Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
11/01/2024, 11:18
Static task
static1
Behavioral task
behavioral1
Sample
535fcdf7d80f74f1230a9c890b422c2e.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
535fcdf7d80f74f1230a9c890b422c2e.exe
Resource
win10v2004-20231222-en
General
-
Target
535fcdf7d80f74f1230a9c890b422c2e.exe
-
Size
869KB
-
MD5
535fcdf7d80f74f1230a9c890b422c2e
-
SHA1
0a6b1860ed1a3587e9da468a8877e59eb60b3fd1
-
SHA256
77b9b21c3349716bd9655e7f8f7f6841d96a00261f660b0b66e840cfe58905ab
-
SHA512
37ab11c35df35c0a49b7678daa1c750d474b2314478fdc7736b5bda5df6d4a3e006dfb821f5459862d1d2d68c042785d6808e29fc638488442fc579b85a2a494
-
SSDEEP
24576:njOwWeegy4mh3ujUw4z9zBBVKxkyP/s1DE:nj6VXajUpVBmkyM1
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation 535fcdf7d80f74f1230a9c890b422c2e.exe -
Executes dropped EXE 1 IoCs
pid Process 2024 bbs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2244 wrote to memory of 2024 2244 535fcdf7d80f74f1230a9c890b422c2e.exe 24 PID 2244 wrote to memory of 2024 2244 535fcdf7d80f74f1230a9c890b422c2e.exe 24 PID 2244 wrote to memory of 2024 2244 535fcdf7d80f74f1230a9c890b422c2e.exe 24
Processes
-
C:\Users\Admin\AppData\Local\Temp\535fcdf7d80f74f1230a9c890b422c2e.exe"C:\Users\Admin\AppData\Local\Temp\535fcdf7d80f74f1230a9c890b422c2e.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\bbs.exe"C:\Users\Admin\AppData\Local\Temp\bbs.exe"2⤵
- Executes dropped EXE
PID:2024
-