Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
31/12/2023, 14:03
General
-
Target
39138f5e46859b22773c478d6e66860f.exe
-
Size
311KB
-
MD5
39138f5e46859b22773c478d6e66860f
-
SHA1
deb1cefdbfb3db5566f4cf179f42e611a7da8603
-
SHA256
68cfb3456fe856e99449354268b7e63c4255249c174a63361643aa57400c73ec
-
SHA512
b05aa449ebc610e477b4e5641a91ff3c73f89195cc939a7e491fe32a0a57bf43a29ef8a3e549814f82c8cf38d959e67409051209a16727c2d1322bf485ddd952
-
SSDEEP
6144:2RL59axiy59ITq/MFUMK4wBgFb1TLdXDiEuiBJYJaH5t:2H9aH59jFMvwmb1TLwEIof
Malware Config
Signatures
-
Adds policy Run key to start application 2 TTPs 2 IoCs
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\39138f5e46859b22773c478d6e66860f.exe"C:\Users\Admin\AppData\Local\Temp\39138f5e46859b22773c478d6e66860f.exe"1⤵
- Adds policy Run key to start application
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\lsass.exe"C:\Windows\lsass.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ipconfig.exe"C:\Windows\System32\ipconfig.exe" /flushdns3⤵
- Gathers network information
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
86KB
MD538c6a2af6c256444cc0e58fa58a95b28
SHA18eacfc39038adff844850505a9e22fdfbb422151
SHA2562a5c8e0501f2256d8353a06e14a8ac225d4c06a74be617429fd698e51506b33e
SHA512ed0d595f6d27dbdfa562454b92e42f94fed01fd8260592b86c7d80e72a1b71f9747a27b08f533acd02ee2d7cab4893347c4337bb6374562ea26077694e7d3cd6
-
Filesize
311KB
MD539138f5e46859b22773c478d6e66860f
SHA1deb1cefdbfb3db5566f4cf179f42e611a7da8603
SHA25668cfb3456fe856e99449354268b7e63c4255249c174a63361643aa57400c73ec
SHA512b05aa449ebc610e477b4e5641a91ff3c73f89195cc939a7e491fe32a0a57bf43a29ef8a3e549814f82c8cf38d959e67409051209a16727c2d1322bf485ddd952
-
Filesize
412KB
-
Filesize
304KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
412KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
20KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
412KB