Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    138s
  • max time network
    161s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231025-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231025-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/10/2023, 14:01

General

  • Target

    19870f84b02c76f49219510e6cdf6fb8375325a5a3d4f0afbbd8b88cceb9e878.exe

  • Size

    89.5MB

  • MD5

    29b65192dded2499cbfa4da86fff8d63

  • SHA1

    504d4e3a028dfa8b25ace7f7e65e8e50762e2a94

  • SHA256

    19870f84b02c76f49219510e6cdf6fb8375325a5a3d4f0afbbd8b88cceb9e878

  • SHA512

    2e857feef8d67cf5e724f11dd8bbb5d71e8e0d7b6bbb97bfe3390a69a8ec26252489642cb917a97d7476ecad39ea22392fc8374cbf91ae8ed2d7db63a2581d0c

  • SSDEEP

    1572864:GVTlgywHTuSQBem/SSde6JUgdjlROqNnVyizOAkR5TwoDTTwoD5:YTlgBT1jzSLjTOMR6YoDQoD5

Score
7/10
upx

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\19870f84b02c76f49219510e6cdf6fb8375325a5a3d4f0afbbd8b88cceb9e878.exe
    "C:\Users\Admin\AppData\Local\Temp\19870f84b02c76f49219510e6cdf6fb8375325a5a3d4f0afbbd8b88cceb9e878.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4756
    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
      "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:1742194 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\19870f84b02c76f49219510e6cdf6fb8375325a5a3d4f0afbbd8b88cceb9e878.exe" "__IRCT:0" "__IRTSS:0" "__IRSID:S-1-5-21-177160434-2093019976-369403398-1000"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      • Suspicious use of SetWindowsHookEx
      PID:2100

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\SoftPlot10Icon.ico

    Filesize

    52KB

    MD5

    265c5203f435725d63273321e03d77a7

    SHA1

    d56f8561cbce42fb74ba008c799c1266932d3140

    SHA256

    9c4d55555640f2e317ff9f062d79f2f642ea9b17244376e2d921b6f2933c4d3c

    SHA512

    5fb820a25f39edabee24907570ed4e2f6f8a239d3f3747ff87397e5e1421f36737adaeba3f06778c671606ad1231e68838ad613a3f792708372552c4c454f153

  • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

    Filesize

    1.3MB

    MD5

    dec931e86140139380ea0df57cd132b6

    SHA1

    b717fd548382064189c16cb94dda28b1967a5712

    SHA256

    5ffd4b20dccfb84c8890abdb780184a7651e760aefba4ab0c6fba5b2a81f97d9

    SHA512

    14d594e88c4a1f0ec8bc1b4fe2d66e26358f907b1106c047ada35d500ca9e608f1ce5a57599453cf10f11f4d9f1948ced9056ce8bd944b16eca7e9b83e8b27af

  • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

    Filesize

    1.3MB

    MD5

    dec931e86140139380ea0df57cd132b6

    SHA1

    b717fd548382064189c16cb94dda28b1967a5712

    SHA256

    5ffd4b20dccfb84c8890abdb780184a7651e760aefba4ab0c6fba5b2a81f97d9

    SHA512

    14d594e88c4a1f0ec8bc1b4fe2d66e26358f907b1106c047ada35d500ca9e608f1ce5a57599453cf10f11f4d9f1948ced9056ce8bd944b16eca7e9b83e8b27af

  • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

    Filesize

    1.3MB

    MD5

    dec931e86140139380ea0df57cd132b6

    SHA1

    b717fd548382064189c16cb94dda28b1967a5712

    SHA256

    5ffd4b20dccfb84c8890abdb780184a7651e760aefba4ab0c6fba5b2a81f97d9

    SHA512

    14d594e88c4a1f0ec8bc1b4fe2d66e26358f907b1106c047ada35d500ca9e608f1ce5a57599453cf10f11f4d9f1948ced9056ce8bd944b16eca7e9b83e8b27af

  • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll

    Filesize

    318KB

    MD5

    b5fc476c1bf08d5161346cc7dd4cb0ba

    SHA1

    280fac9cf711d93c95f6b80ac97d89cf5853c096

    SHA256

    12cb9b8f59c00ef40ea8f28bfc59a29f12dc28332bf44b1a5d8d6a8823365650

    SHA512

    17fa97f399287b941e958d2d42fe6adb62700b01d9dbe0c824604e8e06d903b330f9d7d8ffb109bfb7f6742f46e7e9cedad6981f0d94d629b8402d0a0174f697

  • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll

    Filesize

    318KB

    MD5

    b5fc476c1bf08d5161346cc7dd4cb0ba

    SHA1

    280fac9cf711d93c95f6b80ac97d89cf5853c096

    SHA256

    12cb9b8f59c00ef40ea8f28bfc59a29f12dc28332bf44b1a5d8d6a8823365650

    SHA512

    17fa97f399287b941e958d2d42fe6adb62700b01d9dbe0c824604e8e06d903b330f9d7d8ffb109bfb7f6742f46e7e9cedad6981f0d94d629b8402d0a0174f697

  • memory/2100-14-0x0000000000400000-0x00000000007CB000-memory.dmp

    Filesize

    3.8MB

  • memory/2100-43-0x0000000000400000-0x00000000007CB000-memory.dmp

    Filesize

    3.8MB