Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
112s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26/12/2024, 06:14
Static task
static1
Behavioral task
behavioral1
Sample
55e612ab7f9196618deb3800bd208777d09f2b70be814b1d241acef1dc6280ddN.exe
Resource
win7-20240903-en
General
-
Target
55e612ab7f9196618deb3800bd208777d09f2b70be814b1d241acef1dc6280ddN.exe
-
Size
368KB
-
MD5
aca331cef26e80df50aad16106791cf0
-
SHA1
3eb52a5eee4c386e23c31521a886093d0850a020
-
SHA256
55e612ab7f9196618deb3800bd208777d09f2b70be814b1d241acef1dc6280dd
-
SHA512
9eb23a32eb2641cd5d4be9a4704011f37d878d73a0443296f4e62c8db85a6bb770b4bef8b32863a88e1c641108aa05cfb46130fc957933cdea7d2d03f3ec70cc
-
SSDEEP
6144:eo5N5OazOZaTDWlVnrchrahdOxveC2wo80/agxb0zLz4qF:emSuOcHmnYhrDMTrban4qF
Malware Config
Signatures
-
Trickbot family
-
Trickbot x86 loader 5 IoCs
Detected Trickbot's x86 loader that unpacks the x86 payload.
resource yara_rule behavioral2/memory/404-1-0x0000000001200000-0x0000000001229000-memory.dmp trickbot_loader32 behavioral2/memory/404-6-0x0000000001200000-0x0000000001229000-memory.dmp trickbot_loader32 behavioral2/memory/5100-9-0x0000000000F80000-0x0000000000FA9000-memory.dmp trickbot_loader32 behavioral2/memory/5100-24-0x0000000000F80000-0x0000000000FA9000-memory.dmp trickbot_loader32 behavioral2/memory/1808-41-0x0000000001010000-0x0000000001039000-memory.dmp trickbot_loader32 -
Executes dropped EXE 2 IoCs
pid Process 5100 66e712ab8f9197719deb3900bd209888d09f2b80be914b1d241acef1dc7290ddN.exe 1808 66e712ab8f9197719deb3900bd209888d09f2b80be914b1d241acef1dc7290ddN.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 55e612ab7f9196618deb3800bd208777d09f2b70be814b1d241acef1dc6280ddN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 66e712ab8f9197719deb3900bd209888d09f2b80be914b1d241acef1dc7290ddN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 66e712ab8f9197719deb3900bd209888d09f2b80be914b1d241acef1dc7290ddN.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeTcbPrivilege 1808 66e712ab8f9197719deb3900bd209888d09f2b80be914b1d241acef1dc7290ddN.exe -
Suspicious use of WriteProcessMemory 45 IoCs
description pid Process procid_target PID 404 wrote to memory of 5100 404 55e612ab7f9196618deb3800bd208777d09f2b70be814b1d241acef1dc6280ddN.exe 82 PID 404 wrote to memory of 5100 404 55e612ab7f9196618deb3800bd208777d09f2b70be814b1d241acef1dc6280ddN.exe 82 PID 404 wrote to memory of 5100 404 55e612ab7f9196618deb3800bd208777d09f2b70be814b1d241acef1dc6280ddN.exe 82 PID 5100 wrote to memory of 3228 5100 66e712ab8f9197719deb3900bd209888d09f2b80be914b1d241acef1dc7290ddN.exe 83 PID 5100 wrote to memory of 3228 5100 66e712ab8f9197719deb3900bd209888d09f2b80be914b1d241acef1dc7290ddN.exe 83 PID 5100 wrote to memory of 3228 5100 66e712ab8f9197719deb3900bd209888d09f2b80be914b1d241acef1dc7290ddN.exe 83 PID 5100 wrote to memory of 3228 5100 66e712ab8f9197719deb3900bd209888d09f2b80be914b1d241acef1dc7290ddN.exe 83 PID 5100 wrote to