Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    169s
  • max time network
    181s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/12/2023, 18:56

General

  • Target

    3a5027348187535ea6e51bbe3e6762d2.exe

  • Size

    2.0MB

  • MD5

    3a5027348187535ea6e51bbe3e6762d2

  • SHA1

    9c4c62d970110a71881e4a4e24c621032bb81075

  • SHA256

    4a273105d0d2f071ff747b87d7890cd255ca366025bec4bda0b68bc7e3283314

  • SHA512

    7c0456e72335359b667ec691fdee22b8b54b8b1d0b658dd5a40db10fe81b447f0509bfdf4fbfd5e9ddb9ef0bd3314dc7be05a48bb068883cd30f15f1fc29ddc4

  • SSDEEP

    49152:QyLIQso24XPTUHCBF6dDLmJjnA8YZ9KpecU29IbCZeX:XLI5o2QUhaJsPQecbgxX

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 11 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3a5027348187535ea6e51bbe3e6762d2.exe
    "C:\Users\Admin\AppData\Local\Temp\3a5027348187535ea6e51bbe3e6762d2.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:5020
    • C:\Users\Admin\AppData\Local\Temp\3a5027348187535ea6e51bbe3e6762d2.exe
      "C:\Users\Admin\AppData\Local\Temp\3a5027348187535ea6e51bbe3e6762d2.exe"
      2⤵
      • Checks computer location settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:5036
      • C:\Users\Admin\AppData\Local\Temp\3a5027348187535ea6e51bbe3e6762d2.exe
        "C:\Users\Admin\AppData\Local\Temp\3a5027348187535ea6e51bbe3e6762d2.exe"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:3944
    • C:\Users\Admin\AppData\Local\Temp\3a5027348187535ea6e51bbe3e6762d2.exe
      "C:\Users\Admin\AppData\Local\Temp\3a5027348187535ea6e51bbe3e6762d2.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:4712

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\american cumshot hardcore uncut hole 50+ .mpg.exe

    Filesize

    375KB

    MD5

    d652a7bab54957b0e05d0924cdfd87e0

    SHA1

    54d56f2ef0bbcffaa5654ca86e7ceda3ae345e76

    SHA256

    0f1cb7eaaca41778f6a36ac99c4c226ca302dbe0837280ac395e995101fb21c9

    SHA512

    81880f09aab11464b4eb42b8485f4bde2648d7d917f9f574f1d5862773608057a12243b6051206d1c7b3545dfbe6fd3939ec1773331b14469519ef064fefe896

  • memory/3944-11-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

  • memory/3944-28-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

  • memory/4712-8-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

  • memory/4712-27-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

  • memory/5020-0-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

  • memory/5020-7-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

  • memory/5036-6-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

  • memory/5036-23-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB