Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
139s -
max time network
115s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
26/12/2023, 05:05
Static task
static1
Behavioral task
behavioral1
Sample
569335ab90141b8fff29c9f84a5535eb.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
569335ab90141b8fff29c9f84a5535eb.exe
Resource
win10v2004-20231215-en
General
-
Target
569335ab90141b8fff29c9f84a5535eb.exe
-
Size
94KB
-
MD5
569335ab90141b8fff29c9f84a5535eb
-
SHA1
8cc615007cc127d385b55b0360c34549423f86b9
-
SHA256
587e83ddfc378176004ecddc8751733e32776c0567e701402b83e681ed2c290b
-
SHA512
3f90c0feca85815ca2599c671802ba2fbb2a349e404fd0667a90ad871df0facbf134e9085edda9e39e9cd17075ccd65bb5c201c99e14f3aa7bd1ba4acab03645
-
SSDEEP
1536:vfg+M2Y9oH+cpTKeyaI0Z/od8bDbRvU5yYeVYXrgITAGXBB3exYEjpepikFIy:vfgyY9oH+cTKGI0Z/oooeVYXrgI0GXW4
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation 569335ab90141b8fff29c9f84a5535eb.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1564 wrote to memory of 1876 1564 569335ab90141b8fff29c9f84a5535eb.exe 51 PID 1564 wrote to memory of 1876 1564 569335ab90141b8fff29c9f84a5535eb.exe 51 PID 1564 wrote to memory of 1876 1564 569335ab90141b8fff29c9f84a5535eb.exe 51
Processes
-
C:\Users\Admin\AppData\Local\Temp\569335ab90141b8fff29c9f84a5535eb.exe"C:\Users\Admin\AppData\Local\Temp\569335ab90141b8fff29c9f84a5535eb.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Xjz..bat" > nul 2> nul2⤵PID:1876
-