Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
152s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
26/12/2023, 10:08
Static task
static1
Behavioral task
behavioral1
Sample
660ff8b8f09c8c6a13a057fab6347fa7.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
660ff8b8f09c8c6a13a057fab6347fa7.exe
Resource
win10v2004-20231215-en
General
-
Target
660ff8b8f09c8c6a13a057fab6347fa7.exe
-
Size
94KB
-
MD5
660ff8b8f09c8c6a13a057fab6347fa7
-
SHA1
388116b45996aa3ae79ec54c28a2b28d2c503ebf
-
SHA256
63ce1bf6feefeb79b61e83c24f5ee6e73106aa1e36cc8fa57a2ee9a1aa3768d0
-
SHA512
4883f6c3f2de519efa53ebe4872445c8a4b7e31a69c6494d5f204d2f9cf26a817e852cb2608c8f64a854340b7bab3b51ae463a61f81223c2b49201b5bf21435a
-
SSDEEP
1536:nfg+M2Y9oH+cpTKeyaI0Z/od8bDbRvU5yYeVYXrgITAGXBB3exYEjpepikFIy:nfgyY9oH+cTKGI0Z/oooeVYXrgI0GXW4
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Control Panel\International\Geo\Nation 660ff8b8f09c8c6a13a057fab6347fa7.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1348 wrote to memory of 3608 1348 660ff8b8f09c8c6a13a057fab6347fa7.exe 99 PID 1348 wrote to memory of 3608 1348 660ff8b8f09c8c6a13a057fab6347fa7.exe 99 PID 1348 wrote to memory of 3608 1348 660ff8b8f09c8c6a13a057fab6347fa7.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\660ff8b8f09c8c6a13a057fab6347fa7.exe"C:\Users\Admin\AppData\Local\Temp\660ff8b8f09c8c6a13a057fab6347fa7.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Zhz..bat" > nul 2> nul2⤵PID:3608
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
210B
MD531d260b78436270f64ed96b90cb51f4d
SHA1e416ab107a635762a2bd75e0dfcb2dda81e6bb32
SHA25640d0d40e5589fd9fd25fe6dcf5111a765c6de23131242009256121a5a52e958c
SHA512d5848fe1e89a7c842c7aff944e16a828bbba3ae19892c0214a4a026038ddbda571cb8e13239b54ee001f3c3a08556ca985bf3ba5af39f540e2493f657313ecb0