Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    152s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/12/2023, 10:08

General

  • Target

    660ff8b8f09c8c6a13a057fab6347fa7.exe

  • Size

    94KB

  • MD5

    660ff8b8f09c8c6a13a057fab6347fa7

  • SHA1

    388116b45996aa3ae79ec54c28a2b28d2c503ebf

  • SHA256

    63ce1bf6feefeb79b61e83c24f5ee6e73106aa1e36cc8fa57a2ee9a1aa3768d0

  • SHA512

    4883f6c3f2de519efa53ebe4872445c8a4b7e31a69c6494d5f204d2f9cf26a817e852cb2608c8f64a854340b7bab3b51ae463a61f81223c2b49201b5bf21435a

  • SSDEEP

    1536:nfg+M2Y9oH+cpTKeyaI0Z/od8bDbRvU5yYeVYXrgITAGXBB3exYEjpepikFIy:nfgyY9oH+cTKGI0Z/oooeVYXrgI0GXW4

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\660ff8b8f09c8c6a13a057fab6347fa7.exe
    "C:\Users\Admin\AppData\Local\Temp\660ff8b8f09c8c6a13a057fab6347fa7.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1348
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Zhz..bat" > nul 2> nul
      2⤵
        PID:3608

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\Zhz..bat

      Filesize

      210B

      MD5

      31d260b78436270f64ed96b90cb51f4d

      SHA1

      e416ab107a635762a2bd75e0dfcb2dda81e6bb32

      SHA256

      40d0d40e5589fd9fd25fe6dcf5111a765c6de23131242009256121a5a52e958c

      SHA512

      d5848fe1e89a7c842c7aff944e16a828bbba3ae19892c0214a4a026038ddbda571cb8e13239b54ee001f3c3a08556ca985bf3ba5af39f540e2493f657313ecb0

    • memory/1348-0-0x0000000000400000-0x000000000041D000-memory.dmp

      Filesize

      116KB

    • memory/1348-3-0x0000000000400000-0x000000000041D000-memory.dmp

      Filesize

      116KB

    • memory/1348-4-0x0000000000470000-0x0000000000471000-memory.dmp

      Filesize

      4KB

    • memory/1348-5-0x0000000000400000-0x000000000041D000-memory.dmp

      Filesize

      116KB

    • memory/1348-6-0x0000000000400000-0x000000000041D000-memory.dmp

      Filesize

      116KB

    • memory/1348-7-0x00000000022B0000-0x00000000022B1000-memory.dmp

      Filesize

      4KB

    • memory/1348-8-0x00000000022B0000-0x00000000022B1000-memory.dmp

      Filesize

      4KB

    • memory/1348-10-0x0000000000400000-0x000000000041D000-memory.dmp

      Filesize

      116KB