Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
114s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
30/11/2024, 11:48
Static task
static1
Behavioral task
behavioral1
Sample
0edcbeec2a709b41ad03902cb61ed187b63aef02dfc07f2549a10ccbd95f6baeN.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
0edcbeec2a709b41ad03902cb61ed187b63aef02dfc07f2549a10ccbd95f6baeN.exe
Resource
win10v2004-20241007-en
General
-
Target
0edcbeec2a709b41ad03902cb61ed187b63aef02dfc07f2549a10ccbd95f6baeN.exe
-
Size
168KB
-
MD5
a36bf849262e549aac67ec6638fad090
-
SHA1
6289b56969e48e65cb5a11aeaa8eb8a2de1f3194
-
SHA256
0edcbeec2a709b41ad03902cb61ed187b63aef02dfc07f2549a10ccbd95f6bae
-
SHA512
5d3513f101c3906eeffcb4d599989b6e08c6f131c6712ebd495e68e64d81452c84d4d4834e444268814f626f1ba57bb80e4b196824169134d7a6d98915d164db
-
SSDEEP
3072:LHrTUtapRqBxWhwO8pJ8j5ouK9Uq8Rcg2yAXuM9APy0/L6r1+KD60L:rHRAc1OJYoLOq8RAy4uDP5/rc
Malware Config
Extracted
metasploit
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Metasploit family
-
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation 0edcbeec2a709b41ad03902cb61ed187b63aef02dfc07f2549a10ccbd95f6baeN.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation wnpjt3.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation wnpjt3.exe -
Deletes itself 1 IoCs
pid Process 4480 wnpjt3.exe -
Executes dropped EXE 6 IoCs
pid Process 4996 wnpjt3.exe 4480 wnpjt3.exe 3248 wnpjt3.exe 3840 wnpjt3.exe 4512 wnpjt3.exe 4420 wnpjt3.exe -
Maps connected drives based on registry 3 TTPs 8 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnpjt3.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnpjt3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 0edcbeec2a709b41ad03902cb61ed187b63aef02dfc07f2549a10ccbd95f6baeN.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 0edcbeec2a709b41ad03902cb61ed187b63aef02dfc07f2549a10ccbd95f6baeN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnpjt3.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnpjt3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnpjt3.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnpjt3.exe -
Drops file in System32 directory 6 IoCs
description ioc Process File created C:\Windows\SysWOW64\wnpjt3.exe 0edcbeec2a709b41ad03902cb61ed187b63aef02dfc07f2549a10ccbd95f6baeN.exe File opened for modification C:\Windows\SysWOW64\wnpjt3.exe wnpjt3.exe File created C:\Windows\SysWOW64\wnpjt3.exe wnpjt3.exe File opened for modification C:\Windows\SysWOW64\wnpjt3.exe wnpjt3.exe File created C:\Windows\SysWOW64\wnpjt3.exe wnpjt3.exe File opened for modification C:\Windows\SysWOW64\wnpjt3.exe 0edcbeec2a709b41ad03902cb61ed187b63aef02dfc07f2549a10ccbd95f6baeN.exe -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 3492 set thread context of 3124 3492 0edcbeec2a709b41ad03902cb61ed187b63aef02dfc07f2549a10ccbd95f6baeN.exe 82 PID 4996 set thread context of 4480 4996 wnpjt3.exe 93 PID 3248 set thread context of 3840 3248 wnpjt3.exe 96 PID 4512 set thread context of 4420 4512 wnpjt3.exe 98 -
resource yara_rule behavioral2/memory/3124-2-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/3124-4-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/3124-5-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/3124-3-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/3124-42-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/4480-49-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/4480-48-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/4480-50-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/4480-52-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/3840-58-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/3840-57-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/3840-56-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/3840-61-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/3840-63-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/4420-69-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/4420-67-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/4420-68-0x0000000000400000-0x000000000046A000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpjt3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpjt3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpjt3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpjt3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpjt3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0edcbeec2a709b41ad03902cb61ed187b63aef02dfc07f2549a10ccbd95f6baeN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0edcbeec2a709b41ad03902cb61ed187b63aef02dfc07f2549a10ccbd95f6baeN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpjt3.exe -
