Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
24/12/2023, 15:20
Static task
static1
Behavioral task
behavioral1
Sample
0381dbf778e7d4ec51c60a74dea894d7.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
0381dbf778e7d4ec51c60a74dea894d7.exe
Resource
win10v2004-20231215-en
General
-
Target
0381dbf778e7d4ec51c60a74dea894d7.exe
-
Size
257KB
-
MD5
0381dbf778e7d4ec51c60a74dea894d7
-
SHA1
c5f0da8d86dea11f73a8297d3de6a8ec54416812
-
SHA256
219053e376e003a896e4acc7cdb4adcfeac0930d1027873a0e9dc40651631405
-
SHA512
a9fb11d7bfcc2ce643f4919e3b1e8daaddaf993ba4e818db87c36d16052e271abf0a3d4c504f0dcb34dd179a5aa2bd2a6c3843f01df2c6320390822f7ef9274d
-
SSDEEP
6144:L2DG9mI4/MpUOzYfGJcDIg4k0H5CuRbK5QER:Hm4zYfwcIg4kksumQER
Malware Config
Signatures
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum 0381dbf778e7d4ec51c60a74dea894d7.exe Key value enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum 0381dbf778e7d4ec51c60a74dea894d7.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Tasks\ConstellationGuide.job 0381dbf778e7d4ec51c60a74dea894d7.exe