Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    145s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/10/2023, 09:51

General

  • Target

    f170f7d03815cbdc00681d484b53ae2ef5b94327a9648ed4c275ebe9e69e52e6.exe

  • Size

    1.6MB

  • MD5

    de5908828c6a69018bfbce5e747bff06

  • SHA1

    3fde5014a65a97cf4f92359baaf14b43784404fa

  • SHA256

    f170f7d03815cbdc00681d484b53ae2ef5b94327a9648ed4c275ebe9e69e52e6

  • SHA512

    ea03f824d055b88bd58299a5959143ce63ddbd0a4758849d5d3996f145f532edf341b7503d8649fe84dc52e0930ad5e8d1a5a52fd6ae58c1f5b2950520d944ef

  • SSDEEP

    24576:acbD/31EBoewQOEBs3sEvsx1SGJOrv9mftuF5OloiegCVFeYum9Q:acbz6481x1SxE0UlkJQ5

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f170f7d03815cbdc00681d484b53ae2ef5b94327a9648ed4c275ebe9e69e52e6.exe
    "C:\Users\Admin\AppData\Local\Temp\f170f7d03815cbdc00681d484b53ae2ef5b94327a9648ed4c275ebe9e69e52e6.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1840
    • C:\Windows\SysWOW64\regsvr32.exe
      "C:\Windows\System32\regsvr32.exe" -S FZJvFQ.X -U
      2⤵
      • Loads dropped DLL
      PID:3588

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\FZJvFQ.X

    Filesize

    1.4MB

    MD5

    38b0fea6d7290917b4b87e351476db16

    SHA1

    a312b384f25dbe7120358e57b382dd9ed0f1e062

    SHA256

    5b84d664a5891d250d8c075b940f126eb738cd573ecfe39f182841c220c3026a

    SHA512

    9a3dffccbbe985606ec9d67bf52b6c25d9bb03715626962dded5ae84575404c63091e177b9902eeb602b5fc1a7cddc862822ab05d757d875e2fa2792da468a30

  • C:\Users\Admin\AppData\Local\Temp\fzjvFq.X

    Filesize

    1.4MB

    MD5

    38b0fea6d7290917b4b87e351476db16

    SHA1

    a312b384f25dbe7120358e57b382dd9ed0f1e062

    SHA256

    5b84d664a5891d250d8c075b940f126eb738cd573ecfe39f182841c220c3026a

    SHA512

    9a3dffccbbe985606ec9d67bf52b6c25d9bb03715626962dded5ae84575404c63091e177b9902eeb602b5fc1a7cddc862822ab05d757d875e2fa2792da468a30

  • memory/3588-4-0x0000000000950000-0x0000000000956000-memory.dmp

    Filesize

    24KB

  • memory/3588-5-0x0000000010000000-0x0000000010167000-memory.dmp

    Filesize

    1.4MB

  • memory/3588-8-0x00000000024E0000-0x00000000025D7000-memory.dmp

    Filesize

    988KB

  • memory/3588-9-0x00000000025E0000-0x00000000026C0000-memory.dmp

    Filesize

    896KB

  • memory/3588-12-0x00000000025E0000-0x00000000026C0000-memory.dmp

    Filesize

    896KB

  • memory/3588-13-0x00000000025E0000-0x00000000026C0000-memory.dmp

    Filesize

    896KB