Modifies registry class 7 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings 0edcbeec2a709b41ad03902cb61ed187b63aef02dfc07f2549a10ccbd95f6baeN.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 0edcbeec2a709b41ad03902cb61ed187b63aef02dfc07f2549a10ccbd95f6baeN.exe Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings wnpjt3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnpjt3.exe Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings wnpjt3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnpjt3.exe Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings wnpjt3.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 3124 0edcbeec2a709b41ad03902cb61ed187b63aef02dfc07f2549a10ccbd95f6baeN.exe 3124 0edcbeec2a709b41ad03902cb61ed187b63aef02dfc07f2549a10ccbd95f6baeN.exe 4480 wnpjt3.exe 4480 wnpjt3.exe 3840 wnpjt3.exe 3840 wnpjt3.exe 4420 wnpjt3.exe 4420 wnpjt3.exe -
Suspicious use of WriteProcessMemory 37 IoCs
description pid Process procid_target PID 3492 wrote to memory of 3124 3492 0edcbeec2a709b41ad03902cb61ed187b63aef02dfc07f2549a10ccbd95f6baeN.exe 82 PID 3492 wrote to memory of 3124 3492 0edcbeec2a709b41ad03902cb61ed187b63aef02dfc07f2549a10ccbd95f6baeN.exe 82 PID 3492 wrote to memory of 3124 3492 0edcbeec2a709b41ad03902cb61ed187b63aef02dfc07f2549a10ccbd95f6baeN.exe 82 PID 3492 wrote to memory of 3124 3492 0edcbeec2a709b41ad03902cb61ed187b63aef02dfc07f2549a10ccbd95f6baeN.exe 82 PID 3492 wrote to memory of 3124 3492 0edcbeec2a709b41ad03902cb61ed187b63aef02dfc07f2549a10ccbd95f6baeN.exe 82 PID 3492 wrote to memory of 3124 3492 0edcbeec2a709b41ad03902cb61ed187b63aef02dfc07f2549a10ccbd95f6baeN.exe 82 PID 3492 wrote to memory of 3124 3492 0edcbeec2a709b41ad03902cb61ed187b63aef02dfc07f2549a10ccbd95f6baeN.exe 82 PID 3124 wrote to memory of 4996 3124 0edcbeec2a709b41ad03902cb61ed187b63aef02dfc07f2549a10ccbd95f6baeN.exe 92 PID 3124 wrote to memory of 4996 3124 0edcbeec2a709b41ad03902cb61ed187b63aef02dfc07f2549a10ccbd95f6baeN.exe 92 PID 3124 wrote to memory of 4996 3124 0edcbeec2a709b41ad03902cb61ed187b63aef02dfc07f2549a10ccbd95f6baeN.exe 92 PID 4996 wrote to memory of 4480 4996 wnpjt3.exe 93 PID 4996 wrote to memory of 4480 4996 wnpjt3.exe 93 PID 4996 wrote to memory of 4480 4996 wnpjt3.exe 93 PID 4996 wrote to memory of 4480 4996 wnpjt3.exe 93 PID 4996 wrote to memory of 4480 4996 wnpjt3.exe 93 PID 4996 wrote to memory of 4480 4996 wnpjt3.exe 93 PID 4996 wrote to memory of 4480 4996 wnpjt3.exe 93 PID 4480 wrote to memory of 3248 4480 wnpjt3.exe 95 PID 4480 wrote to memory of 3248 4480 wnpjt3.exe 95 PID 4480 wrote to memory of 3248 4480 wnpjt3.exe 95 PID 3248 wrote to memory of 3840 3248 wnpjt3.exe 96 PID 3248 wrote to memory of 3840 3248 wnpjt3.exe 96 PID 3248 wrote to memory of 3840 3248 wnpjt3.exe 96 PID 3248 wrote to memory of 3840 3248 wnpjt3.exe 96 PID 3248 wrote to memory of 3840 3248 wnpjt3.exe 96 PID 3248 wrote to memory of 3840 3248 wnpjt3.exe 96 PID 3248 wrote to memory of 3840 3248 wnpjt3.exe 96 PID 3840 wrote to memory of 4512 3840 wnpjt3.exe 97 PID 3840 wrote to memory of 4512 3840 wnpjt3.exe 97 PID 3840 wrote to memory of 4512 3840 wnpjt3.exe 97 PID 4512 wrote to memory of 4420 4512 wnpjt3.exe 98 PID 4512 wrote to memory of 4420 4512 wnpjt3.exe 98 PID 4512 wrote to memory of 4420 4512 wnpjt3.exe 98 PID 4512 wrote to memory of 4420 4512 wnpjt3.exe 98 PID 4512 wrote to memory of 4420 4512 wnpjt3.exe 98 PID 4512 wrote to memory of 4420 4512 wnpjt3.exe 98 PID 4512 wrote to memory of 4420 4512 wnpjt3.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\0edcbeec2a709b41ad03902cb61ed187b63aef02dfc07f2549a10ccbd95f6baeN.exe"C:\Users\Admin\AppData\Local\Temp\0edcbeec2a709b41ad03902cb61ed187b63aef02dfc07f2549a10ccbd95f6baeN.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3492 -
C:\Users\Admin\AppData\Local\Temp\0edcbeec2a709b41ad03902cb61ed187b63aef02dfc07f2549a10ccbd95f6baeN.exe"C:\Users\Admin\AppData\Local\Temp\0edcbeec2a709b41ad03902cb61ed187b63aef02dfc07f2549a10ccbd95f6baeN.exe"2⤵
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3124 -
C:\Windows\SysWOW64\wnpjt3.exe"C:\Windows\system32\wnpjt3.exe" C:\Users\Admin\AppData\Local\Temp\0EDCBE~1.EXE3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Windows\SysWOW64\wnpjt3.exe"C:\Windows\system32\wnpjt3.exe" C:\Users\Admin\AppData\Local\Temp\0EDCBE~1.EXE4⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\Windows\SysWOW64\wnpjt3.exe"C:\Windows\system32\wnpjt3.exe" C:\Windows\SysWOW64\wnpjt3.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\Windows\SysWOW64\wnpjt3.exe"C:\Windows\system32\wnpjt3.exe" C:\Windows\SysWOW64\wnpjt3.exe6⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3840 -
C:\Windows\SysWOW64\wnpjt3.exe"C:\Windows\system32\wnpjt3.exe" C:\Windows\SysWOW64\wnpjt3.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Windows\SysWOW64\wnpjt3.exe"C:\Windows\system32\wnpjt3.exe" C:\Windows\SysWOW64\wnpjt3.exe8⤵
- Executes dropped EXE
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4420
-
-
-
-
-
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2712
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
168KB
MD5a36bf849262e549aac67ec6638fad090
SHA16289b56969e48e65cb5a11aeaa8eb8a2de1f3194
SHA2560edcbeec2a709b41ad03902cb61ed187b63aef02dfc07f2549a10ccbd95f6bae
SHA5125d3513f101c3906eeffcb4d599989b6e08c6f131c6712ebd495e68e64d81452c84d4d4834e444268814f626f1ba57bb80e4b196824169134d7a6d98915d164db