N.exe 83 PID 464 wrote to memory of 4804 464 4378bb8f232c3880cf5ef0e14c56afe0N.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\4378bb8f232c3880cf5ef0e14c56afe0N.exe"C:\Users\Admin\AppData\Local\Temp\4378bb8f232c3880cf5ef0e14c56afe0N.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:464 -
C:\Windows\microsofthelp.exe"C:\Windows\microsofthelp.exe"2⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4804
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
45KB
MD5779b97bf6c5b6cfa23dff7f2608667f9
SHA116dd94da852cd13bebd22758de938ea99232cd51
SHA2566a1682275f0af99cfeec751c7080f78f4e925b2e62c6bac01571e66888a18819
SHA51271050a31e6417bfdf226ea0c451242f1762216139066b9c9a9b60f71d466ed903b3277d576996aa2e0273f926e789d54d2a335433c29ad3aa39d6a8136732035