Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
133s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
08/01/2024, 18:12
Static task
static1
Behavioral task
behavioral1
Sample
4c1eed85d9316c81cb3b45a93b2a4ff7.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
4c1eed85d9316c81cb3b45a93b2a4ff7.exe
Resource
win10v2004-20231222-en
General
-
Target
4c1eed85d9316c81cb3b45a93b2a4ff7.exe
-
Size
67KB
-
MD5
4c1eed85d9316c81cb3b45a93b2a4ff7
-
SHA1
98bf0395a4b92c4e6efc05f71442ac081d425cbd
-
SHA256
45f98f5c59b6add9111adf2863eee835a7c3cd73857457e82f57a4fdf69ae6e0
-
SHA512
d923e9228808c911a4f4e85d1fb96fa844a46ab142b3366e85053baaddde05c4d605916c0e3cf208fb207af7061ee8034fd68c57e3bd3184f75c071e17afee4d
-
SSDEEP
1536:2wetP10SuUdZuhRfUwvw37j/XrTnEmgIFlkFVtJ/i:2vc0ZupIrj/XzD4d/i
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Control Panel\International\Geo\Nation 4c1eed85d9316c81cb3b45a93b2a4ff7.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1844 4c1eed85d9316c81cb3b45a93b2a4ff7.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1844 wrote to memory of 2884 1844 4c1eed85d9316c81cb3b45a93b2a4ff7.exe 92 PID 1844 wrote to memory of 2884 1844 4c1eed85d9316c81cb3b45a93b2a4ff7.exe 92 PID 1844 wrote to memory of 2884 1844 4c1eed85d9316c81cb3b45a93b2a4ff7.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\4c1eed85d9316c81cb3b45a93b2a4ff7.exe"C:\Users\Admin\AppData\Local\Temp\4c1eed85d9316c81cb3b45a93b2a4ff7.exe"1⤵
- Checks computer location settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Cwp..bat" > nul 2> nul2⤵PID:2884
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
210B
MD59d18ce0c6499ca9e8fbaec7f4f625aea
SHA193fa0d598da4e17b03b3b4c46b6fafca5e788aec
SHA25623dad3cbb87cab9d506f615351dc24ac0cbdcf2141c2cb571365e000c561823a
SHA51263f5d490b4f89901d69002fb44b00ec63032e21ddfbae321778c42ec59d5c07e8d0656c94bcf22fc44e0f1a8eda4ff93198448def1023be5a313decbead73116