Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    142s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/10/2023, 11:36

General

  • Target

    f_000005.exe

  • Size

    28.1MB

  • MD5

    5a1dc98a569ba313aa7648c50de03080

  • SHA1

    92703f921a7cebad394913ea0bd081328562eac9

  • SHA256

    5c652dcddfbaafe80432ebfff155403ecb6879349df1aab9dccd402f2cb5d152

  • SHA512

    972ab49cd6349cb2741dcef01407ee1830c00048c01fd5b17974d6cdb1a744588e11e7ea84c2c02663d8d178dd532a0540e4d2ebfaa1b9505eef9fa46595d8e3

  • SSDEEP

    786432:YLYLjRKbobSHHafY4WI12MvVQkUd293gPLJIz2F9C:QYLjbOeWWvRxclE9

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f_000005.exe
    "C:\Users\Admin\AppData\Local\Temp\f_000005.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:2244
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\SOURCE\st\stoolsinstall.bat" "
      2⤵
        PID:3464

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\SOURCE\st\stoolsinstall.bat

      Filesize

      13KB

      MD5

      6cd1aaf52fa1a74039f5dcadef7025dc

      SHA1

      b7a317099b73cd90d9d38734b419d17f85ad6998

      SHA256

      4e342c8680c505c19772c16a25d469dc5be809cd401591bce15f02b6af98af40

      SHA512

      4349e15279ff87c7dbdca78ffaba81b9c256c09789d364cdec4dbb438fe76dccae69b4850851197a15faea321f11a192c11856eadba7449b995d8af10dcd1eca