Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
08/10/2024, 22:26
Static task
static1
Behavioral task
behavioral1
Sample
799c3104265180e35d502af137c228a149e9da6d4f9649cf3ae894a3ccac420e.exe
Resource
win7-20240704-en
General
-
Target
799c3104265180e35d502af137c228a149e9da6d4f9649cf3ae894a3ccac420e.exe
-
Size
4.9MB
-
MD5
d0c220c08ca42e5aefdbe16182437d16
-
SHA1
58a3e0d4d99126e6dcfa6b447f887a501aac17a2
-
SHA256
799c3104265180e35d502af137c228a149e9da6d4f9649cf3ae894a3ccac420e
-
SHA512
0af321e5d1cd80977dc62a2cafaa5476c1779fc837909a6caef72811045320914d68c8f6fa5e21e396039f9027ffc6ded9b6e67f72f97eb7cd7ff374169d867a
-
SSDEEP
98304:bXsrSs8klHHgshNdkARlbwSvFz23CTEOmmgbQ9+ctpN2LFrVolCNXuKV3EWEUDv9:bXgX8H+kADwIf+JLFrV5+I31vDvXAAM
Malware Config
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 1192 powershell.exe 1192 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation 799c3104265180e35d502af137c228a149e9da6d4f9649cf3ae894a3ccac420e.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 799c3104265180e35d502af137c228a149e9da6d4f9649cf3ae894a3ccac420e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1192 powershell.exe 1192 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1192 powershell.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3484 799c3104265180e35d502af137c228a149e9da6d4f9649cf3ae894a3ccac420e.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 3484 799c3104265180e35d502af137c228a149e9da6d4f9649cf3ae894a3ccac420e.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 3484 799c3104265180e35d502af137c228a149e9da6d4f9649cf3ae894a3ccac420e.exe 3484 799c3104265180e35d502af137c228a149e9da6d4f9649cf3ae894a3ccac420e.exe 3484 799c3104265180e35d502af137c228a149e9da6d4f9649cf3ae894a3ccac420e.exe 3484 799c3104265180e35d502af137c228a149e9da6d4f9649cf3ae894a3ccac420e.exe 3484 799c3104265180e35d502af137c228a149e9da6d4f9649cf3ae894a3ccac420e.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3484 wrote to memory of 1820 3484 799c3104265180e35d502af137c228a149e9da6d4f9649cf3ae894a3ccac420e.exe 85 PID 3484 wrote to memory of 1820 3484 799c3104265180e35d502af137c228a149e9da6d4f9649cf3ae894a3ccac420e.exe 85 PID 3484 wrote to memory of 1820 3484 799c3104265180e35d502af137c228a149e9da6d4f9649cf3ae894a3ccac420e.exe 85 PID 1820 wrote to memory of 1192 1820 cmd.exe 87 PID 1820 wrote to memory of 1192 1820 cmd.exe 87 PID 1820 wrote to memory of 1192 1820 cmd.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\799c3104265180e35d502af137c228a149e9da6d4f9649cf3ae894a3ccac420e.exe"C:\Users\Admin\AppData\Local\Temp\799c3104265180e35d502af137c228a149e9da6d4f9649cf3ae894a3ccac420e.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3484 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1192
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82