Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    140s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/07/2023, 13:28

General

  • Target

    e87b077a201b4eexe_JC.exe

  • Size

    43KB

  • MD5

    e87b077a201b4e5d8f6bb23175400d6b

  • SHA1

    fe5b8602f8edb27cdccd1a4f54ce625117bbbefb

  • SHA256

    bb78e2a40246f1093e6b07354b5706af098323b157f2ce6877d26017d122bf77

  • SHA512

    24290d073933af3614bfcbda38c499896b85c26e5fbb88845faa4be193777db447fb3eedbd03d8233da957b4fb9fb80f1140dfce34ec5449accdc64c5840e021

  • SSDEEP

    768:X6LsoEEeegiZPvEhHSG+gp/QtOOtEvwDpjBVajSKm5uzOHxuliou7:X6QFElP6n+gJQMOtEvwDpjBcSKm5upG7

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e87b077a201b4eexe_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\e87b077a201b4eexe_JC.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:220
    • C:\Users\Admin\AppData\Local\Temp\asih.exe
      "C:\Users\Admin\AppData\Local\Temp\asih.exe"
      2⤵
      • Executes dropped EXE
      PID:4476

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\asih.exe

    Filesize

    43KB

    MD5

    d28589e4e907e8dc3eff2c767dc5bb88

    SHA1

    6851aad585193ff9e1b0b4a1efbba6191f35b71e

    SHA256

    b8ba8edbefdcf474d01d1cd8363623392c4ef26a32020bd406687754b9ed8c04

    SHA512

    72a9f0b4b5581c6c91f0cb811a6100999e6196b047db5ce69043da9ddaf139a41c7243204d662b7836e198d96450eea44e1d3858f81627c14d5270fab2109067

  • C:\Users\Admin\AppData\Local\Temp\asih.exe

    Filesize

    43KB

    MD5

    d28589e4e907e8dc3eff2c767dc5bb88

    SHA1

    6851aad585193ff9e1b0b4a1efbba6191f35b71e

    SHA256

    b8ba8edbefdcf474d01d1cd8363623392c4ef26a32020bd406687754b9ed8c04

    SHA512

    72a9f0b4b5581c6c91f0cb811a6100999e6196b047db5ce69043da9ddaf139a41c7243204d662b7836e198d96450eea44e1d3858f81627c14d5270fab2109067

  • C:\Users\Admin\AppData\Local\Temp\asih.exe

    Filesize

    43KB

    MD5

    d28589e4e907e8dc3eff2c767dc5bb88

    SHA1

    6851aad585193ff9e1b0b4a1efbba6191f35b71e

    SHA256

    b8ba8edbefdcf474d01d1cd8363623392c4ef26a32020bd406687754b9ed8c04

    SHA512

    72a9f0b4b5581c6c91f0cb811a6100999e6196b047db5ce69043da9ddaf139a41c7243204d662b7836e198d96450eea44e1d3858f81627c14d5270fab2109067

  • memory/220-133-0x0000000000620000-0x0000000000626000-memory.dmp

    Filesize

    24KB

  • memory/220-134-0x0000000000620000-0x0000000000626000-memory.dmp

    Filesize

    24KB

  • memory/220-135-0x0000000000750000-0x0000000000756000-memory.dmp

    Filesize

    24KB

  • memory/4476-150-0x00000000020F0000-0x00000000020F6000-memory.dmp

    Filesize

    24KB