memory of 3228 5100 66e712ab8f9197719deb3900bd209888d09f2b80be914b1d241acef1dc7290ddN.exe 83 PID 5100 wrote to memory of 3228 5100 66e712ab8f9197719deb3900bd209888d09f2b80be914b1d241acef1dc7290ddN.exe 83 PID 5100 wrote to memory of 3228 5100 66e712ab8f9197719deb3900bd209888d09f2b80be914b1d241acef1dc7290ddN.exe 83 PID 5100 wrote to memory of 3228 5100 66e712ab8f9197719deb3900bd209888d09f2b80be914b1d241acef1dc7290ddN.exe 83 PID 5100 wrote to memory of 3228 5100 66e712ab8f9197719deb3900bd209888d09f2b80be914b1d241acef1dc7290ddN.exe 83 PID 5100 wrote to memory of 3228 5100 66e712ab8f9197719deb3900bd209888d09f2b80be914b1d241acef1dc7290ddN.exe 83 PID 5100 wrote to memory of 3228 5100 66e712ab8f9197719deb3900bd209888d09f2b80be914b1d241acef1dc7290ddN.exe 83 PID 5100 wrote to memory of 3228 5100 66e712ab8f9197719deb3900bd209888d09f2b80be914b1d241acef1dc7290ddN.exe 83 PID 5100 wrote to memory of 3228 5100 66e712ab8f9197719deb3900bd209888d09f2b80be914b1d241acef1dc7290ddN.exe 83 PID 5100 wrote to memory of 3228 5100 66e712ab8f9197719deb3900bd209888d09f2b80be914b1d241acef1dc7290ddN.exe 83 PID 5100 wrote to memory of 3228 5100 66e712ab8f9197719deb3900bd209888d09f2b80be914b1d241acef1dc7290ddN.exe 83 PID 5100 wrote to memory of 3228 5100 66e712ab8f9197719deb3900bd209888d09f2b80be914b1d241acef1dc7290ddN.exe 83 PID 5100 wrote to memory of 3228 5100 66e712ab8f9197719deb3900bd209888d09f2b80be914b1d241acef1dc7290ddN.exe 83 PID 5100 wrote to memory of 3228 5100 66e712ab8f9197719deb3900bd209888d09f2b80be914b1d241acef1dc7290ddN.exe 83 PID 5100 wrote to memory of 3228 5100 66e712ab8f9197719deb3900bd209888d09f2b80be914b1d241acef1dc7290ddN.exe 83 PID 5100 wrote to memory of 3228 5100 66e712ab8f9197719deb3900bd209888d09f2b80be914b1d241acef1dc7290ddN.exe 83 PID 5100 wrote to memory of 3228 5100 66e712ab8f9197719deb3900bd209888d09f2b80be914b1d241acef1dc7290ddN.exe 83 PID 1808 wrote to memory of 232 1808 66e712ab8f9197719deb3900bd209888d09f2b80be914b1d241acef1dc7290ddN.exe 94 PID 1808 wrote to memory of 232 1808 66e712ab8f9197719deb3900bd209888d09f2b80be914b1d241acef1dc7290ddN.exe 94 PID 1808 wrote to memory of 232 1808 66e712ab8f9197719deb3900bd209888d09f2b80be914b1d241acef1dc7290ddN.exe 94 PID 1808 wrote to memory of 232 1808 66e712ab8f9197719deb3900bd209888d09f2b80be914b1d241acef1dc7290ddN.exe 94 PID 1808 wrote to memory of 232 1808 66e712ab8f9197719deb3900bd209888d09f2b80be914b1d241acef1dc7290ddN.exe 94 PID 1808 wrote to memory of 232 1808 66e712ab8f9197719deb3900bd209888d09f2b80be914b1d241acef1dc7290ddN.exe 94 PID 1808 wrote to memory of 232 1808 66e712ab8f9197719deb3900bd209888d09f2b80be914b1d241acef1dc7290ddN.exe 94 PID 1808 wrote to memory of 232 1808 66e712ab8f9197719deb3900bd209888d09f2b80be914b1d241acef1dc7290ddN.exe 94 PID 1808 wrote to memory of 232 1808 66e712ab8f9197719deb3900bd209888d09f2b80be914b1d241acef1dc7290ddN.exe 94 PID 1808 wrote to memory of 232 1808 66e712ab8f9197719deb3900bd209888d09f2b80be914b1d241acef1dc7290ddN.exe 