Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
05/07/2023, 16:43
Static task
static1
Behavioral task
behavioral1
Sample
1157d091aefb91exeexeexeex.exe
Resource
win7-20230703-en
Behavioral task
behavioral2
Sample
1157d091aefb91exeexeexeex.exe
Resource
win10v2004-20230703-en
General
-
Target
1157d091aefb91exeexeexeex.exe
-
Size
33KB
-
MD5
1157d091aefb91b88f22377b4834f1c8
-
SHA1
bcd67c78529c66edd2cdb16cbce9f53708c4cc54
-
SHA256
55699571e07e179aea82e918bfec3766f65c288d90473a951883f1a0ff58c34e
-
SHA512
517dfe2014662cd82fa5fdb8036500c19c49802389050f8796829c936e2897a4081392caf50bbb3437b0ba2e9478f04e07c2ce0e7ed47f7c61075018fcebed58
-
SSDEEP
768:q0ZziOWwULueOSdE8tOOtEvwDpjej4AY3xKvVikt/:q0zizzOSxMOtEvwDpjC3IMvVikt/
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\Control Panel\International\Geo\Nation 1157d091aefb91exeexeexeex.exe -
Executes dropped EXE 1 IoCs
pid Process 4908 asih.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1376 wrote to memory of 4908 1376 1157d091aefb91exeexeexeex.exe 79 PID 1376 wrote to memory of 4908 1376 1157d091aefb91exeexeexeex.exe 79 PID 1376 wrote to memory of 4908 1376 1157d091aefb91exeexeexeex.exe 79
Processes
-
C:\Users\Admin\AppData\Local\Temp\1157d091aefb91exeexeexeex.exe"C:\Users\Admin\AppData\Local\Temp\1157d091aefb91exeexeexeex.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
PID:4908
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
33KB
MD5f5157a7377ec355bb73fc161c7de74fc
SHA17f627490d04ce4be12976ee25dc6c1143cef835e
SHA2560464ceb5595c65910372bd1dbc8c25fd23cd5984dd49e230ea1bf06c713f9a08
SHA512e29faea54c9ae1bdea5fe6fc15708a568d0d245c393ec04f55056c0fb43eb58bdc58998bc856c79103668fe4ca0fd3a7cd6af4fbc45dcdf942e54167273e631f
-
Filesize
33KB
MD5f5157a7377ec355bb73fc161c7de74fc
SHA17f627490d04ce4be12976ee25dc6c1143cef835e
SHA2560464ceb5595c65910372bd1dbc8c25fd23cd5984dd49e230ea1bf06c713f9a08
SHA512e29faea54c9ae1bdea5fe6fc15708a568d0d245c393ec04f55056c0fb43eb58bdc58998bc856c79103668fe4ca0fd3a7cd6af4fbc45dcdf942e54167273e631f
-
Filesize
33KB
MD5f5157a7377ec355bb73fc161c7de74fc
SHA17f627490d04ce4be12976ee25dc6c1143cef835e
SHA2560464ceb5595c65910372bd1dbc8c25fd23cd5984dd49e230ea1bf06c713f9a08
SHA512e29faea54c9ae1bdea5fe6fc15708a568d0d245c393ec04f55056c0fb43eb58bdc58998bc856c79103668fe4ca0fd3a7cd6af4fbc45dcdf942e54167273e631f