Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
112s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20250113-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20250113-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
18/01/2025, 17:03
Behavioral task
behavioral1
Sample
Payload11.exe
Resource
win10ltsc2021-20250113-en
General
-
Target
Payload11.exe
-
Size
36KB
-
MD5
8b01ebe394a150cceeeff126c468d63d
-
SHA1
0426461755be9784fcfc69a4103b77d7069d4436
-
SHA256
4111f9ff25410257b04574397c758b2aed91523f5d4bc82f3d5e5c5e302c8db0
-
SHA512
5dcfae074d537ff27950cef6029dfffaf6ef0457f7c8af5edc5f95e1377b81cca3fdb2723a5ec0d2f30364adb0f9b54f6b48b854c9d228c2a999203575a933ba
-
SSDEEP
384:ILmBh0yOAUf9p7fAvWSJyP934WaUMNAQk93vmhm7UMKmIEecKdbXTzm9bVhcanhM:2i493UTNA/vMHTi9bDnqn
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3454535599-122122096-1812617400-1000\Control Panel\International\Geo\Nation Payload11.exe -
Drops startup file 4 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.lnk Payload11.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.lnk Payload.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe Payload.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe Payload.exe -
Executes dropped EXE 1 IoCs
pid Process 2724 Payload.exe -
Adds Run key to start application 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3454535599-122122096-1812617400-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows2 = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Windows.URL" Payload.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows2 = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Windows.URL" Payload.exe Set value (str) \REGISTRY\USER\S-1-5-21-3454535599-122122096-1812617400-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Windows.URL" Payload.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Windows.URL" Payload.exe Set value (str) \REGISTRY\USER\S-1-5-21-3454535599-122122096-1812617400-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows2 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Payload.exe" Payload11.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Payload.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Payload11.exe -
Suspicious use of AdjustPrivilegeToken 35 IoCs
description pid Process Token: SeDebugPrivilege 2724 Payload.exe Token: 33 2724 Payload.exe Token: SeIncBasePriorityPrivilege 2724 Payload.exe Token: 33 2724 Payload.exe Token: SeIncBasePriorityPrivilege 2724 Payload.exe Token: 33 2724 Payload.exe Token: SeIncBasePriorityPrivilege 2724 Payload.exe Token: 33 2724 Payload.exe Token: SeIncBasePriorityPrivilege 2724 Payload.exe Token: 33 2724 Payload.exe Token: SeIncBasePriorityPrivilege 2724 Payload.exe Token: 33 2724 Payload.exe Token: SeIncBasePriorityPrivilege 2724 Payload.exe Token: 33 2724 Payload.exe Token: SeIncBasePriorityPrivilege 2724 Payload.exe Token: 33 2724 Payload.exe Token: SeIncBasePriorityPrivilege 2724 Payload.exe Token: 33 2724 Payload.exe Token: SeIncBasePriorityPrivilege 2724 Payload.exe Token: 33 2724 Payload.exe Token: SeIncBasePriorityPrivilege 2724 Payload.exe Token: 33 2724 Payload.exe Token: SeIncBasePriorityPrivilege 2724 Payload.exe Token: 33 2724 Payload.exe Token: SeIncBasePriorityPrivilege 2724 Payload.exe Token: 33 2724 Payload.exe Token: SeIncBasePriorityPrivilege 2724 Payload.exe Token: 33 2724 Payload.exe Token: SeIncBasePriorityPrivilege 2724 Payload.exe Token: 33 2724 Payload.exe Token: SeIncBasePriorityPrivilege 2724 Payload.exe Token: 33 2724 Payload.exe Token: SeIncBasePriorityPrivilege 2724 Payload.exe Token: 33 2724 Payload.exe Token: SeIncBasePriorityPrivilege 2724 Payload.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4756 wrote to memory of 2724 4756 Payload11.exe 82 PID 4756 wrote to memory of 2724 4756 Payload11.exe 82 PID 4756 wrote to memory of 2724 4756 Payload11.exe 82 PID 4756 wrote to memory of 4676 4756 Payload11.exe 83 PID 4756 wrote to memory of 4676 4756 Payload11.exe 83 PID 4756 wrote to memory of 4676 4756 Payload11.exe 83 -
Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 4676 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Payload11.exe"C:\Users\Admin\AppData\Local\Temp\Payload11.exe"1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\Users\Admin\AppData\Local\Temp\Payload.exe"C:\Users\Admin\AppData\Local\Temp\Payload.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2724
-
-
C:\Windows\SysWOW64\attrib.exeattrib +h +r +s "C:\Users\Admin\AppData\Local\Temp\Payload.exe"2⤵
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:4676
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
36KB
MD58b01ebe394a150cceeeff126c468d63d
SHA10426461755be9784fcfc69a4103b77d7069d4436
SHA2564111f9ff25410257b04574397c758b2aed91523f5d4bc82f3d5e5c5e302c8db0
SHA5125dcfae074d537ff27950cef6029dfffaf6ef0457f7c8af5edc5f95e1377b81cca3fdb2723a5ec0d2f30364adb0f9b54f6b48b854c9d228c2a999203575a933ba
-
Filesize
1KB
MD538c2b68a80ceed4a70ef9a0fcc6a5bdd
SHA1251448392d6f9e45bc19a4d734a8b0977094f92a
SHA2564c87d7dc3a4577056b5d7c07654b41fc496289040d631f90db46365ed728352c
SHA5126d60acadfa79426ace1950731b5a4ea4741b9455b310ca4a746f32eb047e22a2ad2e8215948d5e42accf9e5f4ca0055c2f148e3af7cc3afb4b53d320c31348b7
-
Filesize
1KB
MD51f549ad3c6b1a93e8eb3f4f07b524865
SHA1c06c15a9e219ed7bd24fd29c22f401a7b0201c94
SHA256c8a2b498a78cf361a1c44edbe259ac72712ef5c6c566c3fc2d4e6b59e49ad220
SHA512c22cc12a279633bb1404a4702e6be7a1e228af12d777ceed1f424ed58ff1ce8a96471377322f18e26d7d00a0eb9f1d143dd2f5695f6c5ff2b788d38c6085fc2a