Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
189s -
max time network
237s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
29/11/2022, 10:58
Static task
static1
Behavioral task
behavioral1
Sample
0b34a4b76659650edbbf053adaf59d9e53e9de3e246071cb9a4496bfc98acd59.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
0b34a4b76659650edbbf053adaf59d9e53e9de3e246071cb9a4496bfc98acd59.exe
Resource
win10v2004-20221111-en
General
-
Target
0b34a4b76659650edbbf053adaf59d9e53e9de3e246071cb9a4496bfc98acd59.exe
-
Size
346KB
-
MD5
334830bdb011a8db817049f60da23050
-
SHA1
37f65866f351aff36f83c1809dcb21ce0a92b2fc
-
SHA256
0b34a4b76659650edbbf053adaf59d9e53e9de3e246071cb9a4496bfc98acd59
-
SHA512
34f5d02903508c86951440ed933d8eee9442344aa966b01f128e8a8059dedc60098bf1ccc3927d8cb5388ff8e3967eb80be1ff3da1cf2d93915e9d09b2858a4c
-
SSDEEP
6144:mtlAjZhXij63XlSsrNtFGh1L7o3SbGqJcVTqV3:RZh463XEsxtFGT7o3Swu
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1340 wlgmldg.exe -
Modifies AppInit DLL entries 2 TTPs
-
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\PROGRA~3\Mozilla\wlgmldg.exe 0b34a4b76659650edbbf053adaf59d9e53e9de3e246071cb9a4496bfc98acd59.exe File created C:\PROGRA~3\Mozilla\fkvcmeb.dll wlgmldg.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0b34a4b76659650edbbf053adaf59d9e53e9de3e246071cb9a4496bfc98acd59.exe"C:\Users\Admin\AppData\Local\Temp\0b34a4b76659650edbbf053adaf59d9e53e9de3e246071cb9a4496bfc98acd59.exe"1⤵
- Drops file in Program Files directory
PID:3496
-
C:\PROGRA~3\Mozilla\wlgmldg.exeC:\PROGRA~3\Mozilla\wlgmldg.exe -tefqmxb1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1340
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
346KB
MD5f70eda7168f03868a54dbe1088be7617
SHA1a619d6906907531fb3ab8f8a4f99c134a6dc6c56
SHA256d672c567aa592a0b8ada7d31585994c602bd9cd58275c52e8baa8a477698fbc4
SHA5127118b796cde6b8fba2344b55b71986ef8923fce889b5dd14a6b1abedc86c5b2e6d6d30c4a0e06f80bc3830fda128ba956107e95423cb7281b742825794c207f9
-
Filesize
346KB
MD5f70eda7168f03868a54dbe1088be7617
SHA1a619d6906907531fb3ab8f8a4f99c134a6dc6c56
SHA256d672c567aa592a0b8ada7d31585994c602bd9cd58275c52e8baa8a477698fbc4
SHA5127118b796cde6b8fba2344b55b71986ef8923fce889b5dd14a6b1abedc86c5b2e6d6d30c4a0e06f80bc3830fda128ba956107e95423cb7281b742825794c207f9