Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
54s -
max time network
59s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
13/10/2024, 19:28
Static task
static1
Behavioral task
behavioral1
Sample
4fdfae8e41510f5edd55b0731625b7d440bb4c14b431a66233461bb3b82e3a54.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
4fdfae8e41510f5edd55b0731625b7d440bb4c14b431a66233461bb3b82e3a54.exe
Resource
win10v2004-20241007-en
General
-
Target
4fdfae8e41510f5edd55b0731625b7d440bb4c14b431a66233461bb3b82e3a54.exe
-
Size
2.1MB
-
MD5
c4cf2b734a92cbab21cbf2716bce8718
-
SHA1
5b78ee714675c8b6703abd811908895f5869f56c
-
SHA256
4fdfae8e41510f5edd55b0731625b7d440bb4c14b431a66233461bb3b82e3a54
-
SHA512
d7ce51ec2d5b5ec68a8e334d6e8bfb4a09290d98d457dad33fe4cbc28bced021695eeca0826998582a3c012349d54e8a5708d49a1c6e89a8391e795604f06b06
-
SSDEEP
6144:2BDHmrz4niNy8o3Zp/TWt+g4RQTDUBO8/2vh+ziDV8m56TBac2GuL:wDHmoniNy8L8g4RgoBO8/2vhDX56Te
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation 4fdfae8e41510f5edd55b0731625b7d440bb4c14b431a66233461bb3b82e3a54.exe -
Executes dropped EXE 1 IoCs
pid Process 1152 DBSever0.EXE -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\WDDBSever0.EXE = "\"C:\\Windows\\DBSever0.EXE\" /Auto" DBSever0.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDDBSever0.EXE = "\"C:\\Windows\\DBSever0.EXE\" /Auto" DBSever0.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\WDDBSever0.EXE = "\"C:\\Windows\\DBSever0.EXE\" /Auto" 4fdfae8e41510f5edd55b0731625b7d440bb4c14b431a66233461bb3b82e3a54.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\DBSever0.KInf DBSever0.EXE File opened for modification C:\Windows\DBSever0.EXE 4fdfae8e41510f5edd55b0731625b7d440bb4c14b431a66233461bb3b82e3a54.exe File created C:\Windows\DBSever0.EXE 4fdfae8e41510f5edd55b0731625b7d440bb4c14b431a66233461bb3b82e3a54.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4fdfae8e41510f5edd55b0731625b7d440bb4c14b431a66233461bb3b82e3a54.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DBSever0.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1152 DBSever0.EXE -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1800 wrote to memory of 1152 1800 4fdfae8e41510f5edd55b0731625b7d440bb4c14b431a66233461bb3b82e3a54.exe 85 PID 1800 wrote to memory of 1152 1800 4fdfae8e41510f5edd55b0731625b7d440bb4c14b431a66233461bb3b82e3a54.exe 85 PID 1800 wrote to memory of 1152 1800 4fdfae8e41510f5edd55b0731625b7d440bb4c14b431a66233461bb3b82e3a54.exe 85 PID 1800 wrote to memory of 1052 1800 4fdfae8e41510f5edd55b0731625b7d440bb4c14b431a66233461bb3b82e3a54.exe 87 PID 1800 wrote to memory of 1052 1800 4fdfae8e41510f5edd55b0731625b7d440bb4c14b431a66233461bb3b82e3a54.exe 87 PID 1800 wrote to memory of 1052 1800 4fdfae8e41510f5edd55b0731625b7d440bb4c14b431a66233461bb3b82e3a54.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\4fdfae8e41510f5edd55b0731625b7d440bb4c14b431a66233461bb3b82e3a54.exe"C:\Users\Admin\AppData\Local\Temp\4fdfae8e41510f5edd55b0731625b7d440bb4c14b431a66233461bb3b82e3a54.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Windows\DBSever0.EXEC:\Windows\DBSever0.EXE2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1152
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Temp0.bat" "2⤵
- System Location Discovery: System Language Discovery
PID:1052
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
302B
MD53dcbd93bd284bf5928064f26169d4fee
SHA140833e558bdb53d1da4312be1afa821702275ca3
SHA256b8be94ae63dbfeaa3c90fdffea1cdaaf63fb3637e736da9c871fb07c532700cd
SHA51285f825a5fef070be386bee3c46d8a0b26fe9373e1eb73321bacca63592c6e159214895e2086f773e45f76fc69a3d06ece04ca43c297926a224e4ec9751f69d35
-
Filesize
2.1MB
MD5a713ae13b8a2ea21a0e7a914d660cbbb
SHA1c3e1c803f08a0a12ac8a1b51ee38847438d42de0
SHA256bbcd9b18197cf5c1a56c612208af95ca9bb22320fa1e61b2abac969ef7972ac2
SHA512fa680c76d139871647e57075335c5c686457c5a9314b4cf18756f708a8ef1ffeb17fbd5be36c3689024f9e2c55fa921c76bdbdca48f44f9022a3f64172cea48b