Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
10/10/2024, 16:44
241010-t82a7s1dmq 710/10/2024, 16:43
241010-t8bqjs1djp 510/10/2024, 16:30
241010-tz1nbazhmp 5Analysis
-
max time kernel
300s -
max time network
297s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-ja -
resource tags
arch:x64arch:x86image:win10v2004-20241007-jalocale:ja-jpos:windows10-2004-x64systemwindows -
submitted
10/10/2024, 16:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
mpclient.exe
Resource
win7-20240903-ja
windows7-x64
8 signatures
300 seconds
Behavioral task
behavioral2
Sample
mpclient.exe
Resource
win10v2004-20241007-ja
windows10-2004-x64
8 signatures
300 seconds
General
-
Target
mpclient.exe
-
Size
186KB
-
MD5
6bd4d7f68924301051c22e8a951aecba
-
SHA1
2ae2a6b863616b61ccb550fc1a145ae025896de1
-
SHA256
9afd12eede0db98a35aba52f53041efa4a2f2a03673672c7ac530830b7152392
-
SHA512
ebf97dcc36413e9c05da1df9d296bd5226f2c5acc86f8592755f10454328ffa90dc9805825ede64f350fade5de9cef73d050aad569b733f914da6aa92740f708
-
SSDEEP
3072:crWzrkggF1yGunZZwFrUhxDR1cAoPF+sq:uCzgF1enfwFrUk
Score
5/10
Malware Config
Signatures
-
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\system32\temp.key dllhost.exe File created C:\Windows\system32\temp.key dllhost.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1780 set thread context of 3396 1780 mpclient.exe 84 PID 1200 set thread context of 4200 1200 svchost.exe 89 PID 4200 set thread context of 3984 4200 svchost.exe 91 -
resource yara_rule behavioral2/memory/1780-1-0x0000000180000000-0x0000000180066000-memory.dmp upx behavioral2/memory/1780-6-0x0000000180000000-0x0000000180066000-memory.dmp upx behavioral2/memory/1780-4-0x0000000180000000-0x0000000180066000-memory.dmp upx behavioral2/memory/1780-7-0x0000000180000000-0x0000000180066000-memory.dmp upx behavioral2/memory/1780-5-0x0000000180000000-0x0000000180066000-memory.dmp upx behavioral2/memory/1780-19-0x0000000180000000-0x0000000180066000-memory.dmp upx behavioral2/memory/3396-17-0x0000000180000000-0x0000000180066000-memory.dmp upx behavioral2/memory/2280-30-0x0000000180000000-0x0000000180066000-memory.dmp upx behavioral2/memory/2280-36-0x0000000180000000-0x0000000180066000-memory.dmp upx behavioral2/memory/1200-44-0x0000000180000000-0x0000000180066000-memory.dmp upx behavioral2/memory/4200-51-0x0000000180000000-0x0000000180066000-memory.dmp upx behavioral2/memory/4200-59-0x0000000180000000-0x0000000180066000-memory.dmp upx behavioral2/memory/3984-66-0x0000000180000000-0x0000000180066000-memory.dmp upx behavioral2/memory/3984-67-0x0000000180000000-0x0000000180066000-memory.dmp upx -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1780 mpclient.exe 1780 mpclient.exe 3396 svchost.exe 3396 svchost.exe 3396 svchost.exe 3396 svchost.exe 2280 mpclient.exe 2280 mpclient.exe 1200 svchost.exe 1200 svchost.exe 4200 svchost.exe 4200 svchost.exe 4200 svchost.exe 4200 svchost.exe 4200 svchost.exe 4200 svchost.exe 3984 dllhost.exe 3984 dllhost.exe 3984 dllhost.exe 3984 dllhost.exe 4200 svchost.exe 4200 svchost.exe 4200 svchost.exe 4200 svchost.exe 4200 svchost.exe 4200 svchost.exe 4200 svchost.exe 4200 svchost.exe 4200 svchost.exe 4200 svchost.exe 4200 svchost.exe 4200 svchost.exe 4200 svchost.exe 4200 svchost.exe 4200 svchost.exe 4200 svchost.exe 4200 svchost.exe 4200 svchost.exe 4200 svchost.exe 4200 svchost.exe 4200 svchost.exe 4200 svchost.exe 4200 svchost.exe 4200 svchost.exe 4200 svchost.exe 4200 svchost.exe 4200 svchost.exe 4200 svchost.exe 4200 svchost.exe 4200 svchost.exe 4200 svchost.exe 4200 svchost.exe 4200 svchost.exe 4200 svchost.exe 4200 svchost.exe 4200 svchost.exe 4200 svchost.exe 4200 svchost.exe 4200 svchost.exe 4200 svchost.exe 4200 svchost.exe 4200 svchost.exe 4200 svchost.exe 4200 svchost.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 3396 svchost.