Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
14/09/2024, 21:24
Static task
static1
Behavioral task
behavioral1
Sample
db5292be0d0c71e6f8d088833bcaf8bd76987a10ba904206cc8c4e8bd3d2f421.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
db5292be0d0c71e6f8d088833bcaf8bd76987a10ba904206cc8c4e8bd3d2f421.exe
Resource
win10v2004-20240802-en
General
-
Target
db5292be0d0c71e6f8d088833bcaf8bd76987a10ba904206cc8c4e8bd3d2f421.exe
-
Size
1.1MB
-
MD5
1f528c5dbd1cde51c9efb6a8eb984a59
-
SHA1
371a7c55cdc20bea480598da3459326c20cf5d06
-
SHA256
db5292be0d0c71e6f8d088833bcaf8bd76987a10ba904206cc8c4e8bd3d2f421
-
SHA512
54f6faede966b89c884d688ac24335da395255fe23ed7374e7d2d736b661ab25bc7e63dae3158689779644e7d914f54001ee7e12fad1492f491ebfab68a010c6
-
SSDEEP
24576:aH0dl8myX9Bg42QoXFkrzkmplSgRDYo0lG4Z8r7Qfbkiu5Ql:acallSllG4ZM7QzMe
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation db5292be0d0c71e6f8d088833bcaf8bd76987a10ba904206cc8c4e8bd3d2f421.exe Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation WScript.exe -
Deletes itself 1 IoCs
pid Process 1916 svchcst.exe -
Executes dropped EXE 2 IoCs
pid Process 1916 svchcst.exe 1360 svchcst.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language db5292be0d0c71e6f8d088833bcaf8bd76987a10ba904206cc8c4e8bd3d2f421.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchcst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchcst.exe -
Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings db5292be0d0c71e6f8d088833bcaf8bd76987a10ba904206cc8c4e8bd3d2f421.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ WScript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ WScript.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 952 db5292be0d0c71e6f8d088833bcaf8bd76987a10ba904206cc8c4e8bd3d2f421.exe 952 db5292be0d0c71e6f8d088833bcaf8bd76987a10ba904206cc8c4e8bd3d2f421.exe 952 db5292be0d0c71e6f8d088833bcaf8bd76987a10ba904206cc8c4e8bd3d2f421.exe 952 db5292be0d0c71e6f8d088833bcaf8bd76987a10ba904206cc8c4e8bd3d2f421.exe 1916 svchcst.exe 1916 svchcst.exe 1916 svchcst.exe 1916 svchcst.exe 1916 svchcst.exe 1916 svchcst.exe 1916 svchcst.exe 1916 svchcst.exe 1916 svchcst.exe 1916 svchcst.exe 1916 svchcst.exe 1916 svchcst.exe 1916 svchcst.exe 1916 svchcst.exe 1916 svchcst.exe 1916 svchcst.exe 1916 svchcst.exe 1916 svchcst.exe 1916 svchcst.exe 1916 svchcst.exe 1916 svchcst.exe 1916 svchcst.exe 1916 svchcst.exe 1916 svchcst.exe 1916 svchcst.exe 1916 svchcst.exe 1916 svchcst.exe 1916 svchcst.exe 1916 svchcst.exe 1916 svchcst.exe 1916 svchcst.exe 1916 svchcst.exe 1916 svchcst.exe 1916 svchcst.exe 1916 svchcst.exe 1916 svchcst.exe 1916 svchcst.exe 1916 svchcst.exe 1916 svchcst.exe 1916 svchcst.exe 1916 svchcst.exe 1916 svchcst.exe 1916 svchcst.exe 1916 svchcst.exe 1916 svchcst.exe 1916 svchcst.exe 1916 svchcst.exe 1916 svchcst.exe 1916 svchcst.exe 1916 svchcst.exe 1916 svchcst.exe 1916 svchcst.exe 1916 svchcst.exe 1916 svchcst.exe 1916 svchcst.exe 1916 svchcst.exe 1916 svchcst.exe 1916 svchcst.exe 1916 svchcst.exe 1916 svchcst.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 952 db5292be0d0c71e6f8d088833bcaf8bd76987a10ba904206cc8c4e8bd3d2f421.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 952 db5292be0d0c71e6f8d088833bcaf8bd76987a10ba904206cc8c4e8bd3d2f421.exe 952 db5292be0d0c71e6f8d088833bcaf8bd76987a10ba904206cc8c4e8bd3d2f421.exe 1360 svchcst.exe 1916 svchcst.exe 1360 svchcst.exe 1916 svchcst.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 952 wrote to memory of 1332 952 db5292be0d0c71e6f8d088833bcaf8bd76987a10ba904206cc8c4e8bd3d2f421.exe 87 PID 952 wrote to memory of 1332 952 db5292be0d0c71e6f8d088833bcaf8bd76987a10ba904206cc8c4e8bd3d2f421.exe 87 PID 952 wrote to memory of 1332 952 db5292be0d0c71e6f8d088833bcaf8bd76987a10ba904206cc8c4e8bd3d2f421.exe 87 PID 952 wrote to memory of 4108 952 db5292be0d0c71e6f8d088833bcaf8bd76987a10ba904206cc8c4e8bd3d2f421.exe 86 PID 952 wrote to memory of 4108 952 db5292be0d0c71e6f8d088833bcaf8bd76987a10ba904206cc8c4e8bd3d2f421.exe 86 PID 952 wrote to memory of 4108 952 db5292be0d0c71e6f8d088833bcaf8bd76987a10ba904206cc8c4e8bd3d2f421.exe 86 PID 4108 wrote to memory of 1360 4108 WScript.exe 89 PID 4108 wrote to memory of 1360 4108 WScript.exe 89 PID 4108 wrote to memory of 1360 4108 WScript.exe 89 PID 1332 wrote to memory of 1916 1332 WScript.exe 90 PID 1332 wrote to memory of 1916 1332 WScript.exe 90 PID 1332 wrote to memory of 1916 1332 WScript.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\db5292be0d0c71e6f8d088833bcaf8bd76987a10ba904206cc8c4e8bd3d2f421.exe"C:\Users\Admin\AppData\Local\Temp\db5292be0d0c71e6f8d088833bcaf8bd76987a10ba904206cc8c4e8bd3d2f421.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:952 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4108 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1360
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1332 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"3⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1916
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
753B
MD5a241aeb22bf3bf3283404b7e63258f23
SHA15626161afccef4de617940d4208f844bdf476532
SHA2567f3efcc291fec9e97ba4b9c14bd728f04129f3220294ccb062dc7e781763996f
SHA512651040a44cc82286d21e452f57a52211e27b51f030d3b4734e887be16b75a3e2ae552df812b151ee2d041a0a2ae9e44b739775b05985a3a17f556d08c1ab5c35
-
Filesize
1.1MB
MD59e1c2951328936ab87e9c7975405fd90
SHA1d36224e9a44a56ce73c917556c1c659b8b06a915
SHA256f7a299318b1f512badde1b2d6132281846fa2f37a2fd7161f59dde423438d1d3
SHA51251b22aed3fd7620be666d19468f32caab149fd7609d4bb64b3e4100e0a75791434c761f08a179bd3c5f7a11744df835f57fa3d794ec4a582bbddfe557bc461f9