Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    139s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/10/2023, 19:37

General

  • Target

    4ef4bb360805a70541e40eb802d59b40_exe32.exe

  • Size

    9KB

  • MD5

    4ef4bb360805a70541e40eb802d59b40

  • SHA1

    bc9935d3a5c7497a1fab8b2b18d21e5da5931f8e

  • SHA256

    f499faab313a256c2a684913fc0cade15ad8efd61b99b87114d2af2c51667415

  • SHA512

    5221056d382179b0fa61b517070401344bd865e28272e88a1a26d7a80c472948e5d053e0e6b4bbe4c5b8e1822ed4e150b9171967e706c0a15adb9c5bfb251f0d

  • SSDEEP

    192:HLCUdKBYJsw4t4UjdBr8lk2wgHveFaNJhLkwcud2DH9VwGfct85ySkpV:HRKqdUhBP2wPaNJawcudoD7UIySQV

Score
7/10
upx

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4ef4bb360805a70541e40eb802d59b40_exe32.exe
    "C:\Users\Admin\AppData\Local\Temp\4ef4bb360805a70541e40eb802d59b40_exe32.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:3960
    • C:\Users\Admin\AppData\Local\Temp\DE4A.tmp\b2e.exe
      "C:\Users\Admin\AppData\Local\Temp\DE4A.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\DE4A.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\4ef4bb360805a70541e40eb802d59b40_exe32.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:2340
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\E2CE.tmp\batfile.bat" "
        3⤵
          PID:5016
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\selfdel0.bat" "
          3⤵
            PID:2764

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\DE4A.tmp\b2e.exe

        Filesize

        8KB

        MD5

        b861226487012dd40e26ace365812e80

        SHA1

        f7e362ffe7180435063edca4fc12ef161b81794f

        SHA256

        7caac5dd211cad7e695689349b79004b4987f60d5806c220f3295be2647c7c85

        SHA512

        be1df54852ba6cf859bc573f94ac2134fdca5137c998409130fb0fc6c610188121278df29aceaed01dc5b1332daf52aa56200f44505b4b987344a497aa59102e

      • C:\Users\Admin\AppData\Local\Temp\DE4A.tmp\b2e.exe

        Filesize

        8KB

        MD5

        b861226487012dd40e26ace365812e80

        SHA1

        f7e362ffe7180435063edca4fc12ef161b81794f

        SHA256

        7caac5dd211cad7e695689349b79004b4987f60d5806c220f3295be2647c7c85

        SHA512

        be1df54852ba6cf859bc573f94ac2134fdca5137c998409130fb0fc6c610188121278df29aceaed01dc5b1332daf52aa56200f44505b4b987344a497aa59102e

      • C:\Users\Admin\AppData\Local\Temp\DE4A.tmp\b2e.exe

        Filesize

        8KB

        MD5

        b861226487012dd40e26ace365812e80

        SHA1

        f7e362ffe7180435063edca4fc12ef161b81794f

        SHA256

        7caac5dd211cad7e695689349b79004b4987f60d5806c220f3295be2647c7c85

        SHA512

        be1df54852ba6cf859bc573f94ac2134fdca5137c998409130fb0fc6c610188121278df29aceaed01dc5b1332daf52aa56200f44505b4b987344a497aa59102e

      • C:\Users\Admin\AppData\Local\Temp\E2CE.tmp\batfile.bat

        Filesize

        367B

        MD5

        1a74e6f043e5fc8c05e07cc71c0a432f

        SHA1

        733dafe0964816b343e6c992769d61c786cdf7ce

        SHA256

        63117cf2fb22ec54283b1b32d09cd35da32a96bc310c1a14b454c5219cf7a4d2

        SHA512

        00d2bfd3e6bfede107f1aa18dc4b3b851f29438b73b74b11cacf658434af4ef897ebbd64017a3b4e5707cdd50202bb1aa38ce0ffc1986a72ca1f5e26a0ea6f29

      • C:\Users\Admin\AppData\Local\Temp\selfdel0.bat

        Filesize

        158B

        MD5

        f952e8abdc3182016d8efdb869b60741

        SHA1

        6441e3adb9ccad051fd028a7b2b32595588e3894

        SHA256

        1d8d9574b7d356e27224fb1620c29d882d98f25d59c37def2c188ed748c069c2

        SHA512

        0a5dd5c8afe3aa39b157eafcbb0508c7737861a78eed847685234a2997091115645e46ef52489f509fa1e45ef80dfd80a3aa55e3bad7e65aa0b66934ac013f3f

      • memory/2340-8-0x0000000000400000-0x0000000000405000-memory.dmp

        Filesize

        20KB

      • memory/2340-19-0x0000000000400000-0x0000000000405000-memory.dmp

        Filesize

        20KB

      • memory/3960-0-0x0000000000400000-0x000000000040B000-memory.dmp

        Filesize

        44KB

      • memory/3960-11-0x0000000000400000-0x000000000040B000-memory.dmp

        Filesize

        44KB