Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26/12/2024, 02:09
Behavioral task
behavioral1
Sample
4c4a405e23f317a69e5dd5428ece6902600c6d0a31f29cc5eb3416514a42ce29.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
4c4a405e23f317a69e5dd5428ece6902600c6d0a31f29cc5eb3416514a42ce29.exe
Resource
win10v2004-20241007-en
General
-
Target
4c4a405e23f317a69e5dd5428ece6902600c6d0a31f29cc5eb3416514a42ce29.exe
-
Size
37KB
-
MD5
2f771b3461d8ddc93842c39feca9bc44
-
SHA1
4814441916df2c5ae700ef8b380c25a59d119789
-
SHA256
4c4a405e23f317a69e5dd5428ece6902600c6d0a31f29cc5eb3416514a42ce29
-
SHA512
28efaa86ee085bc9e0e5cafa5afefd2bc028479cc9a4019f9b86ae921bbf658bb2cfa0340a8de99fa2e1dcf71abd6960f3af67c01256f23c92b87cda02b3e06e
-
SSDEEP
384:Rc3Vqi0PJZtbH9KyM+2LzmQnfSsWQLarAF+rMRTyN/0L+EcoinblneHQM3epzXTT:eYJ95M+2L6Q6tQurM+rMRa8NuFRt
Malware Config
Signatures
-
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 1928 netsh.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation 4c4a405e23f317a69e5dd5428ece6902600c6d0a31f29cc5eb3416514a42ce29.exe -
Executes dropped EXE 1 IoCs
pid Process 2660 RuntimeBroker.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4c4a405e23f317a69e5dd5428ece6902600c6d0a31f29cc5eb3416514a42ce29.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RuntimeBroker.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe -
System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 1928 netsh.exe -
Suspicious use of AdjustPrivilegeToken 35 IoCs
description pid Process Token: SeDebugPrivilege 2660 RuntimeBroker.exe Token: 33 2660 RuntimeBroker.exe Token: SeIncBasePriorityPrivilege 2660 RuntimeBroker.exe Token: 33 2660 RuntimeBroker.exe Token: SeIncBasePriorityPrivilege 2660 RuntimeBroker.exe Token: 33 2660 RuntimeBroker.exe Token: SeIncBasePriorityPrivilege 2660 RuntimeBroker.exe Token: 33 2660 RuntimeBroker.exe Token: SeIncBasePriorityPrivilege 2660 RuntimeBroker.exe Token: 33 2660 RuntimeBroker.exe Token: SeIncBasePriorityPrivilege 2660 RuntimeBroker.exe Token: 33 2660 RuntimeBroker.exe Token: SeIncBasePriorityPrivilege 2660 RuntimeBroker.exe Token: 33 2660 RuntimeBroker.exe Token: SeIncBasePriorityPrivilege 2660 RuntimeBroker.exe Token: 33 2660 RuntimeBroker.exe Token: SeIncBasePriorityPrivilege 2660 RuntimeBroker.exe Token: 33 2660 RuntimeBroker.exe Token: SeIncBasePriorityPrivilege 2660 RuntimeBroker.exe Token: 33 2660 RuntimeBroker.exe Token: SeIncBasePriorityPrivilege 2660 RuntimeBroker.exe Token: 33 2660 RuntimeBroker.exe Token: SeIncBasePriorityPrivilege 2660 RuntimeBroker.exe Token: 33 2660 RuntimeBroker.exe Token: SeIncBasePriorityPrivilege 2660 RuntimeBroker.exe Token: 33 2660 RuntimeBroker.exe Token: SeIncBasePriorityPrivilege 2660 RuntimeBroker.exe Token: 33 2660 RuntimeBroker.exe Token: SeIncBasePriorityPrivilege 2660 RuntimeBroker.exe Token: 33 2660 RuntimeBroker.exe Token: SeIncBasePriorityPrivilege 2660 RuntimeBroker.exe Token: 33 2660 RuntimeBroker.exe Token: SeIncBasePriorityPrivilege 2660 RuntimeBroker.exe Token: 33 2660 RuntimeBroker.exe Token: SeIncBasePriorityPrivilege 2660 RuntimeBroker.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4912 wrote to memory of 2660 4912 4c4a405e23f317a69e5dd5428ece6902600c6d0a31f29cc5eb3416514a42ce29.exe 83 PID 4912 wrote to memory of 2660 4912 4c4a405e23f317a69e5dd5428ece6902600c6d0a31f29cc5eb3416514a42ce29.exe 83 PID 4912 wrote to memory of 2660 4912 4c4a405e23f317a69e5dd5428ece6902600c6d0a31f29cc5eb3416514a42ce29.exe 83 PID 2660 wrote to memory of 1928 2660 RuntimeBroker.exe 84 PID 2660 wrote to memory of 1928 2660 RuntimeBroker.exe 84 PID 2660 wrote to memory of 1928 2660 RuntimeBroker.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\4c4a405e23f317a69e5dd5428ece6902600c6d0a31f29cc5eb3416514a42ce29.exe"C:\Users\Admin\AppData\Local\Temp\4c4a405e23f317a69e5dd5428ece6902600c6d0a31f29cc5eb3416514a42ce29.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe" "RuntimeBroker.exe" ENABLE3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
- System Time Discovery
PID:1928
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
37KB
MD52f771b3461d8ddc93842c39feca9bc44
SHA14814441916df2c5ae700ef8b380c25a59d119789
SHA2564c4a405e23f317a69e5dd5428ece6902600c6d0a31f29cc5eb3416514a42ce29
SHA51228efaa86ee085bc9e0e5cafa5afefd2bc028479cc9a4019f9b86ae921bbf658bb2cfa0340a8de99fa2e1dcf71abd6960f3af67c01256f23c92b87cda02b3e06e