Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
05/07/2023, 17:01
Static task
static1
Behavioral task
behavioral1
Sample
13128e81d01b91exeexeexeex.exe
Resource
win7-20230703-en
Behavioral task
behavioral2
Sample
13128e81d01b91exeexeexeex.exe
Resource
win10v2004-20230703-en
General
-
Target
13128e81d01b91exeexeexeex.exe
-
Size
90KB
-
MD5
13128e81d01b9159396ef64db66c90ce
-
SHA1
bb2d2bb068d707479192a8203acef420d2adf511
-
SHA256
1fa9e3f7957d34e48725e12d8463250a0687099a04b36ef247389efde1fd87d6
-
SHA512
d7e1282c4bf5a69afc1aaa4cd49bdbc485320d64e6a807b8aa3a2a61b5e218ff6bed5fdac93b1b698d48338be30d48791f208a165e85c0ccdd212729f578eb37
-
SSDEEP
1536:V6QFElP6n+gMQMOtEvwDpjQGYQbNcqamvWLmk:V6a+pOtEvwDpjta
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\Control Panel\International\Geo\Nation 13128e81d01b91exeexeexeex.exe -
Executes dropped EXE 1 IoCs
pid Process 3788 asih.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2400 wrote to memory of 3788 2400 13128e81d01b91exeexeexeex.exe 79 PID 2400 wrote to memory of 3788 2400 13128e81d01b91exeexeexeex.exe 79 PID 2400 wrote to memory of 3788 2400 13128e81d01b91exeexeexeex.exe 79
Processes
-
C:\Users\Admin\AppData\Local\Temp\13128e81d01b91exeexeexeex.exe"C:\Users\Admin\AppData\Local\Temp\13128e81d01b91exeexeexeex.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
PID:3788
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
90KB
MD52314850d05ea98874425f23ee4bf07de
SHA13203ff9824b370c462ac4e6d44078b7d03038a95
SHA256f3d904c3073d222aef5095f88cff1b68355a82edfb2f22a72fcb7ebb8d7fa8e1
SHA51235825a587f7c2293e6100c1381d110c52839453ec8f9eb0ed26122adb8d70d8c2ce3a0b70f624b33c3952cd2450eca9db765e8809f0899fd4245ec48cca7a965
-
Filesize
90KB
MD52314850d05ea98874425f23ee4bf07de
SHA13203ff9824b370c462ac4e6d44078b7d03038a95
SHA256f3d904c3073d222aef5095f88cff1b68355a82edfb2f22a72fcb7ebb8d7fa8e1
SHA51235825a587f7c2293e6100c1381d110c52839453ec8f9eb0ed26122adb8d70d8c2ce3a0b70f624b33c3952cd2450eca9db765e8809f0899fd4245ec48cca7a965
-
Filesize
90KB
MD52314850d05ea98874425f23ee4bf07de
SHA13203ff9824b370c462ac4e6d44078b7d03038a95
SHA256f3d904c3073d222aef5095f88cff1b68355a82edfb2f22a72fcb7ebb8d7fa8e1
SHA51235825a587f7c2293e6100c1381d110c52839453ec8f9eb0ed26122adb8d70d8c2ce3a0b70f624b33c3952cd2450eca9db765e8809f0899fd4245ec48cca7a965