Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
04/10/2024, 00:47
Static task
static1
Behavioral task
behavioral1
Sample
66297c92ce06a9b1e207c667662e23942b6250b9551f1c04ea38a4e68a72d5bfN.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
66297c92ce06a9b1e207c667662e23942b6250b9551f1c04ea38a4e68a72d5bfN.exe
Resource
win10v2004-20240802-en
General
-
Target
66297c92ce06a9b1e207c667662e23942b6250b9551f1c04ea38a4e68a72d5bfN.exe
-
Size
64KB
-
MD5
42c800d469acc0e754e6a74d18f826c0
-
SHA1
7daa94f1892068373f456cdcde17164cc17ea975
-
SHA256
66297c92ce06a9b1e207c667662e23942b6250b9551f1c04ea38a4e68a72d5bf
-
SHA512
c8255b5544c182ece395f5519118817664b741819450db1cddf5118c5aa3ff5e379ed44c05066dce08b6d3e0dc0b6fce189492a2c21b05821b9329baebb734c1
-
SSDEEP
1536:lAo0ej2d6rnJwwvlKlIUBP6vghzwYu7vih9GueIh9j2IoHAjU+Eh6IbIKv8H8hvb:lAo1lOwvlKlXBP6vghzwYu7vih9GueI6
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 4404 microsofthelp.exe -
Executes dropped EXE 1 IoCs
pid Process 4404 microsofthelp.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\microsofthelp = "C:\\Windows\\microsofthelp.exe" 66297c92ce06a9b1e207c667662e23942b6250b9551f1c04ea38a4e68a72d5bfN.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\microsofthelp.exe 66297c92ce06a9b1e207c667662e23942b6250b9551f1c04ea38a4e68a72d5bfN.exe File created C:\Windows\HidePlugin.dll microsofthelp.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 66297c92ce06a9b1e207c667662e23942b6250b9551f1c04ea38a4e68a72d5bfN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language microsofthelp.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3352 wrote to memory of 4404 3352 66297c92ce06a9b1e207c667662e23942b6250b9551f1c04ea38a4e68a72d5bfN.exe 82 PID 3352 wrote to memory of 4404 3352 66297c92ce06a9b1e207c667662e23942b6250b9551f1c04ea38a4e68a72d5bfN.exe 82 PID 3352 wrote to memory of 4404 3352 66297c92ce06a9b1e207c667662e23942b6250b9551f1c04ea38a4e68a72d5bfN.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\66297c92ce06a9b1e207c667662e23942b6250b9551f1c04ea38a4e68a72d5bfN.exe"C:\Users\Admin\AppData\Local\Temp\66297c92ce06a9b1e207c667662e23942b6250b9551f1c04ea38a4e68a72d5bfN.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3352 -
C:\Windows\microsofthelp.exe"C:\Windows\microsofthelp.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4404
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD55ef2bb9ddd53ca7f9c1f9d0c486bb511
SHA1bf1b8eeab770cb6418b7340e679bb53612e79b91
SHA2562f26bcf8bddfdbd90a9b69010924aec3eda13467dca91b444cdc901a5c9431c7
SHA51279edc04698378137510cf03287597f0b52a5b528d4df4bdddf27d64867735598275bff423758db68624bb1ce7fa953500f60cee52ba85de310b1430475162953