Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
02/10/2024, 19:10
Static task
static1
Behavioral task
behavioral1
Sample
2acd3a6d4462b06c138bc01646a0f8dfa6b22497dbcb9464537248b3525c38ec.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2acd3a6d4462b06c138bc01646a0f8dfa6b22497dbcb9464537248b3525c38ec.exe
Resource
win10v2004-20240802-en
General
-
Target
2acd3a6d4462b06c138bc01646a0f8dfa6b22497dbcb9464537248b3525c38ec.exe
-
Size
1.1MB
-
MD5
ceaf3c57248cdd15e77faf715fa55687
-
SHA1
d192c30c95787c4fe5b1bb86ffd40e154edf2a14
-
SHA256
2acd3a6d4462b06c138bc01646a0f8dfa6b22497dbcb9464537248b3525c38ec
-
SHA512
df73309fd76a95dad1f24ae8e128b7128b72b706f76189f6b9da3688d6f0a326abc554a5d853ea5b4febc02b8e06128ceb82ab2a2d88e8121ec0ae571bde9dd1
-
SSDEEP
24576:aH0dl8myX9Bg42QoXFkrzkmplSgRDYo0lG4Z8r7Qfbkiu5Q8:acallSllG4ZM7QzMr
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation 2acd3a6d4462b06c138bc01646a0f8dfa6b22497dbcb9464537248b3525c38ec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2acd3a6d4462b06c138bc01646a0f8dfa6b22497dbcb9464537248b3525c38ec.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings 2acd3a6d4462b06c138bc01646a0f8dfa6b22497dbcb9464537248b3525c38ec.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1324 2acd3a6d4462b06c138bc01646a0f8dfa6b22497dbcb9464537248b3525c38ec.exe 1324 2acd3a6d4462b06c138bc01646a0f8dfa6b22497dbcb9464537248b3525c38ec.exe 1324 2acd3a6d4462b06c138bc01646a0f8dfa6b22497dbcb9464537248b3525c38ec.exe 1324 2acd3a6d4462b06c138bc01646a0f8dfa6b22497dbcb9464537248b3525c38ec.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1324 2acd3a6d4462b06c138bc01646a0f8dfa6b22497dbcb9464537248b3525c38ec.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1324 2acd3a6d4462b06c138bc01646a0f8dfa6b22497dbcb9464537248b3525c38ec.exe 1324 2acd3a6d4462b06c138bc01646a0f8dfa6b22497dbcb9464537248b3525c38ec.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1324 wrote to memory of 1764 1324 2acd3a6d4462b06c138bc01646a0f8dfa6b22497dbcb9464537248b3525c38ec.exe 83 PID 1324 wrote to memory of 1764 1324 2acd3a6d4462b06c138bc01646a0f8dfa6b22497dbcb9464537248b3525c38ec.exe 83 PID 1324 wrote to memory of 1764 1324 2acd3a6d4462b06c138bc01646a0f8dfa6b22497dbcb9464537248b3525c38ec.exe 83 PID 1324 wrote to memory of 3696 1324 2acd3a6d4462b06c138bc01646a0f8dfa6b22497dbcb9464537248b3525c38ec.exe 82 PID 1324 wrote to memory of 3696 1324 2acd3a6d4462b06c138bc01646a0f8dfa6b22497dbcb9464537248b3525c38ec.exe 82 PID 1324 wrote to memory of 3696 1324 2acd3a6d4462b06c138bc01646a0f8dfa6b22497dbcb9464537248b3525c38ec.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\2acd3a6d4462b06c138bc01646a0f8dfa6b22497dbcb9464537248b3525c38ec.exe"C:\Users\Admin\AppData\Local\Temp\2acd3a6d4462b06c138bc01646a0f8dfa6b22497dbcb9464537248b3525c38ec.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1324 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"2⤵
- System Location Discovery: System Language Discovery
PID:3696
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"2⤵
- System Location Discovery: System Language Discovery
PID:1764
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
753B
MD5407025e4cebff9399e4b03482253298c
SHA1b4ba7bbbed33d311c62b523d3729f896e299cf69
SHA2561f63b846bff2e877390df62220855d22c9e86f401f3852d1e3d7f99f5acb2b41
SHA512c2369702934102bd960d5d727e54326fdddc7906be87fdd94b57a7a9c98ce9938a2686b5ab61bef5665e812fcbe6b3ce8a00c04c876a8987cea8320bb40acd3f