Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20/12/2024, 20:15
Behavioral task
behavioral1
Sample
Payload.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
Payload.exe
Resource
win10v2004-20241007-en
General
-
Target
Payload.exe
-
Size
55KB
-
MD5
0aa0d54c852edc70645d3283c38d4248
-
SHA1
90e62a41ac7f38e8d4cfca9bee412f6f155a2ce5
-
SHA256
3eeedb97ac9a8cc70f5ce4de874670603c11518250ffb3e1e5e9f485b8de640f
-
SHA512
b2994209bdca0f3899470b11374ad674d8f34454406d1b55946fc092543852c60fcafdd2eacde85030953a875da8172c3f6ece0efcbdbda1aea8d0e7267bfbad
-
SSDEEP
1536:kqBLcDnCN6FikSJDOwsNMD2XExI3pmTm:xcDn7MBJDOwsNMD2XExI3pm
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation Payload.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\e564aa028dc627deeaa119b78ed54d5e.exe dllhost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\e564aa028dc627deeaa119b78ed54d5e.exe dllhost.exe -
Executes dropped EXE 1 IoCs
pid Process 3156 dllhost.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\e564aa028dc627deeaa119b78ed54d5e = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\dllhost.exe\" .." dllhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\e564aa028dc627deeaa119b78ed54d5e = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\dllhost.exe\" .." dllhost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Payload.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dllhost.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 4868 cmd.exe 3252 PING.EXE -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 3252 PING.EXE -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 3156 dllhost.exe Token: 33 3156 dllhost.exe Token: SeIncBasePriorityPrivilege 3156 dllhost.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1212 wrote to memory of 3156 1212 Payload.exe 82 PID 1212 wrote to memory of 3156 1212 Payload.exe 82 PID 1212 wrote to memory of 3156 1212 Payload.exe 82 PID 3156 wrote to memory of 228 3156 dllhost.exe 84 PID 3156 wrote to memory of 228 3156 dllhost.exe 84 PID 3156 wrote to memory of 228 3156 dllhost.exe 84 PID 3156 wrote to memory of 4868 3156 dllhost.exe 86 PID 3156 wrote to memory of 4868 3156 dllhost.exe 86 PID 3156 wrote to memory of 4868 3156 dllhost.exe 86 PID 4868 wrote to memory of 3252 4868 cmd.exe 88 PID 4868 wrote to memory of 3252 4868 cmd.exe 88 PID 4868 wrote to memory of 3252 4868 cmd.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\Payload.exe"C:\Users\Admin\AppData\Local\Temp\Payload.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\dllhost.exe"C:\Users\Admin\AppData\Local\Temp\dllhost.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3156 -
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn CleanSweepCheck /f3⤵
- System Location Discovery: System Language Discovery
PID:228
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ping 0 -n 2 & del "C:\Users\Admin\AppData\Local\Temp\dllhost.exe"3⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Windows\SysWOW64\PING.EXEping 0 -n 24⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:3252
-
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
55KB
MD50aa0d54c852edc70645d3283c38d4248
SHA190e62a41ac7f38e8d4cfca9bee412f6f155a2ce5
SHA2563eeedb97ac9a8cc70f5ce4de874670603c11518250ffb3e1e5e9f485b8de640f
SHA512b2994209bdca0f3899470b11374ad674d8f34454406d1b55946fc092543852c60fcafdd2eacde85030953a875da8172c3f6ece0efcbdbda1aea8d0e7267bfbad