Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
13/10/2024, 23:33
Static task
static1
Behavioral task
behavioral1
Sample
58564ed5d2cae7921f0c415cd09a4e9c54e52f9f33b33acfc2aa015882fb917eN.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
58564ed5d2cae7921f0c415cd09a4e9c54e52f9f33b33acfc2aa015882fb917eN.exe
Resource
win10v2004-20241007-en
General
-
Target
58564ed5d2cae7921f0c415cd09a4e9c54e52f9f33b33acfc2aa015882fb917eN.exe
-
Size
38KB
-
MD5
d7444ea85d230e4a4255d77c157791f0
-
SHA1
8e7cd0f442e90d562b6ec3b92c46bda93b2f0a0b
-
SHA256
58564ed5d2cae7921f0c415cd09a4e9c54e52f9f33b33acfc2aa015882fb917e
-
SHA512
054b27461ae83847ade6438bc7edaa1ffe927e3fba0d53985bd3f9ef1214c3f35c051b60d63afa5e2744c419963a8039095b29a596f127bc48d65e3da5d5ac37
-
SSDEEP
768:DqPJtsA6C1VqahohtgVRNToV7TtRu8rM0wYVFl2g5coW58dO0xXHV2EfKYfdhNhD:DqMA6C1VqaqhtgVRNToV7TtRu8rM0wYj
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1780 microsofthelp.exe -
Executes dropped EXE 1 IoCs
pid Process 1780 microsofthelp.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\microsofthelp = "C:\\Windows\\microsofthelp.exe" 58564ed5d2cae7921f0c415cd09a4e9c54e52f9f33b33acfc2aa015882fb917eN.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\microsofthelp.exe 58564ed5d2cae7921f0c415cd09a4e9c54e52f9f33b33acfc2aa015882fb917eN.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 58564ed5d2cae7921f0c415cd09a4e9c54e52f9f33b33acfc2aa015882fb917eN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language microsofthelp.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4476 wrote to memory of 1780 4476 58564ed5d2cae7921f0c415cd09a4e9c54e52f9f33b33acfc2aa015882fb917eN.exe 83 PID 4476 wrote to memory of 1780 4476 58564ed5d2cae7921f0c415cd09a4e9c54e52f9f33b33acfc2aa015882fb917eN.exe 83 PID 4476 wrote to memory of 1780 4476 58564ed5d2cae7921f0c415cd09a4e9c54e52f9f33b33acfc2aa015882fb917eN.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\58564ed5d2cae7921f0c415cd09a4e9c54e52f9f33b33acfc2aa015882fb917eN.exe"C:\Users\Admin\AppData\Local\Temp\58564ed5d2cae7921f0c415cd09a4e9c54e52f9f33b33acfc2aa015882fb917eN.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\Windows\microsofthelp.exe"C:\Windows\microsofthelp.exe"2⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1780
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
39KB
MD5e6260f8254c9a67aaee805e83b0e2b68
SHA1eaf4fc6ced499ec214a481b08d44233c6fc233f0
SHA25609930764c96f708e28b82481eac2c1f881f35bbb1b80a479eb685fd5372acfe4
SHA512b755b5c5d71dafc93ad8af6a524704deb3168d05287dc9acb147495ee54a494a9352efc89fd6faed5f2300dafbc6ba38184d88ce796030c5307718e44c73f2c3