Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    151s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/12/2023, 09:33

General

  • Target

    14965113e96487385b7fb8e92589d53c.exe

  • Size

    240KB

  • MD5

    14965113e96487385b7fb8e92589d53c

  • SHA1

    67ea22147dbdbe345e337f14668ecbfe0a8307ec

  • SHA256

    1e4e8b73abbf3ab007aa94ad571953169d5d5dca375ee67e53660b182e3be7b5

  • SHA512

    c63ea867b2199ff3861a0765e279952b923655c2bcac6bb5d114b8e6bbe6304e5041fd1c1c98213094d6b265d8aaeefa42a31996b80663362cfd1e7d4212551d

  • SSDEEP

    3072:r6JoB8eFF+YupJ904AX+ipuvnHMC6Fz2Pa9VZumXYdVL63fZi8KGc333ygop+:ccFFk/at6PMFKa9VUuYdVL63fZNMF1

Score
10/10

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 52 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\14965113e96487385b7fb8e92589d53c.exe
    "C:\Users\Admin\AppData\Local\Temp\14965113e96487385b7fb8e92589d53c.exe"
    1⤵
    • Modifies visiblity of hidden/system files in Explorer
    • Checks computer location settings
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4460
    • C:\Users\Admin\reakin.exe
      "C:\Users\Admin\reakin.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:4400

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\reakin.exe

    Filesize

    240KB

    MD5

    7394500433b9108c72f8214db642ba05

    SHA1

    21cf1459b96b34c5271e09c257192e3ff7cfcb12

    SHA256

    e5a411912be9e83cad3679d18c2716101f6756077597f89d7dde359621653ae0

    SHA512

    93b14d7e5b65fd38378f9ebfa67cd356af259d8269780a64e4a8c4d9ec88b2dfbacda2d49293cae9407a0588400c88d9bd0bbfa24480eacb00d4045ddfe3646c