Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
94s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
12/09/2024, 21:58
Static task
static1
Behavioral task
behavioral1
Sample
8b4c64ed4ca3b6d0a372dad31ab7a18993dac44df9bf6770ece28d5c3acf81a6.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
8b4c64ed4ca3b6d0a372dad31ab7a18993dac44df9bf6770ece28d5c3acf81a6.exe
Resource
win10v2004-20240802-en
General
-
Target
8b4c64ed4ca3b6d0a372dad31ab7a18993dac44df9bf6770ece28d5c3acf81a6.exe
-
Size
1.1MB
-
MD5
e6951f7d29a0fed4b2f0cbeba2b98ed3
-
SHA1
4fa016bcc8b1df2f50ee195decc3977a2497c7c0
-
SHA256
8b4c64ed4ca3b6d0a372dad31ab7a18993dac44df9bf6770ece28d5c3acf81a6
-
SHA512
02b953fd3c47a30e11af9a82592fb488056979dde0a4d5875d871e600ef65b1e5cd0f5d44011ac0f20ad081635c2302e289e72a52e150d12de586bbb98d6dea9
-
SSDEEP
24576:CH0dl8myX9Bg42QoXFkrzkmmlSgRDko0lG4Z8r7Qfbkiu5Qr:CcaClSFlG4ZM7QzMc
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation 8b4c64ed4ca3b6d0a372dad31ab7a18993dac44df9bf6770ece28d5c3acf81a6.exe Key value queried \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation WScript.exe -
Deletes itself 1 IoCs
pid Process 4472 svchcst.exe -
Executes dropped EXE 2 IoCs
pid Process 4472 svchcst.exe 2484 svchcst.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8b4c64ed4ca3b6d0a372dad31ab7a18993dac44df9bf6770ece28d5c3acf81a6.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchcst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchcst.exe -
Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings 8b4c64ed4ca3b6d0a372dad31ab7a18993dac44df9bf6770ece28d5c3acf81a6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ WScript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ WScript.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1640 8b4c64ed4ca3b6d0a372dad31ab7a18993dac44df9bf6770ece28d5c3acf81a6.exe 1640 8b4c64ed4ca3b6d0a372dad31ab7a18993dac44df9bf6770ece28d5c3acf81a6.exe 1640 8b4c64ed4ca3b6d0a372dad31ab7a18993dac44df9bf6770ece28d5c3acf81a6.exe 1640 8b4c64ed4ca3b6d0a372dad31ab7a18993dac44df9bf6770ece28d5c3acf81a6.exe 4472 svchcst.exe 4472 svchcst.exe 4472 svchcst.exe 4472 svchcst.exe 4472 svchcst.exe 4472 svchcst.exe 4472 svchcst.exe 4472 svchcst.exe 4472 svchcst.exe 4472 svchcst.exe 4472 svchcst.exe 4472 svchcst.exe 4472 svchcst.exe 4472 svchcst.exe 4472 svchcst.exe 4472 svchcst.exe 4472 svchcst.exe 4472 svchcst.exe 4472 svchcst.exe 4472 svchcst.exe 4472 svchcst.exe 4472 svchcst.exe 4472 svchcst.exe 4472 svchcst.exe 4472 svchcst.exe 4472 svchcst.exe 4472 svchcst.exe 4472 svchcst.exe 4472 svchcst.exe 4472 svchcst.exe 4472 svchcst.exe 4472 svchcst.exe 4472 svchcst.exe 4472 svchcst.exe 4472 svchcst.exe 4472 svchcst.exe 4472 svchcst.exe 4472 svchcst.exe 4472 svchcst.exe 4472 svchcst.exe 4472 svchcst.exe 4472 svchcst.exe 4472 svchcst.exe 4472 svchcst.exe 4472 svchcst.exe 4472 svchcst.exe 4472 svchcst.exe 4472 svchcst.exe 4472 svchcst.exe 4472 svchcst.exe 4472 svchcst.exe 4472 svchcst.exe 4472 svchcst.exe 4472 svchcst.exe 4472 svchcst.exe 4472 svchcst.exe 4472 svchcst.exe 4472 svchcst.exe 4472 svchcst.exe 4472 svchcst.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1640 8b4c64ed4ca3b6d0a372dad31ab7a18993dac44df9bf6770ece28d5c3acf81a6.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1640 8b4c64ed4ca3b6d0a372dad31ab7a18993dac44df9bf6770ece28d5c3acf81a6.exe 1640 8b4c64ed4ca3b6d0a372dad31ab7a18993dac44df9bf6770ece28d5c3acf81a6.exe 4472 svchcst.exe 4472 svchcst.exe 2484 svchcst.exe 2484 svchcst.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1640 wrote to memory of 2276 1640 8b4c64ed4ca3b6d0a372dad31ab7a18993dac44df9bf6770ece28d5c3acf81a6.exe 85 PID 1640 wrote to memory of 2276 1640 8b4c64ed4ca3b6d0a372dad31ab7a18993dac44df9bf6770ece28d5c3acf81a6.exe 85 PID 1640 wrote to memory of 2276 1640 8b4c64ed4ca3b6d0a372dad31ab7a18993dac44df9bf6770ece28d5c3acf81a6.exe 85 PID 1640 wrote to memory of 1684 1640 8b4c64ed4ca3b6d0a372dad31ab7a18993dac44df9bf6770ece28d5c3acf81a6.exe 86 PID 1640 wrote to memory of 1684 1640 8b4c64ed4ca3b6d0a372dad31ab7a18993dac44df9bf6770ece28d5c3acf81a6.exe 86 PID 1640 wrote to memory of 1684 1640 8b4c64ed4ca3b6d0a372dad31ab7a18993dac44df9bf6770ece28d5c3acf81a6.exe 86 PID 2276 wrote to memory of 4472 2276 WScript.exe 93 PID 2276 wrote to memory of 4472 2276 WScript.exe 93 PID 2276 wrote to memory of 4472 2276 WScript.exe 93 PID 1684 wrote to memory of 2484 1684 WScript.exe 94 PID 1684 wrote to memory of 2484 1684 WScript.exe 94 PID 1684 wrote to memory of 2484 1684 WScript.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\8b4c64ed4ca3b6d0a372dad31ab7a18993dac44df9bf6770ece28d5c3acf81a6.exe"C:\Users\Admin\AppData\Local\Temp\8b4c64ed4ca3b6d0a372dad31ab7a18993dac44df9bf6770ece28d5c3acf81a6.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"3⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4472
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2484
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
753B
MD5e76e067376ef5816e053e87e47328152
SHA1a9654d729d749da78e356e1cef2bbf62dadd2a61
SHA2568487e0f20d6b62cb62dcb76e9998ff8b5e2d81d9f1f861c0dc05f286751f9391
SHA51270455213d0fe1db60722559afaf807d9b92ed5ba479d4579b437e1f3966ba76838332c764b1ce09c5ae98b20fea59575415ac865f2d1b370bb82228931b49b7e
-
Filesize
1.1MB
MD5c9411297fb83f09880b7644e4e07c2ee
SHA11c7d3e2e3fd68a27f9e4e2ac1126256fa513c1db
SHA2564d713b16a12b26f5ff77abdcb1163f5a49399b554a486ad53b4959e9afe2dba3
SHA512cb42c17e22f9d1d3785baffbd4fbb1cd3e2ba34bdd962188061366bc02ebac4b5be13ddacd1ad2bc0ca66803b1bff6ef275accd9997bd17f7400c4e3046607e5