Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20230831-en -
resource tags
-
submitted
01/09/2023, 01:51
General
-
Target
Annual Leave and Salary Memo_PDF.exe
-
Size
352KB
-
MD5
5ac38c0411769fc70fde438d5d74ceeb
-
SHA1
4f3619eb37373854bde4f1a3e510e5c525f971c7
-
SHA256
8e06e30fe6a9c4f64a09da567c0a6d2f01b49622f535122736d1dd7177b7f9be
-
SHA512
8d46c0b9fbfe711fcc95cbfe723ec864b1366bcc06cdfd6986126fbc4e2a013a708bface78e3fa023b084abb965cf0a6184f4192f13cc8ec87b28028db886b10
-
SSDEEP
6144:/Ya6evNxhBqtTbVirSLYsL3Y3A/IIHVAg2+C+qpWFtsDUV+ONMI3Uv/rr37FnqTZ:/YIvN/Bqr6szd/IIHuQVFFtscr3Yr02E
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 2 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 62 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Annual Leave and Salary Memo_PDF.exe"C:\Users\Admin\AppData\Local\Temp\Annual Leave and Salary Memo_PDF.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\jjoajzkd.exe"C:\Users\Admin\AppData\Local\Temp\jjoajzkd.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\jjoajzkd.exe"C:\Users\Admin\AppData\Local\Temp\jjoajzkd.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
180KB
MD54e90643c232b2c88ac72958322b873d5
SHA1f040959d3acb90bd547d795a6f582395de08a18f
SHA2568370e38ea115b112132a3ee0290cd489c48ca3ad08d6efbb6a82e845482b0e2b
SHA512a5cd3b41c0f066cfe1b5589b181abdcac46d9b543f413c58a62156e3e01d03c7b6fd8d4abd8e205ebd45ef6560b739b96c74911e13df02fe77c2f1fc13521d66
-
Filesize
180KB
MD54e90643c232b2c88ac72958322b873d5
SHA1f040959d3acb90bd547d795a6f582395de08a18f
SHA2568370e38ea115b112132a3ee0290cd489c48ca3ad08d6efbb6a82e845482b0e2b
SHA512a5cd3b41c0f066cfe1b5589b181abdcac46d9b543f413c58a62156e3e01d03c7b6fd8d4abd8e205ebd45ef6560b739b96c74911e13df02fe77c2f1fc13521d66
-
Filesize
180KB
MD54e90643c232b2c88ac72958322b873d5
SHA1f040959d3acb90bd547d795a6f582395de08a18f
SHA2568370e38ea115b112132a3ee0290cd489c48ca3ad08d6efbb6a82e845482b0e2b
SHA512a5cd3b41c0f066cfe1b5589b181abdcac46d9b543f413c58a62156e3e01d03c7b6fd8d4abd8e205ebd45ef6560b739b96c74911e13df02fe77c2f1fc13521d66
-
Filesize
232KB
MD5ae41c8abe785aa8d353308326f65436e
SHA190d12631494730b8baf70aa397af1a1ae5cf5107
SHA256c07d9c00dd283e9cda0826ea7c620f1a7fe31abf94e2385054b5e6e3e70762be
SHA512f70c65498fee0c9d3e44443e981e01d0f0ae5cfabb158d70718b084e57bc56ec8986dfec540bcaa1aec227e47db1bc8482ef2748a46d2ec897ebe55f0384a1c7
-
Filesize
8KB
-
Filesize
212KB
-
Filesize
3.3MB
-
Filesize
212KB