Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
162s -
max time network
174s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2023, 05:07
Static task
static1
Behavioral task
behavioral1
Sample
0f8fb26432587a5b54c479cf5284fd68.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
0f8fb26432587a5b54c479cf5284fd68.exe
Resource
win10v2004-20231215-en
General
-
Target
0f8fb26432587a5b54c479cf5284fd68.exe
-
Size
15KB
-
MD5
0f8fb26432587a5b54c479cf5284fd68
-
SHA1
7417d9926a01bc548d547f2ee312b69a2cb43808
-
SHA256
75e08bfba7c98e96009629c6c6dbed46751c9fd591abce4272f7708ce419cbbe
-
SHA512
2d4a1e4d9b105e727c2888c6eb3d97be739bd9d6d579b7ef7d36ccb186be013e7bb29062eb712f4147becb4be247843f102ddb5fe6d0422c2fc08b29b67b9722
-
SSDEEP
384:0jTuJj+wS7VYcvqbqQ7ARjSovhx8aJZLB6:XiHqf7bovPtr
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation 0f8fb26432587a5b54c479cf5284fd68.exe -
Executes dropped EXE 1 IoCs
pid Process 2348 time.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Time Sync = "C:\\Program Files (x86)\\Time Sync\\time.exe" time.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files (x86)\Time Sync\time.exe 0f8fb26432587a5b54c479cf5284fd68.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1488 wrote to memory of 2348 1488 0f8fb26432587a5b54c479cf5284fd68.exe 91 PID 1488 wrote to memory of 2348 1488 0f8fb26432587a5b54c479cf5284fd68.exe 91 PID 1488 wrote to memory of 2348 1488 0f8fb26432587a5b54c479cf5284fd68.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\0f8fb26432587a5b54c479cf5284fd68.exe"C:\Users\Admin\AppData\Local\Temp\0f8fb26432587a5b54c479cf5284fd68.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Program Files (x86)\Time Sync\time.exe"C:\Program Files (x86)\Time Sync\time.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:2348
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
15KB
MD50f8fb26432587a5b54c479cf5284fd68
SHA17417d9926a01bc548d547f2ee312b69a2cb43808
SHA25675e08bfba7c98e96009629c6c6dbed46751c9fd591abce4272f7708ce419cbbe
SHA5122d4a1e4d9b105e727c2888c6eb3d97be739bd9d6d579b7ef7d36ccb186be013e7bb29062eb712f4147becb4be247843f102ddb5fe6d0422c2fc08b29b67b9722