Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
12/01/2024, 09:05
General
-
Target
560a10903033dea6ffe2ac89152188c1.exe
-
Size
471KB
-
MD5
560a10903033dea6ffe2ac89152188c1
-
SHA1
1fb3d42c5802ec9753d8dcfce09b5a3446998f27
-
SHA256
240386b000499bd7206219cd041a7cc3ad1fedf9a098517fae5ff1fffc493e72
-
SHA512
d1b365e3201da3fe75a1d94acfc0823d2bc236018b5bd3898b41d1cc6b355aa02420be1c4408613f6ab859a11a1fee6e03f35b0a27d0a981db0a75a957e59a44
-
SSDEEP
6144:amsyd7BspOWZ+Stxo3Gc2uqy3gu88mWCMpCRWFf2Kj+m+6X4YR:mpO3StxwGc2c3tfmfsCRA22+m+8V
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\560a10903033dea6ffe2ac89152188c1.exe"C:\Users\Admin\AppData\Local\Temp\560a10903033dea6ffe2ac89152188c1.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\DM\worker.exe"C:\Users\Admin\AppData\Local\Temp\DM\worker.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
92KB
MD590183255903345e1447b80be76a8bbb1
SHA166af36eefac7b046ef0b264007d676778ae43c96
SHA256e0330e83c951d09039c1911ca5c7300d0bd097fd47f2c4d5b1c31754104bfb91
SHA512a11f7bd5b5f30e9d8c9a4390a35f316de2a84d628005ab1a906184135b6881ef88cc4b4b033c69240ddae2d95d714bbf8b061d6f826f23bb67632282164ebc5b
-
Filesize
19KB
MD52b23c69b68708c14fc214c3454e6b1bd
SHA15c923d25c14ad13dab4f05bb1423026f873e7dc4
SHA256b2eb3b20cfa82a80207cb9fe8ea7cb28faa1b35612816b7b0052e68b9c8068bd
SHA51200135ff0664e9de5f98be600773c72025f5f338e7301ab9d10b023fef672baa2ddbe3124813352eacf8d7475f0905d68dded619aa2cc3099f10b943ff3cdb8c5
-
Filesize
64KB
-
Filesize
392KB
-
Filesize
272KB
-
Filesize
4.8MB
-
Filesize
624KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
64KB
-
Filesize
4.7MB
-
Filesize
9.6MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB