Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/07/2023, 18:27

General

  • Target

    a45a68b38cd498_JC.exe

  • Size

    36KB

  • MD5

    a45a68b38cd498ef2b3ad6a1a9094d4f

  • SHA1

    434c566bd2b3c35faff13c2a28cdf980ad8fe165

  • SHA256

    bd1aa523478dbbdcc571eb1d0b6246c22a0fa56b194a12288424cc6301280343

  • SHA512

    1c1da614b9e2b36ee7e7ac9429d65e64ffee4b43c9127a60eaf67c1622b0967f72187d27d13ce994a32edf8f0b254a05801df97949c5182806ce662d0e749d07

  • SSDEEP

    384:bgX4uGLLQRcsdeQ7/nQu63Ag7YmecFanrlwfjDUkKDfWf6XT+72kmGYjll3:bgX4zYcgTEu6QOaryfjqDlC7rYZl3

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a45a68b38cd498_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\a45a68b38cd498_JC.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:2028
    • C:\Users\Admin\AppData\Local\Temp\hasfj.exe
      "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
      2⤵
      • Executes dropped EXE
      PID:5060

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\hasfj.exe

    Filesize

    36KB

    MD5

    7950c232205173c71a3e5841da59d505

    SHA1

    c750d505efbe011441f59d494ccabff99b9891b5

    SHA256

    87c534b3664f697ee06b9c2ef30db333dafe1a21431e495fc5e366ff4a9224c8

    SHA512

    2831ab42db4bae65ee382c7e90a1d5995a7692c79bfb5b0f9acaf70e526357261d8c86b04cf8c65f0f79678e377b02f7484f92af441b1c50322812eeef38e5ae

  • C:\Users\Admin\AppData\Local\Temp\hasfj.exe

    Filesize

    36KB

    MD5

    7950c232205173c71a3e5841da59d505

    SHA1

    c750d505efbe011441f59d494ccabff99b9891b5

    SHA256

    87c534b3664f697ee06b9c2ef30db333dafe1a21431e495fc5e366ff4a9224c8

    SHA512

    2831ab42db4bae65ee382c7e90a1d5995a7692c79bfb5b0f9acaf70e526357261d8c86b04cf8c65f0f79678e377b02f7484f92af441b1c50322812eeef38e5ae

  • C:\Users\Admin\AppData\Local\Temp\hasfj.exe

    Filesize

    36KB

    MD5

    7950c232205173c71a3e5841da59d505

    SHA1

    c750d505efbe011441f59d494ccabff99b9891b5

    SHA256

    87c534b3664f697ee06b9c2ef30db333dafe1a21431e495fc5e366ff4a9224c8

    SHA512

    2831ab42db4bae65ee382c7e90a1d5995a7692c79bfb5b0f9acaf70e526357261d8c86b04cf8c65f0f79678e377b02f7484f92af441b1c50322812eeef38e5ae

  • memory/2028-133-0x0000000002350000-0x0000000002356000-memory.dmp

    Filesize

    24KB

  • memory/2028-134-0x0000000002350000-0x0000000002356000-memory.dmp

    Filesize

    24KB

  • memory/2028-135-0x0000000002400000-0x0000000002406000-memory.dmp

    Filesize

    24KB

  • memory/5060-150-0x0000000002ED0000-0x0000000002ED6000-memory.dmp

    Filesize

    24KB

  • memory/5060-151-0x0000000002D60000-0x0000000002D66000-memory.dmp

    Filesize

    24KB