94 PID 1808 wrote to memory of 232 1808 66e712ab8f9197719deb3900bd209888d09f2b80be914b1d241acef1dc7290ddN.exe 94 PID 1808 wrote to memory of 232 1808 66e712ab8f9197719deb3900bd209888d09f2b80be914b1d241acef1dc7290ddN.exe 94 PID 1808 wrote to memory of 232 1808 66e712ab8f9197719deb3900bd209888d09f2b80be914b1d241acef1dc7290ddN.exe 94 PID 1808 wrote to memory of 232 1808 66e712ab8f9197719deb3900bd209888d09f2b80be914b1d241acef1dc7290ddN.exe 94 PID 1808 wrote to memory of 232 1808 66e712ab8f9197719deb3900bd209888d09f2b80be914b1d241acef1dc7290ddN.exe 94 PID 1808 wrote to memory of 232 1808 66e712ab8f9197719deb3900bd209888d09f2b80be914b1d241acef1dc7290ddN.exe 94 PID 1808 wrote to memory of 232 1808 66e712ab8f9197719deb3900bd209888d09f2b80be914b1d241acef1dc7290ddN.exe 94 PID 1808 wrote to memory of 232 1808 66e712ab8f9197719deb3900bd209888d09f2b80be914b1d241acef1dc7290ddN.exe 94 PID 1808 wrote to memory of 232 1808 66e712ab8f9197719deb3900bd209888d09f2b80be914b1d241acef1dc7290ddN.exe 94 PID 1808 wrote to memory of 232 1808 66e712ab8f9197719deb3900bd209888d09f2b80be914b1d241acef1dc7290ddN.exe 94 PID 1808 wrote to memory of 232 1808 66e712ab8f9197719deb3900bd209888d09f2b80be914b1d241acef1dc7290ddN.exe 94 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\55e612ab7f9196618deb3800bd208777d09f2b70be814b1d241acef1dc6280ddN.exe"C:\Users\Admin\AppData\Local\Temp\55e612ab7f9196618deb3800bd208777d09f2b70be814b1d241acef1dc6280ddN.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:404 -
C:\Users\Admin\AppData\Roaming\WNetval\66e712ab8f9197719deb3900bd209888d09f2b80be914b1d241acef1dc7290ddN.exeC:\Users\Admin\AppData\Roaming\WNetval\66e712ab8f9197719deb3900bd209888d09f2b80be914b1d241acef1dc7290ddN.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵PID:3228
-
-
-
C:\Users\Admin\AppData\Roaming\WNetval\66e712ab8f9197719deb3900bd209888d09f2b80be914b1d241acef1dc7290ddN.exeC:\Users\Admin\AppData\Roaming\WNetval\66e712ab8f9197719deb3900bd209888d09f2b80be914b1d241acef1dc7290ddN.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe2⤵PID:232
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-4089630652-1596403869-279772308-1000\0f5007522459c86e95ffcc62f32308f1_dc5cddf5-9e4b-4c89-ba53-89649a7a5ee7
Filesize1KB
MD5bcc75f6155be383567e3adebc054f7db
SHA159c9f03d42a83544cd933921bdb129ed82cf28f1
SHA256a49d4a7da0be0ef444aa23a7f6073897d2a4ae7d1c8280052cee7bc89fac6ab7
SHA51265fa4347fa4540d70142b9c3f92dca88f8bfcf9d2ba081a773116d8327ee0cd36019b29931dc0e5e4654c845bf6ee7f8bf4c5d95d10f32663549f1fde3f3266a
-
C:\Users\Admin\AppData\Roaming\WNetval\66e712ab8f9197719deb3900bd209888d09f2b80be914b1d241acef1dc7290ddN.exe
Filesize368KB
MD5aca331cef26e80df50aad16106791cf0
SHA13eb52a5eee4c386e23c31521a886093d0850a020
SHA25655e612ab7f9196618deb3800bd208777d09f2b70be814b1d241acef1dc6280dd
SHA5129eb23a32eb2641cd5d4be9a4704011f37d878d73a0443296f4e62c8db85a6bb770b4bef8b32863a88e1c641108aa05cfb46130fc957933cdea7d2d03f3ec70cc