Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
125s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
25/09/2024, 13:59
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20240802-en
General
-
Target
file.exe
-
Size
732KB
-
MD5
7fbb332b55f872e61c8307e0b5242287
-
SHA1
b499466240ef01da4a2cf380d709752b2e44232a
-
SHA256
9845acc424512cc5b0c67de96ce917624b5e80ee95ea4ea6a7cbc37b7c03ef63
-
SHA512
e813f006263b87a5078bca9c58b94567ac8df627b27d44411774b797bdd7095f9bebaff8a1d2f0329b8fc63016199ef7e04ec17d68ce28b250cd3da37c2e8d04
-
SSDEEP
12288:TfLdembnSidi8rrdTT4aQUh9IHUM1mPCeBxHnymwsXFDsiJjWlWVB0mPHp:TfLNnSsi8dTTCjmqePSrsXF4i7XPPJ
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2972 file.exe -
pid Process 3668 powershell.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe -
Suspicious behavior: EnumeratesProcesses 9 IoCs
pid Process 3668 powershell.exe 3668 powershell.exe 3668 powershell.exe 3668 powershell.exe 3668 powershell.exe 3668 powershell.exe 3668 powershell.exe 3668 powershell.exe 3668 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3668 powershell.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2972 wrote to memory of 3668 2972 file.exe 89 PID 2972 wrote to memory of 3668 2972 file.exe 89 PID 2972 wrote to memory of 3668 2972 file.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -windowstyle minimized "$Sprag=Get-Content 'C:\Users\Admin\AppData\Local\acneform\Camomiles.Bev';$Depurge=$Sprag.SubString(30781,3);.$Depurge($Sprag)"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3668
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3988,i,5469445176230119590,7931734017267321834,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:81⤵PID:3372
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
7KB
MD5b4579bc396ace8cafd9e825ff63fe244
SHA132a87ed28a510e3b3c06a451d1f3d0ba9faf8d9c
SHA25601e72332362345c415a7edcb366d6a1b52be9ac6e946fb9da49785c140ba1a4b
SHA5123a76e0e259a0ca12275fed922ce6e01bdfd9e33ba85973e80101b8025ef9243f5e32461a113bbcc6aa75e40894bb5d3a42d6b21045517b6b3cf12d76b4cfa36a
-
Filesize
71KB
MD599eba9ecc95f62898e4df3aa12cb4624
SHA1c21a35b90111b01c32c9e963b20aaa01b35658a6
SHA256b8408fc8df3cd3c0938d8314568b278d72cb102b8d128a11608cab75a2046b21
SHA51242b40c55dc01197d21b6dbb5c4d0ca77be2ca890a70fab1e0022defbde7204a8b19387915fe144b540333bdb72fde557e8f1673131830faf455aa0fb25e6a347