Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
320557d8b53...e2.exe
windows7-x64
320557d8b53...e2.exe
windows10-2004-x64
725367c9554...22.exe
windows7-x64
325367c9554...22.exe
windows10-2004-x64
35119c03df1...4d.exe
windows7-x64
105119c03df1...4d.exe
windows10-2004-x64
105434c5c18f...98.exe
windows7-x64
105434c5c18f...98.exe
windows10-2004-x64
106631a01942...f8.exe
windows7-x64
36631a01942...f8.exe
windows10-2004-x64
107992c95955...79.exe
windows7-x64
47992c95955...79.exe
windows10-2004-x64
58452fe5158...32.exe
windows7-x64
78452fe5158...32.exe
windows10-2004-x64
79262fc6203...d6.exe
windows7-x64
109262fc6203...d6.exe
windows10-2004-x64
10Analysis
-
max time kernel
121s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
01/11/2023, 12:36
Static task
static1
Behavioral task
behavioral1
Sample
20557d8b534b624b67bc6c659519d1e2.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
20557d8b534b624b67bc6c659519d1e2.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral3
Sample
25367c955449f48ffc7fd421f8a5f822.exe
Resource
win7-20231020-en
Behavioral task
behavioral4
Sample
25367c955449f48ffc7fd421f8a5f822.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral5
Sample
5119c03df1becd83ce7de22565c5fc4d.exe
Resource
win7-20231020-en
Behavioral task
behavioral6
Sample
5119c03df1becd83ce7de22565c5fc4d.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral7
Sample
5434c5c18f21ddfd15d423d6670b2f98.exe
Resource
win7-20231025-en
Behavioral task
behavioral8
Sample
5434c5c18f21ddfd15d423d6670b2f98.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral9
Sample
6631a01942a28fc0507a84c854310df8.exe
Resource
win7-20231020-en
Behavioral task
behavioral10
Sample
6631a01942a28fc0507a84c854310df8.exe
Resource
win10v2004-20231020-en
Behavioral task
behavioral11
Sample
7992c95955b88441a5ab498bc0364f79.exe
Resource
win7-20231023-en
Behavioral task
behavioral12
Sample
7992c95955b88441a5ab498bc0364f79.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral13
Sample
8452fe515826ab6f43eff16918a40e32.exe
Resource
win7-20231023-en
Behavioral task
behavioral14
Sample
8452fe515826ab6f43eff16918a40e32.exe
Resource
win10v2004-20231025-en
Behavioral task
behavioral15
Sample
9262fc6203bfd7d41fa45e2976e60ad6.exe
Resource
win7-20231023-en
Behavioral task
behavioral16
Sample
9262fc6203bfd7d41fa45e2976e60ad6.exe
Resource
win10v2004-20231020-en
General
-
Target
20557d8b534b624b67bc6c659519d1e2.exe
-
Size
128KB
-
MD5
20557d8b534b624b67bc6c659519d1e2
-
SHA1
721fe4138bf30bb457be01de4fa02effe891db09
-
SHA256
633b04aa2a794fab5b0e23cb77b1d7a2bc2d69b1f2ec258b02317060d5731681
-
SHA512
df630b5b5fde0f6d50e17b5689b13a5c83cd08a6b5e78ced65519bfa976a61463ed6b640b6976ac266b35307cb0a7d44dc4637509e71c5bb984bcc736bb3c83f
-
SSDEEP
768:AggEakQhT9VmoVK/bHUyhDWIKT5Ydf9QuDdwzXik7RNi3CVL:takQhTjT4/b1hDWSUFDTlNpl
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-984744499-3605095035-265325720-1000\Control Panel\International\Geo\Nation 20557d8b534b624b67bc6c659519d1e2.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 1316 5004 WerFault.exe 79 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1416 powershell.exe 1416 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1416 powershell.exe Token: SeDebugPrivilege 5004 20557d8b534b624b67bc6c659519d1e2.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 5004 wrote to memory of 1416 5004 20557d8b534b624b67bc6c659519d1e2.exe 87 PID 5004 wrote to memory of 1416 5004 20557d8b534b624b67bc6c659519d1e2.exe 87 PID 5004 wrote to memory of 1416 5004 20557d8b534b624b67bc6c659519d1e2.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\20557d8b534b624b67bc6c659519d1e2.exe"C:\Users\Admin\AppData\Local\Temp\20557d8b534b624b67bc6c659519d1e2.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AEEAcgB0AC0AUwBsAEUAZQBQACAALQBzACAAMgAwAA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1416
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5004 -s 12282⤵
- Program crash
PID:1316
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 5004 -ip 50041⤵PID:1660
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82