Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
25/12/2023, 06:45
General
-
Target
0c8b07e62777ce16587245855942bae8.exe
-
Size
144KB
-
MD5
0c8b07e62777ce16587245855942bae8
-
SHA1
3cf8b7b1a355ce495368d55f3019a3db41c709fe
-
SHA256
c21a3c61209d1cf0a29345ef04ebed09104227f9d8e4e45aef32879608b4f186
-
SHA512
5de24ac9ad5b35bfa05b249d6ce55967fd10b60638167b896170f473353f4f943346ad83ee92e9663b6d5fe4d3ba5e4b214e8458e50046d39116034f7c7f2d95
-
SSDEEP
3072:EArud5mUWr4Ux07unBSXBKBl4VsSXBKBlnxnMLFLZ8CgiAE:EUdUWr460Bi6s0Bi2QCgvE
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Drops startup file 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies registry class 1 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious use of SetWindowsHookEx 8 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0c8b07e62777ce16587245855942bae8.exe"C:\Users\Admin\AppData\Local\Temp\0c8b07e62777ce16587245855942bae8.exe"1⤵
- Checks computer location settings
- Drops startup file
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\0c8b07e62777ce16587245855942bae8.exe~~.doc" /o ""2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
20KB
MD5d37c7a7c5cbda96e1a7f3029e34c07a2
SHA1b32a4ef61fc09b2176724c6754302b3dd4f0af05
SHA25638d7c0bda1de1cbdda9c2a9a7f782cb0768256516afd9468b02a71d104f46834
SHA512d4c33e95ec63d2da44a6f1b4b7b8cb2cf7fe872075507a9ea097cd33f910dcd50de34a3dc1a3f8a913755dc47f3f318757ea6be73af4b35a4bf606aaaaac10b7
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
Filesize
124KB
MD5fa98abf47c17f19f7d26b37ad009dfe0
SHA14abdab0e9d01fea98a887930d2a8956b89d7a53f
SHA256a1382ecab718e105b944b676a0148ba212c40798bd915c9a74ee9ea594261bda
SHA5123b2286ae1abe64b31889ff2f6498265c958622d3ada7df83779c7f531a4bcc6cdbdbfd115dacffcecd9e33c6fa5537fa4b3e92b0c9c29e8aae38135d53eb4c11
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
144KB