Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
11/07/2023, 18:00
Behavioral task
behavioral1
Sample
ff93ff6d2407d3exeexeexeex.exe
Resource
win7-20230703-en
Behavioral task
behavioral2
Sample
ff93ff6d2407d3exeexeexeex.exe
Resource
win10v2004-20230703-en
General
-
Target
ff93ff6d2407d3exeexeexeex.exe
-
Size
99KB
-
MD5
ff93ff6d2407d362a6b7ae9993003095
-
SHA1
68360ad60ed8331ff493d16d411a60ba3c753636
-
SHA256
d6308045bef0112144759a5e9a06328bc15050db81327a9fb287f06433e09344
-
SHA512
efcc426dbd215ecb8d89b912abf5a2db6f91fb4fbf125b9331e1903eec667131019ace00e1f077b39582125b8ab8cd925fe917e017b8d5d40a6d126c520cc6dc
-
SSDEEP
1536:qkmnpomddpMOtEvwDpjJGYQbN/PKwNgpQb6KJ:AnBdOOtEvwDpj6zp
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\Control Panel\International\Geo\Nation ff93ff6d2407d3exeexeexeex.exe -
Executes dropped EXE 1 IoCs
pid Process 5112 asih.exe -
resource yara_rule behavioral2/memory/4876-133-0x0000000000500000-0x000000000050F000-memory.dmp upx behavioral2/files/0x000200000001e89e-145.dat upx behavioral2/files/0x000200000001e89e-147.dat upx behavioral2/files/0x000200000001e89e-149.dat upx behavioral2/memory/4876-148-0x0000000000500000-0x000000000050F000-memory.dmp upx behavioral2/memory/5112-157-0x0000000000500000-0x000000000050F000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4876 wrote to memory of 5112 4876 ff93ff6d2407d3exeexeexeex.exe 88 PID 4876 wrote to memory of 5112 4876 ff93ff6d2407d3exeexeexeex.exe 88 PID 4876 wrote to memory of 5112 4876 ff93ff6d2407d3exeexeexeex.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\ff93ff6d2407d3exeexeexeex.exe"C:\Users\Admin\AppData\Local\Temp\ff93ff6d2407d3exeexeexeex.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
PID:5112
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
99KB
MD55cbee2c9cdb466a23ea59852c06ee5d7
SHA1883c9551e5063d49da06af75d052ca14a88165c6
SHA25679ca4adb7b37002c703f379c27005724ab34b87a4aedc58d8f3f345e72090aeb
SHA51287990fd20fb1075d7f0baaa7de6c8f530e986870ca07599024fe366b8e6017fe28f3518a4b11c29d22bfd378de2bf0b40e543a77d07f743d6100509cc4b8d691
-
Filesize
99KB
MD55cbee2c9cdb466a23ea59852c06ee5d7
SHA1883c9551e5063d49da06af75d052ca14a88165c6
SHA25679ca4adb7b37002c703f379c27005724ab34b87a4aedc58d8f3f345e72090aeb
SHA51287990fd20fb1075d7f0baaa7de6c8f530e986870ca07599024fe366b8e6017fe28f3518a4b11c29d22bfd378de2bf0b40e543a77d07f743d6100509cc4b8d691
-
Filesize
99KB
MD55cbee2c9cdb466a23ea59852c06ee5d7
SHA1883c9551e5063d49da06af75d052ca14a88165c6
SHA25679ca4adb7b37002c703f379c27005724ab34b87a4aedc58d8f3f345e72090aeb
SHA51287990fd20fb1075d7f0baaa7de6c8f530e986870ca07599024fe366b8e6017fe28f3518a4b11c29d22bfd378de2bf0b40e543a77d07f743d6100509cc4b8d691