Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/12/2023, 08:42

General

  • Target

    12bc0b139f9551db690e45e42949ebec.exe

  • Size

    110KB

  • MD5

    12bc0b139f9551db690e45e42949ebec

  • SHA1

    070467f60f6ec9ac1a7ef67826750bbc07d3abdf

  • SHA256

    43f69e87dcb0f5320fa280d274ac2bb7a0141aa17bfad60d5f4cbad437a56154

  • SHA512

    90825b94e06da7ae7b7b4fb447721be1ed39a4491949b0915fa07a5a7a921080d4163dbeea78b7662ae64e54e9f3a15e5662ff1b3734542548480430694dd69c

  • SSDEEP

    1536:h0LFGxfLR3JaTNjDTJIBTtL9qfEovoWODtaqPhNm1ekqan27MI:hMGh1Ja1q3L9qfHIDbJNvV

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\12bc0b139f9551db690e45e42949ebec.exe
    "C:\Users\Admin\AppData\Local\Temp\12bc0b139f9551db690e45e42949ebec.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:3592
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Fpj..bat" > nul 2> nul
      2⤵
        PID:1376

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\Fpj..bat

      Filesize

      210B

      MD5

      be51a5c7eb40d0bb318dbddcb1bcb14e

      SHA1

      49387d217e0d5ae8776a5468a8c4b6dad562c63e

      SHA256

      6422487429cb8974e1545d01c52a6e03a08eb32ca8a3527ce6116dbe4574becb

      SHA512

      57f245482a6a113c5c3d3615205035688d92af75c5e952e191589c30052b7c120b925a02042f966adbc02d9ae7e2d35ddc06578b5b2c64ce87b816a021a266c6

    • memory/3592-58-0x000000007FC70000-0x000000007FC8C000-memory.dmp

      Filesize

      112KB

    • memory/3592-7-0x00000000041A0000-0x000000000421A000-memory.dmp

      Filesize

      488KB

    • memory/3592-12-0x00000000001D0000-0x00000000001F4000-memory.dmp

      Filesize

      144KB

    • memory/3592-16-0x0000000004270000-0x0000000004284000-memory.dmp

      Filesize

      80KB

    • memory/3592-20-0x0000000074BB0000-0x0000000074C41000-memory.dmp

      Filesize

      580KB

    • memory/3592-24-0x0000000074D40000-0x0000000074D48000-memory.dmp

      Filesize

      32KB

    • memory/3592-26-0x0000000004220000-0x000000000422F000-memory.dmp

      Filesize

      60KB

    • memory/3592-31-0x00000000750F0000-0x00000000751B2000-memory.dmp

      Filesize

      776KB

    • memory/3592-37-0x00000000754E0000-0x00000000754FB000-memory.dmp

      Filesize

      108KB

    • memory/3592-40-0x0000000075F80000-0x0000000076128000-memory.dmp

      Filesize

      1.7MB

    • memory/3592-41-0x0000000074DE0000-0x0000000074DEB000-memory.dmp

      Filesize

      44KB

    • memory/3592-43-0x0000000075A20000-0x0000000075A3D000-memory.dmp

      Filesize

      116KB

    • memory/3592-44-0x000000007F9F0000-0x000000007FA83000-memory.dmp

      Filesize

      588KB

    • memory/3592-47-0x00000000762C0000-0x00000000762E1000-memory.dmp

      Filesize

      132KB

    • memory/3592-51-0x000000007FB70000-0x000000007FBE1000-memory.dmp

      Filesize

      452KB

    • memory/3592-52-0x0000000077050000-0x000000007706F000-memory.dmp

      Filesize

      124KB

    • memory/3592-1-0x0000000000400000-0x000000000041E000-memory.dmp

      Filesize

      120KB

    • memory/3592-54-0x000000007FBF0000-0x000000007FC15000-memory.dmp

      Filesize

      148KB

    • memory/3592-22-0x000000007E700000-0x000000007E92B000-memory.dmp

      Filesize

      2.2MB

    • memory/3592-64-0x0000000076150000-0x000000007615F000-memory.dmp

      Filesize

      60KB

    • memory/3592-63-0x000000007FCF0000-0x000000007FD09000-memory.dmp

      Filesize

      100KB

    • memory/3592-62-0x000000007FCD0000-0x000000007FCE1000-memory.dmp

      Filesize

      68KB

    • memory/3592-61-0x000000007FC90000-0x000000007FCCD000-memory.dmp

      Filesize

      244KB

    • memory/3592-56-0x000000007FC20000-0x000000007FC69000-memory.dmp

      Filesize

      292KB

    • memory/3592-49-0x000000007FA90000-0x000000007FB6B000-memory.dmp

      Filesize

      876KB

    • memory/3592-34-0x00000000759E0000-0x0000000075A1B000-memory.dmp

      Filesize

      236KB

    • memory/3592-33-0x0000000074E10000-0x0000000074E28000-memory.dmp

      Filesize

      96KB

    • memory/3592-29-0x0000000074D50000-0x0000000074DC4000-memory.dmp

      Filesize

      464KB

    • memory/3592-0-0x00000000001A0000-0x00000000001B7000-memory.dmp

      Filesize

      92KB

    • memory/3592-17-0x0000000004290000-0x00000000042A6000-memory.dmp

      Filesize

      88KB

    • memory/3592-14-0x0000000004230000-0x0000000004262000-memory.dmp

      Filesize

      200KB

    • memory/3592-10-0x000000007E0F0000-0x000000007E6F8000-memory.dmp

      Filesize

      6.0MB

    • memory/3592-6-0x0000000000400000-0x000000000041E000-memory.dmp

      Filesize

      120KB

    • memory/3592-5-0x00000000001C0000-0x00000000001CA000-memory.dmp

      Filesize

      40KB

    • memory/3592-4-0x0000000076A10000-0x0000000076E60000-memory.dmp

      Filesize

      4.3MB

    • memory/3592-3-0x0000000000400000-0x000000000041E000-memory.dmp

      Filesize

      120KB