Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240910-en -
resource tags
arch:x64arch:x86image:win10v2004-20240910-enlocale:en-usos:windows10-2004-x64system -
submitted
01/10/2024, 05:10
Static task
static1
Behavioral task
behavioral1
Sample
quote prices.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
quote prices.exe
Resource
win10v2004-20240910-en
General
-
Target
quote prices.exe
-
Size
2.7MB
-
MD5
ebfef9cceabb8b7bae8fdd6da82818fb
-
SHA1
c434ac40f3a456f849a440001e0fdcae583f8eaa
-
SHA256
1dec2eb916877caf3b3fb23330de8cba38ba9bf743de5b72d0c7db5bf01f308c
-
SHA512
11fa839b9b4eab890cba026ea1cb9a928556da31da77460665e6146b25f84b9a001772f29b6ca3cb05899199e9d40d66126d4fed55eb4e122cd44e434c178f4d
-
SSDEEP
24576:WXbWGsSH8HfTn2McGGn2Gc89Jd46bV8YYDYDVBfzd7peh+cjZUYg+9Auof0AB:
Malware Config
Signatures
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
description pid Process procid_target PID 3052 created 3460 3052 quote prices.exe 56 -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Ghsbflgh = "C:\\Users\\Admin\\AppData\\Roaming\\Ghsbflgh.exe" quote prices.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3052 set thread context of 1252 3052 quote prices.exe 88 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language InstallUtil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language quote prices.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
pid Process 3052 quote prices.exe 3052 quote prices.exe 3052 quote prices.exe 3052 quote prices.exe 1252 InstallUtil.exe 1252 InstallUtil.exe 1252 InstallUtil.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 3052 quote prices.exe Token: SeDebugPrivilege 3052 quote prices.exe Token: SeDebugPrivilege 1252 InstallUtil.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 3052 wrote to memory of 1252 3052 quote prices.exe 88 PID 3052 wrote to memory of 1252 3052 quote prices.exe 88 PID 3052 wrote to memory of 1252 3052 quote prices.exe 88 PID 3052 wrote to memory of 1252 3052 quote prices.exe 88 PID 3052 wrote to memory of 1252 3052 quote prices.exe 88 PID 3052 wrote to memory of 1252 3052 quote prices.exe 88 PID 3052 wrote to memory of 1252 3052 quote prices.exe 88 PID 3052 wrote to memory of 1252 3052 quote prices.exe 88
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3460
-
C:\Users\Admin\AppData\Local\Temp\quote prices.exe"C:\Users\Admin\AppData\Local\Temp\quote prices.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3052
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1252
-