Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

07/01/2024, 18:26

240107-w3ameabffn 10

Analysis

  • max time kernel
    146s
  • max time network
    124s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/01/2024, 18:26

General

  • Target

    Samples 6/c4ec2c4d73a45bba85debe9fe243708bb52afd29dc95d7fdefed02cd34c375ca.exe

  • Size

    7KB

  • MD5

    9612c12e7c958af8eddf9ebf341ad754

  • SHA1

    39a96f9934706cc22a34a9398dc1dd4e7d03d738

  • SHA256

    c4ec2c4d73a45bba85debe9fe243708bb52afd29dc95d7fdefed02cd34c375ca

  • SHA512

    d13a58955741eaa148b7fd55ad690e7f4c9fa53beb06dbc4a6b5ef527bfb23ef9999e2ea5c0ed93ddc519e410f6f6f6ea16cad9702eaa21e08e2bc69bcbf9c22

  • SSDEEP

    192:HpEwzsViovM7q1YpmYiogbJgigbGgJgigoD9NwEt:HpEwIIj7+YptYPv8PVH

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Samples 6\c4ec2c4d73a45bba85debe9fe243708bb52afd29dc95d7fdefed02cd34c375ca.exe
    "C:\Users\Admin\AppData\Local\Temp\Samples 6\c4ec2c4d73a45bba85debe9fe243708bb52afd29dc95d7fdefed02cd34c375ca.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1572
    • C:\Users\Admin\AppData\Local\Temp\budha.exe
      "C:\Users\Admin\AppData\Local\Temp\budha.exe"
      2⤵
      • Executes dropped EXE
      PID:2108

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\budha.exe

    Filesize

    7KB

    MD5

    98bc96fd2508f93e40ba3a8c8e40d199

    SHA1

    4912ecd1e774f8c1b7aa2bdaa94ef477f01f8c12

    SHA256

    b2e779a05b06840f138cfc0c2145df5158818affcf10e595380ff2ce364bcefb

    SHA512

    f0abe8d07c097c13767b35c36cdab1ea7247f85c6ca1fbd17672adf92409ac45c93478c614a5679193d8ed09cc366e36343ca45cd6968bcce5cb500162b24856

  • memory/1572-0-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

  • memory/1572-9-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

  • memory/2108-16-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB