Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2023, 04:02
Static task
static1
Behavioral task
behavioral1
Sample
0dc304a2e042c8270f2ed515fb723ec0.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
0dc304a2e042c8270f2ed515fb723ec0.exe
Resource
win10v2004-20231215-en
General
-
Target
0dc304a2e042c8270f2ed515fb723ec0.exe
-
Size
102KB
-
MD5
0dc304a2e042c8270f2ed515fb723ec0
-
SHA1
0a4b1b5b5ada5dde83d0a321aa832bd880af05e8
-
SHA256
f237db18bae06b27b9625fa093496f10f94a1d44524984ad2342929a913b3f67
-
SHA512
0f8cafec921188b287c49323b089c636296d7e9091164e71198f994f7c3da084b4a2e61ca2298218d1dfd4a2a00ae229a46639f9c5ff3e3b36a9fe4d65da7fa1
-
SSDEEP
1536:YNS8dJau+12Po9C3xWEn+LhfaSj4/PoaPao1xqb7yWe:4S2+1zCBJ+lfZU5P7K/yW
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation 0dc304a2e042c8270f2ed515fb723ec0.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1060 0dc304a2e042c8270f2ed515fb723ec0.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1060 wrote to memory of 4796 1060 0dc304a2e042c8270f2ed515fb723ec0.exe 98 PID 1060 wrote to memory of 4796 1060 0dc304a2e042c8270f2ed515fb723ec0.exe 98 PID 1060 wrote to memory of 4796 1060 0dc304a2e042c8270f2ed515fb723ec0.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\0dc304a2e042c8270f2ed515fb723ec0.exe"C:\Users\Admin\AppData\Local\Temp\0dc304a2e042c8270f2ed515fb723ec0.exe"1⤵
- Checks computer location settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Ibz..bat" > nul 2> nul2⤵PID:4796
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
210B
MD55cd1ec343f73eaed9b8fedc5cb350f21
SHA117586107f0011ec8d8563f986d464a436bc1a220
SHA256fc17eb245003dcee35a3cdd58ad2d2eb8d3ba0bd2ddb0208d788ab71eb782142
SHA512c6b7bec1fa8f30aaa4e37c0e9bf1cba4a3c5b13def8136b4b62b3043fb6548bbc4a611f3eee5c671c154162f85e96b5502b728f0b40776f02616aa195dda3fab