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3396 svchost.exe Token: SeTcbPrivilege 3396 svchost.exe Token: SeDebugPrivilege 3984 dllhost.exe Token: SeTcbPrivilege 3984 dllhost.exe Token: SeDebugPrivilege 3984 dllhost.exe Token: SeTcbPrivilege 3984 dllhost.exe Token: SeDebugPrivilege 3984 dllhost.exe Token: SeTcbPrivilege 3984 dllhost.exe Token: SeDebugPrivilege 3984 dllhost.exe Token: SeTcbPrivilege 3984 dllhost.exe Token: SeDebugPrivilege 3984 dllhost.exe Token: SeTcbPrivilege 3984 dllhost.exe Token: SeDebugPrivilege 3984 dllhost.exe Token: SeTcbPrivilege 3984 dllhost.exe Token: SeDebugPrivilege 3984 dllhost.exe Token: SeTcbPrivilege 3984 dllhost.exe Token: SeDebugPrivilege 3984 dllhost.exe Token: SeTcbPrivilege 3984 dllhost.exe Token: SeDebugPrivilege 3984 dllhost.exe Token: SeTcbPrivilege 3984 dllhost.exe Token: SeDebugPrivilege 3984 dllhost.exe Token: SeTcbPrivilege 3984 dllhost.exe Token: SeDebugPrivilege 3984 dllhost.exe Token: SeTcbPrivilege 3984 dllhost.exe Token: SeDebugPrivilege 3984 dllhost.exe Token: SeTcbPrivilege 3984 dllhost.exe Token: SeDebugPrivilege 3984 dllhost.exe Token: SeTcbPrivilege 3984 dllhost.exe Token: SeDebugPrivilege 3984 dllhost.exe Token: SeTcbPrivilege 3984 dllhost.exe Token: SeDebugPrivilege 3984 dllhost.exe Token: SeTcbPrivilege 3984 dllhost.exe Token: SeDebugPrivilege 3984 dllhost.exe Token: SeTcbPrivilege 3984 dllhost.exe Token: SeDebugPrivilege 3984 dllhost.exe Token: SeTcbPrivilege 3984 dllhost.exe Token: SeDebugPrivilege 3984 dllhost.exe Token: SeTcbPrivilege 3984 dllhost.exe Token: SeDebugPrivilege 3984 dllhost.exe Token: SeTcbPrivilege 3984 dllhost.exe Token: SeDebugPrivilege 3984 dllhost.exe Token: SeTcbPrivilege 3984 dllhost.exe Token: SeDebugPrivilege 3984 dllhost.exe Token: SeTcbPrivilege 3984 dllhost.exe Token: SeDebugPrivilege 3984 dllhost.exe Token: SeTcbPrivilege 3984 dllhost.exe Token: SeDebugPrivilege 3984 dllhost.exe Token: SeTcbPrivilege 3984 dllhost.exe Token: SeDebugPrivilege 3984 dllhost.exe Token: SeTcbPrivilege 3984 dllhost.exe Token: SeDebugPrivilege 3984 dllhost.exe Token: SeTcbPrivilege 3984 dllhost.exe Token: SeDebugPrivilege 3984 dllhost.exe Token: SeTcbPrivilege 3984 dllhost.exe Token: SeDebugPrivilege 3984 dllhost.exe Token: SeTcbPrivilege 3984 dllhost.exe Token: SeDebugPrivilege 3984 dllhost.exe Token: SeTcbPrivilege 3984 dllhost.exe Token: SeDebugPrivilege 3984 dllhost.exe Token: SeTcbPrivilege 3984 dllhost.exe Token: SeDebugPrivilege 3984 dllhost.exe Token: SeTcbPrivilege 3984 dllhost.exe Token: SeDebugPrivilege 3984 dllhost.exe Token: SeTcbPrivilege 3984 dllhost.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 1780 wrote to memory of 3396 1780 mpclient.exe 84 PID 1780 wrote to memory of 3396 1780 mpclient.exe 84 PID 1780 wrote to memory of 3396 1780 mpclient.exe 84 PID 1780 wrote to memory of 3396 1780 mpclient.exe 84 PID 1780 wrote to memory of 3396 1780 mpclient.exe 84 PID 2280 wrote to memory of 1200 2280 mpclient.exe 20 PID 2280 wrote to memory of 1200 2280 mpclient.exe 20 PID 2280 wrote to memory of 1200 2280 mpclient.exe 20 PID 1200 wrote to memory of 4200 1200 svchost.exe 89 PID 1200 wrote to memory of 4200 1200 svchost.exe 89 PID 1200 wrote to memory of 4200 1200 svchost.exe 89 PID 1200 wrote to memory of 4200 1200 svchost.exe 89 PID 1200 wrote to memory of 4200 1200 svchost.exe 89 PID 4200 wrote to memory of 3984 4200 svchost.exe 91 PID 4200 wrote to memory of 3984 4200 svchost.exe 91 PID 4200 wrote to memory of 3984 4200 svchost.exe 91 PID 4200 wrote to memory of 3984 4200 svchost.exe 91 PID 4200 wrote to memory of 3984 4200 svchost.exe 91 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Windows\system32\mpclient.exeC:\Windows\system32\mpclient.exe -svc2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2280
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4200 -
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe /Processid:{F8284233-48F4-4680-ADDD-F8284233}3⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3984
-
-
-
C:\Users\Admin\AppData\Local\Temp\mpclient.exe"C:\Users\Admin\AppData\Local\Temp\mpclient.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -Install2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
PID:3396
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1424
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s fdPHost1⤵PID:1716