Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    94s
  • max time network
    96s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/10/2024, 07:08

General

  • Target

    0589a4577444ad44f26bf0c27d53fbc74b07eeb6cd0db927a85576c06224c814N.exe

  • Size

    88KB

  • MD5

    c5cdf1176286efaa5fc3d7185d0e51c0

  • SHA1

    a7dabf9f070ff73be95a488393d988cd8e6f1ffa

  • SHA256

    0589a4577444ad44f26bf0c27d53fbc74b07eeb6cd0db927a85576c06224c814

  • SHA512

    d371bdd24c03096d5c67fdfbf0758cf22a1a129fefaaf61e602fb9ab26271e700bdccf31bf0983aeb96608cee1f4f9fc1ca45e5535730bedbacf87bb6b682e9a

  • SSDEEP

    1536:8h7xsCKosi5pzjIcdRiTpqMGxs3lh7xsCKosi5pzjIcdRiTpqMGxs34:8EhWbcpqIlEhWbcpqI4

Malware Config

Signatures

  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 6 IoCs
  • Modifies system executable filetype association 2 TTPs 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 14 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0589a4577444ad44f26bf0c27d53fbc74b07eeb6cd0db927a85576c06224c814N.exe
    "C:\Users\Admin\AppData\Local\Temp\0589a4577444ad44f26bf0c27d53fbc74b07eeb6cd0db927a85576c06224c814N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2792
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3336
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\123.bat
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4440
      • C:\Windows\SysWOW64\reg.exe
        reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\ZhuDongFangYu.exe" /v debugger /t reg_sz /d "ntsd -d" /f
        3⤵
        • Event Triggered Execution: Image File Execution Options Injection
        • System Location Discovery: System Language Discovery
        PID:940
      • C:\Windows\SysWOW64\reg.exe
        reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\360tray.exe" /v debugger /t reg_sz /d "ntsd -d" /f
        3⤵
        • Event Triggered Execution: Image File Execution Options Injection
        • System Location Discovery: System Language Discovery
        PID:2776
      • C:\Windows\SysWOW64\reg.exe
        reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\taskmgr.exe" /v debugger /t reg_sz /d "ntsd -d" /f
        3⤵
        • Event Triggered Execution: Image File Execution Options Injection
        • System Location Discovery: System Language Discovery
        PID:4056
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c assoc .txt = exefile
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      PID:1140
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c ftype comfile=C:\Users\Admin\AppData\Local\Temp\0589a4577444ad44f26bf0c27d53fbc74b07eeb6cd0db927a85576c06224c814N.exe
      2⤵
      • Modifies system executable filetype association
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      PID:4348
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c ftype zipfile=C:\Users\Admin\AppData\Local\Temp\0589a4577444ad44f26bf0c27d53fbc74b07eeb6cd0db927a85576c06224c814N.exe
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      PID:4556
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c ftype jpgfile=C:\Users\Admin\AppData\Local\Temp\0589a4577444ad44f26bf0c27d53fbc74b07eeb6cd0db927a85576c06224c814N.exe
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      PID:4592
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c ftype txtfile=C:\Users\Admin\AppData\Local\Temp\0589a4577444ad44f26bf0c27d53fbc74b07eeb6cd0db927a85576c06224c814N.exe
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      PID:4396

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\123.bat

    Filesize

    443B

    MD5

    70170ba16a737a438223b88279dc6c85

    SHA1

    cc066efa0fca9bc9f44013660dea6b28ddfd6a24

    SHA256

    d3674f4b34a8ca8167160519aa5c66b6024eb09f4cb0c9278bc44370b0efec6a

    SHA512

    37cc8c954544374d0a1ca4d012c9bd0b47781bc9bb8d0c15a8a95b9934893db3bedee867b984c20edabe54c39574abf7250de433aade6c0d544b8dd2c972c6da

  • C:\Program Files\7-Zip\7zFM.exe

    Filesize

    88KB

    MD5

    90a9a90e8c1e2e1b95ea9f71eb8c53fc

    SHA1

    0b82e7a00dde5829cabcaf1efd08112bac9f8b44

    SHA256

    ad46c59a20d00952a9e3a1769f10cb45ea18e6d59cfdd35f853c3eb6fdbb60c5

    SHA512

    b7e9b29fe3c3ebde728d29f7f3e050136a5a47cc48371a1a714b9fb57bb3f59e9c6aab569a1a7a39c0221cd373ff80f17e872246eaa51addfa43264a1bcfb421