Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    140s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/07/2023, 20:50

General

  • Target

    5d35e867803700exeexeexeex.exe

  • Size

    55KB

  • MD5

    5d35e8678037005eadf86862c4f58e3b

  • SHA1

    0a015bda5bea42b19b085738418f0a2e653b0059

  • SHA256

    7537d2d83df8cd26afb93fe916f31860c885047ba3ff952d170c0f00554a6f56

  • SHA512

    8602f2d11ca32b11c09a83fa004085c3d0851ffece273e113398ffcdb72453cf0b48ccb56f518bab74c04f5cd31c3ff712798c919c17c92dc4b2da316b965c49

  • SSDEEP

    1536:o1KhxqwtdgI2MyzNORQtOflIwoHNV2XBFV72BOlA7ZszsbKY1xzp0oj67a:aq7tdgI2MyzNORQtOflIwoHNV2XBFV7e

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5d35e867803700exeexeexeex.exe
    "C:\Users\Admin\AppData\Local\Temp\5d35e867803700exeexeexeex.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:2716
    • C:\Users\Admin\AppData\Local\Temp\hurok.exe
      "C:\Users\Admin\AppData\Local\Temp\hurok.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      PID:228

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\hurok.exe

    Filesize

    56KB

    MD5

    25eaa9ee063b1516c787b74ae6987237

    SHA1

    19f159fca8271da8bc5948658ddd1d6700e32332

    SHA256

    874b4784edb610b6d2d2008c7f3b040ca53c2b7ecfef34aa657845cf9c33ada5

    SHA512

    be05796368f90d815fa5584b253e3dfb599e843ea99bcec6cd114733e87d585b37edc4d0fe0377886a30ac0c0c6e8660b9d7d24c79e08de5e7b71da35c3161d1

  • C:\Users\Admin\AppData\Local\Temp\hurok.exe

    Filesize

    56KB

    MD5

    25eaa9ee063b1516c787b74ae6987237

    SHA1

    19f159fca8271da8bc5948658ddd1d6700e32332

    SHA256

    874b4784edb610b6d2d2008c7f3b040ca53c2b7ecfef34aa657845cf9c33ada5

    SHA512

    be05796368f90d815fa5584b253e3dfb599e843ea99bcec6cd114733e87d585b37edc4d0fe0377886a30ac0c0c6e8660b9d7d24c79e08de5e7b71da35c3161d1

  • C:\Users\Admin\AppData\Local\Temp\hurok.exe

    Filesize

    56KB

    MD5

    25eaa9ee063b1516c787b74ae6987237

    SHA1

    19f159fca8271da8bc5948658ddd1d6700e32332

    SHA256

    874b4784edb610b6d2d2008c7f3b040ca53c2b7ecfef34aa657845cf9c33ada5

    SHA512

    be05796368f90d815fa5584b253e3dfb599e843ea99bcec6cd114733e87d585b37edc4d0fe0377886a30ac0c0c6e8660b9d7d24c79e08de5e7b71da35c3161d1

  • memory/2716-133-0x00000000004B0000-0x00000000004B6000-memory.dmp

    Filesize

    24KB

  • memory/2716-134-0x0000000000400000-0x0000000000406000-memory.dmp

    Filesize

    24KB