Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
25/12/2023, 08:42
Static task
static1
Behavioral task
behavioral1
Sample
12bc0b139f9551db690e45e42949ebec.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
12bc0b139f9551db690e45e42949ebec.exe
Resource
win10v2004-20231215-en
General
-
Target
12bc0b139f9551db690e45e42949ebec.exe
-
Size
110KB
-
MD5
12bc0b139f9551db690e45e42949ebec
-
SHA1
070467f60f6ec9ac1a7ef67826750bbc07d3abdf
-
SHA256
43f69e87dcb0f5320fa280d274ac2bb7a0141aa17bfad60d5f4cbad437a56154
-
SHA512
90825b94e06da7ae7b7b4fb447721be1ed39a4491949b0915fa07a5a7a921080d4163dbeea78b7662ae64e54e9f3a15e5662ff1b3734542548480430694dd69c
-
SSDEEP
1536:h0LFGxfLR3JaTNjDTJIBTtL9qfEovoWODtaqPhNm1ekqan27MI:hMGh1Ja1q3L9qfHIDbJNvV
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Control Panel\International\Geo\Nation 12bc0b139f9551db690e45e42949ebec.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3592 wrote to memory of 1376 3592 12bc0b139f9551db690e45e42949ebec.exe 99 PID 3592 wrote to memory of 1376 3592 12bc0b139f9551db690e45e42949ebec.exe 99 PID 3592 wrote to memory of 1376 3592 12bc0b139f9551db690e45e42949ebec.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\12bc0b139f9551db690e45e42949ebec.exe"C:\Users\Admin\AppData\Local\Temp\12bc0b139f9551db690e45e42949ebec.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3592 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Fpj..bat" > nul 2> nul2⤵PID:1376
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
210B
MD5be51a5c7eb40d0bb318dbddcb1bcb14e
SHA149387d217e0d5ae8776a5468a8c4b6dad562c63e
SHA2566422487429cb8974e1545d01c52a6e03a08eb32ca8a3527ce6116dbe4574becb
SHA51257f245482a6a113c5c3d3615205035688d92af75c5e952e191589c30052b7c120b925a02042f966adbc02d9ae7e2d35ddc06578b5b2c64ce87b816a021a266c6