Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    133s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/01/2024, 18:12

General

  • Target

    4c1eed85d9316c81cb3b45a93b2a4ff7.exe

  • Size

    67KB

  • MD5

    4c1eed85d9316c81cb3b45a93b2a4ff7

  • SHA1

    98bf0395a4b92c4e6efc05f71442ac081d425cbd

  • SHA256

    45f98f5c59b6add9111adf2863eee835a7c3cd73857457e82f57a4fdf69ae6e0

  • SHA512

    d923e9228808c911a4f4e85d1fb96fa844a46ab142b3366e85053baaddde05c4d605916c0e3cf208fb207af7061ee8034fd68c57e3bd3184f75c071e17afee4d

  • SSDEEP

    1536:2wetP10SuUdZuhRfUwvw37j/XrTnEmgIFlkFVtJ/i:2vc0ZupIrj/XzD4d/i

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4c1eed85d9316c81cb3b45a93b2a4ff7.exe
    "C:\Users\Admin\AppData\Local\Temp\4c1eed85d9316c81cb3b45a93b2a4ff7.exe"
    1⤵
    • Checks computer location settings
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of WriteProcessMemory
    PID:1844
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Cwp..bat" > nul 2> nul
      2⤵
        PID:2884

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\Cwp..bat

      Filesize

      210B

      MD5

      9d18ce0c6499ca9e8fbaec7f4f625aea

      SHA1

      93fa0d598da4e17b03b3b4c46b6fafca5e788aec

      SHA256

      23dad3cbb87cab9d506f615351dc24ac0cbdcf2141c2cb571365e000c561823a

      SHA512

      63f5d490b4f89901d69002fb44b00ec63032e21ddfbae321778c42ec59d5c07e8d0656c94bcf22fc44e0f1a8eda4ff93198448def1023be5a313decbead73116

    • memory/1844-2-0x00000000020D0000-0x00000000020E2000-memory.dmp

      Filesize

      72KB

    • memory/1844-3-0x0000000000400000-0x0000000000420000-memory.dmp

      Filesize

      128KB

    • memory/1844-0-0x0000000000400000-0x0000000000420000-memory.dmp

      Filesize

      128KB

    • memory/1844-5-0x0000000002270000-0x000000000228B000-memory.dmp

      Filesize

      108KB

    • memory/1844-4-0x0000000002270000-0x000000000228B000-memory.dmp

      Filesize

      108KB

    • memory/1844-7-0x0000000000400000-0x0000000000420000-memory.dmp

      Filesize

      128KB