Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
02/10/2023, 09:20
General
-
Target
0cb5271feef473f4e724496b1bdc31d2b3ae4f3f0458cb3361e56860e8cfd1f3.exe
-
Size
5.4MB
-
MD5
8dcd7b7985f4854663dfa7fdc5319f8f
-
SHA1
190c28ffff971c3ff61b84e665381b4694a68e3d
-
SHA256
0cb5271feef473f4e724496b1bdc31d2b3ae4f3f0458cb3361e56860e8cfd1f3
-
SHA512
328d7f7ed6a0081394052f83368a31e9064cbc9ee43c5fcea36a708a8a61110356b85ca95052ff834a265d97ad8264f8330d7e212ea38e1c9bcdc1e2633674a9
-
SSDEEP
98304:yTIuG9odiQD9JIDIq+YKQyWmQPIDbuxa7y8zdctTBxQDR0dp7rFLOAkGkzdnEVoe:yPG9rcTXbuL8zdctdSCdRrFLOyomFHKu
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SendNotifyMessage 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0cb5271feef473f4e724496b1bdc31d2b3ae4f3f0458cb3361e56860e8cfd1f3.exe"C:\Users\Admin\AppData\Local\Temp\0cb5271feef473f4e724496b1bdc31d2b3ae4f3f0458cb3361e56860e8cfd1f3.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\l2.exe"C:\Users\Admin\AppData\Local\Temp\l2.exe"2⤵
- Executes dropped EXE
-
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
480KB
MD523566916e2f5f164ff752e23d8c61491
SHA15955e26b53e999561a9507444a2997dbdefcb258
SHA256790d9068796714389d82a400d14d26dcb9e6ecdfc6c2b5eba92ebd1a441b10ee
SHA51290b1a91dff7675ddd840e62036af31fe61fb3ac7cddb9e079db6c4293258985052e086883d380a685fb78915d40fc308b896589d7f5e305289f86673a0739c9d
-
Filesize
480KB
MD523566916e2f5f164ff752e23d8c61491
SHA15955e26b53e999561a9507444a2997dbdefcb258
SHA256790d9068796714389d82a400d14d26dcb9e6ecdfc6c2b5eba92ebd1a441b10ee
SHA51290b1a91dff7675ddd840e62036af31fe61fb3ac7cddb9e079db6c4293258985052e086883d380a685fb78915d40fc308b896589d7f5e305289f86673a0739c9d
-
Filesize
480KB
MD523566916e2f5f164ff752e23d8c61491
SHA15955e26b53e999561a9507444a2997dbdefcb258
SHA256790d9068796714389d82a400d14d26dcb9e6ecdfc6c2b5eba92ebd1a441b10ee
SHA51290b1a91dff7675ddd840e62036af31fe61fb3ac7cddb9e079db6c4293258985052e086883d380a685fb78915d40fc308b896589d7f5e305289f86673a0739c9d
-
Filesize
33B
MD533a6417430acf3de0d63ce51ea379446
SHA11edd015375aafbcfb019fbbff2e5f155fdc56bd0
SHA2564fe93a90b2deab9e438b21127815cefebb8c3686c301b0cb110eb8ac18ec403a
SHA5124f1f28fb96463b82403a43cb559b3a8a27d617864995adeb74b34f2d2856e5a9c11c1f562b28a867859cf7f59bf2b303a6434f27474e8d5e3fb9d3b8acb2faa3
-
Filesize
4KB
MD546368866a9bce25c8a7222a2e17e2970
SHA1b4cad29d127fc2e3ea5e3b0e8a18ec21318f9dd3
SHA2567d89246e2d401f172f5ea6bc62aff9fa40add42e5e81182b381d472f61abfdd2
SHA512f7dbe9409d4f75a6dcd8d8722d6cdb653c9cedb74f4fdc2399026422d07ea5c8d74c8dfce2e7056c1665ce67bef4e2a47d4084cac66822511862c2f8d9a62a80
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB