Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
29/09/2024, 22:07
Static task
static1
Behavioral task
behavioral1
Sample
6344de41d68b03a4033637e5d9f61b4e0298b65ab113c390e20f9602c34d33dc.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
6344de41d68b03a4033637e5d9f61b4e0298b65ab113c390e20f9602c34d33dc.exe
Resource
win10v2004-20240802-en
General
-
Target
6344de41d68b03a4033637e5d9f61b4e0298b65ab113c390e20f9602c34d33dc.exe
-
Size
135KB
-
MD5
6b301094cf3ea605312cdc96b9b8bc89
-
SHA1
7c541453573b98a730c9275c0922d53429251e48
-
SHA256
6344de41d68b03a4033637e5d9f61b4e0298b65ab113c390e20f9602c34d33dc
-
SHA512
13b1bbc6c4765c41e19b68e97f8e726c7e3e80bbe329d2ad825ec947ada66c044ea7bb7e3f4a486d5f1ba1aff2651c0baa8a3e1d2d9901f5f5134f6761322b17
-
SSDEEP
3072:UVqoCl/YgjxEufVU0TbTyDDalp5777777777777777777777777777777777777Y:UsLqdufVUNDaO
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe -
Executes dropped EXE 4 IoCs
pid Process 1012 explorer.exe 2352 spoolsv.exe 3140 svchost.exe 2176 spoolsv.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" explorer.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\explorer.exe explorer.exe File opened for modification C:\Windows\SysWOW64\explorer.exe svchost.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification \??\c:\windows\resources\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\resources\svchost.exe spoolsv.exe File opened for modification C:\Windows\Resources\tjud.exe explorer.exe File opened for modification \??\c:\windows\resources\themes\explorer.exe 6344de41d68b03a4033637e5d9f61b4e0298b65ab113c390e20f9602c34d33dc.exe -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6344de41d68b03a4033637e5d9f61b4e0298b65ab113c390e20f9602c34d33dc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4648 6344de41d68b03a4033637e5d9f61b4e0298b65ab113c390e20f9602c34d33dc.exe 4648 6344de41d68b03a4033637e5d9f61b4e0298b65ab113c390e20f9602c34d33dc.exe 4648 6344de41d68b03a4033637e5d9f61b4e0298b65ab113c390e20f9602c34d33dc.exe 4648 6344de41d68b03a4033637e5d9f61b4e0298b65ab113c390e20f9602c34d33dc.exe 4648 6344de41d68b03a4033637e5d9f61b4e0298b65ab113c390e20f9602c34d33dc.exe 4648 6344de41d68b03a4033637e5d9f61b4e0298b65ab113c390e20f9602c34d33dc.exe 4648 6344de41d68b03a4033637e5d9f61b4e0298b65ab113c390e20f9602c34d33dc.exe 4648 6344de41d68b03a4033637e5d9f61b4e0298b65ab113c390e20f9602c34d33dc.exe 4648 6344de41d68b03a4033637e5d9f61b4e0298b65ab113c390e20f9602c34d33dc.exe 4648 6344de41d68b03a4033637e5d9f61b4e0298b65ab113c390e20f9602c34d33dc.exe 4648 6344de41d68b03a4033637e5d9f61b4e0298b65ab113c390e20f9602c34d33dc.exe 4648 6344de41d68b03a4033637e5d9f61b4e0298b65ab113c390e20f9602c34d33dc.exe 4648 6344de41d68b03a4033637e5d9f61b4e0298b65ab113c390e20f9602c34d33dc.exe 4648 6344de41d68b03a4033637e5d9f61b4e0298b65ab113c390e20f9602c34d33dc.exe 4648 6344de41d68b03a4033637e5d9f61b4e0298b65ab113c390e20f9602c34d33dc.exe 4648 6344de41d68b03a4033637e5d9f61b4e0298b65ab113c390e20f9602c34d33dc.exe 4648 6344de41d68b03a4033637e5d9f61b4e0298b65ab113c390e20f9602c34d33dc.exe 4648 6344de41d68b03a4033637e5d9f61b4e0298b65ab113c390e20f9602c34d33dc.exe 4648 6344de41d68b03a4033637e5d9f61b4e0298b65ab113c390e20f9602c34d33dc.exe 4648 6344de41d68b03a4033637e5d9f61b4e0298b65ab113c390e20f9602c34d33dc.exe 4648 6344de41d68b03a4033637e5d9f61b4e0298b65ab113c390e20f9602c34d33dc.exe 4648 6344de41d68b03a4033637e5d9f61b4e0298b65ab113c390e20f9602c34d33dc.exe 4648 6344de41d68b03a4033637e5d9f61b4e0298b65ab113c390e20f9602c34d33dc.exe 4648 6344de41d68b03a4033637e5d9f61b4e0298b65ab113c390e20f9602c34d33dc.exe 4648 6344de41d68b03a4033637e5d9f61b4e0298b65ab113c390e20f9602c34d33dc.exe 4648 6344de41d68b03a4033637e5d9f61b4e0298b65ab113c390e20f9602c34d33dc.exe 4648 6344de41d68b03a4033637e5d9f61b4e0298b65ab113c390e20f9602c34d33dc.exe 4648 