Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
161s -
max time network
172s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
02/10/2022, 08:23
Static task
static1
Behavioral task
behavioral1
Sample
b5de6c48d58bceccf4253f63d2710f0cceb4d53e338980979da7dda09e342aff.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
b5de6c48d58bceccf4253f63d2710f0cceb4d53e338980979da7dda09e342aff.exe
Resource
win10v2004-20220812-en
General
-
Target
b5de6c48d58bceccf4253f63d2710f0cceb4d53e338980979da7dda09e342aff.exe
-
Size
314KB
-
MD5
6791dbaa7923dd539b81a95f24afcae0
-
SHA1
22207db4f5223ca47134f3e9bdd2a7f1a6dda9ef
-
SHA256
b5de6c48d58bceccf4253f63d2710f0cceb4d53e338980979da7dda09e342aff
-
SHA512
f7bf5f12edd7e77141138aa96f46bc69f81b9ce79a55feaf62a0450ef49a9a346aeb6338c3c6d870f3ed7b4cb70771dbb16a1fe25614199800b9663600b06ec0
-
SSDEEP
6144:HribUzkuvcBYC47l2xdtqsnixBzO7F3PfLwXZoBxBY27vI6wIkhC900mE:Hr7kuveY3yUFbO+Sb5wIGYN
Malware Config
Signatures
-
Loads dropped DLL 3 IoCs
pid Process 1548 b5de6c48d58bceccf4253f63d2710f0cceb4d53e338980979da7dda09e342aff.exe 1548 b5de6c48d58bceccf4253f63d2710f0cceb4d53e338980979da7dda09e342aff.exe 1548 b5de6c48d58bceccf4253f63d2710f0cceb4d53e338980979da7dda09e342aff.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum b5de6c48d58bceccf4253f63d2710f0cceb4d53e338980979da7dda09e342aff.exe Key value enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum b5de6c48d58bceccf4253f63d2710f0cceb4d53e338980979da7dda09e342aff.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1548 b5de6c48d58bceccf4253f63d2710f0cceb4d53e338980979da7dda09e342aff.exe 1548 b5de6c48d58bceccf4253f63d2710f0cceb4d53e338980979da7dda09e342aff.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b5de6c48d58bceccf4253f63d2710f0cceb4d53e338980979da7dda09e342aff.exe"C:\Users\Admin\AppData\Local\Temp\b5de6c48d58bceccf4253f63d2710f0cceb4d53e338980979da7dda09e342aff.exe"1⤵
- Loads dropped DLL
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
PID:1548
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
269KB
MD5af7ce801c8471c5cd19b366333c153c4
SHA14267749d020a362edbd25434ad65f98b073581f1
SHA256cf7e00ba429bc9f27ccfacc49ae367054f40ada6cede9f513cc29a24e88bf49e
SHA51288655bd940e9b540c4df551fe68135793eceed03f94389b0654637a18b252bf4d3ef73b0c49548b5fa6ba2cf6d9aff79335c4ebcc0b668e008bcc62c40d2a73c
-
Filesize
91KB
MD54df1b4586365a7b76428983d648a6f94
SHA10bdaca035dcd7dbf5ac0b54b064d37248bfbd2d0
SHA2569b0ddd5e0daf3f6d9d47ca296ea92130ada8eb4e09f42189f88a9c00db430df0
SHA512ca9a2119ccf2aacf3844b0e155cfc76f1b5364ab497e5ae1d8a3f7a1e79ef6cab29717d9660265f31f2dd3e696e228666fe10c1ffaa1e8df9ca87a5697b6874f
-
Filesize
173KB
MD519e45bb17f216974e2153587e10bced2
SHA1d9ab41addcdd3faf9edaabef5cc6a0bb6bc4e536
SHA2561fc6ae5a31204d369c4b95d3cb8397b0b7c9e2491288f7745a6192a35518df25
SHA512b1cab64832b14766fa1f311bf07faaa761bc18499bf59384ecbee1ca75b1069ac3557400d1106041ffbadd1257f650afa9ce72f94b2361c4ce8e9022e2b70505