Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    142s
  • max time network
    131s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/12/2023, 17:10

General

  • Target

    2fd9ff8bf1912e92ab31f2055cfdd52e.exe

  • Size

    1.2MB

  • MD5

    2fd9ff8bf1912e92ab31f2055cfdd52e

  • SHA1

    a5688a2e602baf294664f9b6c8162e55d01a1cf3

  • SHA256

    45d49721acf869b16829615db6c6bd9e7209e0b8017d9d1a4bbd2663cbd0c0cf

  • SHA512

    557fefbccbad45d55651f4085f63f6e338607d048c087612eee256dc7623adb911c1bc5a02d4f1fe5777f7b38f350a04a2d356535027bc308af1700c953b8aa9

  • SSDEEP

    6144:Ie34jW7Mq1zQbe9DP3lpr4jAxLY6MaEVagK:uUzQcbRx9+VP

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 7 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

Processes

  • C:\Users\Admin\AppData\Local\Temp\2fd9ff8bf1912e92ab31f2055cfdd52e.exe
    "C:\Users\Admin\AppData\Local\Temp\2fd9ff8bf1912e92ab31f2055cfdd52e.exe"
    1⤵
    • Loads dropped DLL
    PID:4304

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nsm58CF.tmp\LangDLL.dll

    Filesize

    5KB

    MD5

    9384f4007c492d4fa040924f31c00166

    SHA1

    aba37faef30d7c445584c688a0b5638f5db31c7b

    SHA256

    60a964095af1be79f6a99b22212fefe2d16f5a0afd7e707d14394e4143e3f4f5

    SHA512

    68f158887e24302673227adffc688fd3edabf097d7f5410f983e06c6b9c7344ca1d8a45c7fa05553adcc5987993df3a298763477168d4842e554c4eb93b9aaaf

  • memory/4304-24-0x0000000003230000-0x0000000003242000-memory.dmp

    Filesize

    72KB

  • memory/4304-21-0x0000000003230000-0x0000000003242000-memory.dmp

    Filesize

    72KB

  • memory/4304-49-0x0000000003230000-0x0000000003242000-memory.dmp

    Filesize

    72KB

  • memory/4304-48-0x0000000003230000-0x0000000003242000-memory.dmp

    Filesize

    72KB