Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
27/01/2025, 01:13
Behavioral task
behavioral1
Sample
0321be602a40fb4526ed4c494716043895e02f8bb2c84dae5b62429e4ecec754.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
0321be602a40fb4526ed4c494716043895e02f8bb2c84dae5b62429e4ecec754.exe
Resource
win10v2004-20241007-en
General
-
Target
0321be602a40fb4526ed4c494716043895e02f8bb2c84dae5b62429e4ecec754.exe
-
Size
839KB
-
MD5
f8fbd7b9f090423f8851529e647a64ef
-
SHA1
177dc6e93a4808fa1fb7e1dcd9235ce4559dbc8b
-
SHA256
0321be602a40fb4526ed4c494716043895e02f8bb2c84dae5b62429e4ecec754
-
SHA512
f6b173d1952bf663188c80b8c7c05b4e854d708aa561a4e490cb33840295105c3871121196bec5ad66fdc421d6f4c77e3aaf55e33dda3136dacfac00d0239db9
-
SSDEEP
24576:wFS04YNEMuExDiU6E5R9s8xY/2l/drtnIbt+r5:w34auS+UjfU2TrdIbt+r
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation 0321be602a40fb4526ed4c494716043895e02f8bb2c84dae5b62429e4ecec754.exe -
Executes dropped EXE 1 IoCs
pid Process 4164 AudioDriver.exe -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File created C:\Windows\assembly\Desktop.ini 0321be602a40fb4526ed4c494716043895e02f8bb2c84dae5b62429e4ecec754.exe File opened for modification C:\Windows\assembly\Desktop.ini 0321be602a40fb4526ed4c494716043895e02f8bb2c84dae5b62429e4ecec754.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\assembly 0321be602a40fb4526ed4c494716043895e02f8bb2c84dae5b62429e4ecec754.exe File created C:\Windows\assembly\Desktop.ini 0321be602a40fb4526ed4c494716043895e02f8bb2c84dae5b62429e4ecec754.exe File opened for modification C:\Windows\assembly\Desktop.ini 0321be602a40fb4526ed4c494716043895e02f8bb2c84dae5b62429e4ecec754.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0321be602a40fb4526ed4c494716043895e02f8bb2c84dae5b62429e4ecec754.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AudioDriver.exe -
Suspicious behavior: EnumeratesProcesses 36 IoCs
pid Process 4164 AudioDriver.exe 4164 AudioDriver.exe 4164 AudioDriver.exe 4164 AudioDriver.exe 4164 AudioDriver.exe 4164 AudioDriver.exe 4164 AudioDriver.exe 4164 AudioDriver.exe 4164 AudioDriver.exe 4164 AudioDriver.exe 4164 AudioDriver.exe 4164 AudioDriver.exe 4164 AudioDriver.exe 4164 AudioDriver.exe 4164 AudioDriver.exe 4164 AudioDriver.exe 4164 AudioDriver.exe 4164 AudioDriver.exe 4164 AudioDriver.exe 4164 AudioDriver.exe 4164 AudioDriver.exe 4164 AudioDriver.exe 4164 AudioDriver.exe 4164 AudioDriver.exe 4164 AudioDriver.exe 4164 AudioDriver.exe 4164 AudioDriver.exe 4164 AudioDriver.exe 4164 AudioDriver.exe 4164 AudioDriver.exe 4164 AudioDriver.exe 4164 AudioDriver.exe 4164 AudioDriver.exe 4164 AudioDriver.exe 4164 AudioDriver.exe 4164 AudioDriver.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4164 AudioDriver.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4164 AudioDriver.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 4164 AudioDriver.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3784 wrote to memory of 4164 3784 0321be602a40fb4526ed4c494716043895e02f8bb2c84dae5b62429e4ecec754.exe 83 PID 3784 wrote to memory of 4164 3784 0321be602a40fb4526ed4c494716043895e02f8bb2c84dae5b62429e4ecec754.exe 83 PID 3784 wrote to memory of 4164 3784 0321be602a40fb4526ed4c494716043895e02f8bb2c84dae5b62429e4ecec754.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\0321be602a40fb4526ed4c494716043895e02f8bb2c84dae5b62429e4ecec754.exe"C:\Users\Admin\AppData\Local\Temp\0321be602a40fb4526ed4c494716043895e02f8bb2c84dae5b62429e4ecec754.exe"1⤵
- Checks computer location settings
- Drops desktop.ini file(s)
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3784 -
C:\Users\Admin\AppData\Roaming\Microsoft\Speech\AudioDriver.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Speech\AudioDriver.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4164
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
839KB
MD5f8fbd7b9f090423f8851529e647a64ef
SHA1177dc6e93a4808fa1fb7e1dcd9235ce4559dbc8b
SHA2560321be602a40fb4526ed4c494716043895e02f8bb2c84dae5b62429e4ecec754
SHA512f6b173d1952bf663188c80b8c7c05b4e854d708aa561a4e490cb33840295105c3871121196bec5ad66fdc421d6f4c77e3aaf55e33dda3136dacfac00d0239db9