6344de41d68b03a4033637e5d9f61b4e0298b65ab113c390e20f9602c34d33dc.exe 4648 6344de41d68b03a4033637e5d9f61b4e0298b65ab113c390e20f9602c34d33dc.exe 4648 6344de41d68b03a4033637e5d9f61b4e0298b65ab113c390e20f9602c34d33dc.exe 4648 6344de41d68b03a4033637e5d9f61b4e0298b65ab113c390e20f9602c34d33dc.exe 4648 6344de41d68b03a4033637e5d9f61b4e0298b65ab113c390e20f9602c34d33dc.exe 4648 6344de41d68b03a4033637e5d9f61b4e0298b65ab113c390e20f9602c34d33dc.exe 4648 6344de41d68b03a4033637e5d9f61b4e0298b65ab113c390e20f9602c34d33dc.exe 1012 explorer.exe 1012 explorer.exe 1012 explorer.exe 1012 explorer.exe 1012 explorer.exe 1012 explorer.exe 1012 explorer.exe 1012 explorer.exe 1012 explorer.exe 1012 explorer.exe 1012 explorer.exe 1012 explorer.exe 1012 explorer.exe 1012 explorer.exe 1012 explorer.exe 1012 explorer.exe 1012 explorer.exe 1012 explorer.exe 1012 explorer.exe 1012 explorer.exe 1012 explorer.exe 1012 explorer.exe 1012 explorer.exe 1012 explorer.exe 1012 explorer.exe 1012 explorer.exe 1012 explorer.exe 1012 explorer.exe 1012 explorer.exe 1012 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 1012 explorer.exe 3140 svchost.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 4648 6344de41d68b03a4033637e5d9f61b4e0298b65ab113c390e20f9602c34d33dc.exe 4648 6344de41d68b03a4033637e5d9f61b4e0298b65ab113c390e20f9602c34d33dc.exe 1012 explorer.exe 1012 explorer.exe 2352 spoolsv.exe 2352 spoolsv.exe 3140 svchost.exe 3140 svchost.exe 2176 spoolsv.exe 2176 spoolsv.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 4648 wrote to memory of 1012 4648 6344de41d68b03a4033637e5d9f61b4e0298b65ab113c390e20f9602c34d33dc.exe 82 PID 4648 wrote to memory of 1012 4648 6344de41d68b03a4033637e5d9f61b4e0298b65ab113c390e20f9602c34d33dc.exe 82 PID 4648 wrote to memory of 1012 4648 6344de41d68b03a4033637e5d9f61b4e0298b65ab113c390e20f9602c34d33dc.exe 82 PID 1012 wrote to memory of 2352 1012 explorer.exe 83 PID 1012 wrote to memory of 2352 1012 explorer.exe 83 PID 1012 wrote to memory of 2352 1012 explorer.exe 83 PID 2352 wrote to memory of 3140 2352 spoolsv.exe 84 PID 2352 wrote to memory of 3140 2352 spoolsv.exe 84 PID 2352 wrote to memory of 3140 2352 spoolsv.exe 84 PID 3140 wrote to memory of 2176 3140 svchost.exe 85 PID 3140 wrote to memory of 2176 3140 svchost.exe 85 PID 3140 wrote to memory of 2176 3140 svchost.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\6344de41d68b03a4033637e5d9f61b4e0298b65ab113c390e20f9602c34d33dc.exe"C:\Users\Admin\AppData\Local\Temp\6344de41d68b03a4033637e5d9f61b4e0298b65ab113c390e20f9602c34d33dc.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4648 -
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1012 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2352 -
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe4⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3140 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2176
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
135KB
MD555c7b11893137bc1cddf69b591ecd5ea
SHA12d1ca5e23f7e1d67d5c23cade26711adaa97d0ea
SHA25668a12bfb2bce2e63561861e0369b060595a089784e64b1327bb38f4f915c00ac
SHA512ddc4c787dd622d56b557101fb141691f6c3b5ec893e3df8355d5342a43c99e30a08aac843f7914d4400034cbeea60d713c2ce2f01b0da8fb0d8d67981162bcb3
-
Filesize
135KB
MD5626698825f4a2529156a2baa58c3e9b8
SHA18ad1c5ba23945e7ade1eedff340e7f1293b9f1e7
SHA256458a34a52b3e46db1228e66233b3395d0feab65d634c6d658a35c913016b7167
SHA5125014ac263b727908135d523edc6c8ed7cc4ab756e18506e39b2195564d42347bfa12205a92e321b7c9a78277befb2371e10fc629e4801744691484fd621ee594
-
Filesize
135KB
MD5a3333cb5f0a1c67fd1eab357e24b826c
SHA16a0192c5f11c904ae4f70471e5f47f10a59adb05
SHA25657cd49d8be927a003fd7e1588f26c6b905c408c4ffb23a2777d85bab71bf4a92
SHA512d36fda69f3d05765a9178a0a738c2c1e672b52720a427e0a953cf8a58832de329fa8b8323d2822102d39841c785bbf266bf2fe68160cd3beb90e906e4c926a8e