Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
111s -
max time network
115s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
03/10/2024, 09:40
Static task
static1
Behavioral task
behavioral1
Sample
941d700ac27ab23faab16bd7755e61f58cef0dce2f7ab2539c5dbc469e550df0N.exe
Resource
win7-20240903-en
General
-
Target
941d700ac27ab23faab16bd7755e61f58cef0dce2f7ab2539c5dbc469e550df0N.exe
-
Size
415KB
-
MD5
6d30b8abcb1afe112d465cbc6d426000
-
SHA1
c75f8ea3ef64c12b1941c026e7857a4bae318ff9
-
SHA256
941d700ac27ab23faab16bd7755e61f58cef0dce2f7ab2539c5dbc469e550df0
-
SHA512
d0b7425b48d920e635dbeeada2049587e5de729dbc0938187fb84fedf3659c3f1d49099d50f0c34a2c7582efc11ca063a7705717df40e731468abb487cfc3e1e
-
SSDEEP
6144:ITNE3ZRrnaBVlvphVxmP+6CiejgcME1cwYfU+va+RU7g:ITNYrnE3bm/CiejewY5v3
Malware Config
Extracted
nanocore
1.2.2.0
4af74541-e3f1-469c-8af7-efe4071b81cf
-
activate_away_mode
false
-
backup_connection_host
178.32.224.116
- backup_dns_server
-
buffer_size
65535
-
build_time
2018-07-28T12:59:38.488799236Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
false
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
46218
-
default_group
tourex
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
4af74541-e3f1-469c-8af7-efe4071b81cf
-
mutex_timeout
5000
-
prevent_system_sleep
false
- primary_connection_host
- primary_dns_server
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
true
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2028 ximo2ubzn1i.exe -
Loads dropped DLL 1 IoCs
pid Process 3044 941d700ac27ab23faab16bd7755e61f58cef0dce2f7ab2539c5dbc469e550df0N.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\c5e4gxfvd4v = "C:\\Users\\Admin\\AppData\\Roaming\\c5e4gxfvd4v\\ximo2ubzn1i.exe" 941d700ac27ab23faab16bd7755e61f58cef0dce2f7ab2539c5dbc469e550df0N.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA regasm.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2028 set thread context of 2752 2028 ximo2ubzn1i.exe 32 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 941d700ac27ab23faab16bd7755e61f58cef0dce2f7ab2539c5dbc469e550df0N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ximo2ubzn1i.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regasm.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2752 regasm.exe 2752 regasm.exe 2752 regasm.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2752 regasm.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2752 regasm.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 3044 wrote to memory of 2028 3044 941d700ac27ab23faab16bd7755e61f58cef0dce2f7ab2539c5dbc469e550df0N.exe 31 PID 3044 wrote to memory of 2028 3044 941d700ac27ab23faab16bd7755e61f58cef0dce2f7ab2539c5dbc469e550df0N.exe 31 PID 3044 wrote to memory of 2028 3044 941d700ac27ab23faab16bd7755e61f58cef0dce2f7ab2539c5dbc469e550df0N.exe 31 PID 3044 wrote to memory of 2028 3044 941d700ac27ab23faab16bd7755e61f58cef0dce2f7ab2539c5dbc469e550df0N.exe 31 PID 2028 wrote to memory of 2752 2028 ximo2ubzn1i.exe 32 PID 2028 wrote to memory of 2752 2028 ximo2ubzn1i.exe 32 PID 2028 wrote to memory of 2752 2028 ximo2ubzn1i.exe 32 PID 2028 wrote to memory of 2752 2028 ximo2ubzn1i.exe 32 PID 2028 wrote to memory of 2752 2028 ximo2ubzn1i.exe 32 PID 2028 wrote to memory of 2752 2028 ximo2ubzn1i.exe 32 PID 2028 wrote to memory of 2752 2028 ximo2ubzn1i.exe 32 PID 2028 wrote to memory of 2752 2028 ximo2ubzn1i.exe 32 PID 2028 wrote to memory of 2752 2028 ximo2ubzn1i.exe 32 PID 2028 wrote to memory of 2752 2028 ximo2ubzn1i.exe 32 PID 2028 wrote to memory of 2752 2028 ximo2ubzn1i.exe 32 PID 2028 wrote to memory of 2752 2028 ximo2ubzn1i.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\941d700ac27ab23faab16bd7755e61f58cef0dce2f7ab2539c5dbc469e550df0N.exe"C:\Users\Admin\AppData\Local\Temp\941d700ac27ab23faab16bd7755e61f58cef0dce2f7ab2539c5dbc469e550df0N.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Users\Admin\AppData\Roaming\c5e4gxfvd4v\ximo2ubzn1i.exe"C:\Users\Admin\AppData\Roaming\c5e4gxfvd4v\ximo2ubzn1i.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"3⤵
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2752
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
415KB
MD5c748ab43fd59a8d85f0823bd4f6686d8
SHA1d0103826af3d4af146cce4bdd47c5653cc97d5ef
SHA25649f04913c0ed52722b98033ee3713afc95bcbfe2cf47064c65c364a0e5bf45a9
SHA512c0a352e349e85405a9054b942a04e59ba68bb863bc51e3e1c76c4910c225b42a89a0cc402c6223b7e71e0de164c3de195a6a5c32bb3f85a821223ba6332357b9