Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
163s -
max time network
177s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2023, 11:39
Static task
static1
Behavioral task
behavioral1
Sample
1759c0dddaecb9ed584e329094ddcde0.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
1759c0dddaecb9ed584e329094ddcde0.exe
Resource
win10v2004-20231215-en
General
-
Target
1759c0dddaecb9ed584e329094ddcde0.exe
-
Size
156KB
-
MD5
1759c0dddaecb9ed584e329094ddcde0
-
SHA1
2b17a241a2b2cef57016d6b6ef6328f3421912ac
-
SHA256
d46b0c048e52fa8c21e0e39c46c1397dce998945f1ff8f8d38f280b83a371b82
-
SHA512
c6aa6ae40a2b154f67e115d809832b85cb39e52dc9f2e49db983af2ddf5a5c4bb8669b502e3e227cd3e643a6f828ebe262306c90f40596069b1baa288a68db8a
-
SSDEEP
1536:MCzfc5NyzO/UBeMkFYA5v6V/LHk9Iy2/a+dCUxWhLU30La9APLBb48n:MCgj2vBe1yAULHkaysvd47La9At8Y
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation 1759c0dddaecb9ed584e329094ddcde0.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2572 wrote to memory of 1216 2572 1759c0dddaecb9ed584e329094ddcde0.exe 94 PID 2572 wrote to memory of 1216 2572 1759c0dddaecb9ed584e329094ddcde0.exe 94 PID 2572 wrote to memory of 1216 2572 1759c0dddaecb9ed584e329094ddcde0.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\1759c0dddaecb9ed584e329094ddcde0.exe"C:\Users\Admin\AppData\Local\Temp\1759c0dddaecb9ed584e329094ddcde0.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Dkp..bat" > nul 2> nul2⤵PID:1216
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
210B
MD52da05ac03af55fc2933ab8ed6725390c
SHA1dcfc5224c5b6c45e410456f2275c7824b13ba66a
SHA256ed1d37f6722c1c51884317619b68c1f7194b6b9e92860012a13e101a0ac2be06
SHA512aa3f45542ed4440680a4045f46581107c23a89a0efe058357dc0d7c76b8cbcd06f438a6e0c686177b520ef036e811c21b163d3cff0c8a97fd82d2262211ca9df