Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
19/07/2023, 12:42
Behavioral task
behavioral1
Sample
e3bb7878f1fa5dexe_JC.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
e3bb7878f1fa5dexe_JC.exe
Resource
win10v2004-20230703-en
General
-
Target
e3bb7878f1fa5dexe_JC.exe
-
Size
100KB
-
MD5
e3bb7878f1fa5d523cb3bf7236646973
-
SHA1
f3a5fdb6a608822419b9d8f858c9ae81d7048911
-
SHA256
be25a5e6560c285f795b753a8cbfd0b90c4d543068bb153dc77001bb792b0bc9
-
SHA512
fef715b831bef4b37b967785919850e4a549143037519b49c346f065cb9849ce77eef65cca573b8ccb68dfb42274af132748fd0fd1374889c1c7b5726bfd10c1
-
SSDEEP
1536:P8mnK6QFElP6n+gymddpMOtEvwDpjIHsalRn5iF1j6GCp:1nK6a+qdOOtEvwDpjI
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\Control Panel\International\Geo\Nation e3bb7878f1fa5dexe_JC.exe -
Executes dropped EXE 1 IoCs
pid Process 3780 asih.exe -
resource yara_rule behavioral2/memory/4940-133-0x0000000000500000-0x000000000050F311-memory.dmp upx behavioral2/files/0x0007000000023261-146.dat upx behavioral2/files/0x0007000000023261-148.dat upx behavioral2/files/0x0007000000023261-149.dat upx behavioral2/memory/4940-152-0x0000000000500000-0x000000000050F311-memory.dmp upx behavioral2/memory/3780-159-0x0000000000500000-0x000000000050F311-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4940 wrote to memory of 3780 4940 e3bb7878f1fa5dexe_JC.exe 86 PID 4940 wrote to memory of 3780 4940 e3bb7878f1fa5dexe_JC.exe 86 PID 4940 wrote to memory of 3780 4940 e3bb7878f1fa5dexe_JC.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\e3bb7878f1fa5dexe_JC.exe"C:\Users\Admin\AppData\Local\Temp\e3bb7878f1fa5dexe_JC.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
PID:3780
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
100KB
MD5c2a06632ffa10003619f43d31b6f1da1
SHA1f83654d88eb679a03ed504178ccd07e8ed6dd092
SHA2569b7e4f2b3cb9f1ddeafe83815ff8b93750c415dca6d079053106386447913510
SHA51251eb70673cef270e96e174ad710ffea2b4b731232147faa05b5fa2c9ee934f9402097a465a78ab21d1fbea146e982c02e5d0b0e35a55cc568e5e5307e6571e42
-
Filesize
100KB
MD5c2a06632ffa10003619f43d31b6f1da1
SHA1f83654d88eb679a03ed504178ccd07e8ed6dd092
SHA2569b7e4f2b3cb9f1ddeafe83815ff8b93750c415dca6d079053106386447913510
SHA51251eb70673cef270e96e174ad710ffea2b4b731232147faa05b5fa2c9ee934f9402097a465a78ab21d1fbea146e982c02e5d0b0e35a55cc568e5e5307e6571e42
-
Filesize
100KB
MD5c2a06632ffa10003619f43d31b6f1da1
SHA1f83654d88eb679a03ed504178ccd07e8ed6dd092
SHA2569b7e4f2b3cb9f1ddeafe83815ff8b93750c415dca6d079053106386447913510
SHA51251eb70673cef270e96e174ad710ffea2b4b731232147faa05b5fa2c9ee934f9402097a465a78ab21d1fbea146e982c02e5d0b0e35a55cc568e5e5307e6571e42