Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
14/01/2024, 12:35
General
-
Target
5b40bd174024d939d54e53284555b5c9.exe
-
Size
471KB
-
MD5
5b40bd174024d939d54e53284555b5c9
-
SHA1
df3908890c1b77e5166b7b58a008151410ff5a2d
-
SHA256
0520b8cbb3869b829bfd9850132dc02192459ccae5483f0bba5d7d4acb7bcfbc
-
SHA512
20c800e2ce8a0b3577ca1b3ec5c8f1079479f51f9faff9ea2307bb81251e52a5133904ae3bbe4b047ed4e304f208753c8a6d8aac4c0192882a61e053e405b324
-
SSDEEP
6144:Vmsyd7BspOWZ+Stxo3Gc2uqy3gu88mWCMpCRWFf2Kj+m+6XmYr:BpO3StxwGc2c3tfmfsCRA22+m+8p
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5b40bd174024d939d54e53284555b5c9.exe"C:\Users\Admin\AppData\Local\Temp\5b40bd174024d939d54e53284555b5c9.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\DM\worker.exe"C:\Users\Admin\AppData\Local\Temp\DM\worker.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
471KB
MD55b40bd174024d939d54e53284555b5c9
SHA1df3908890c1b77e5166b7b58a008151410ff5a2d
SHA2560520b8cbb3869b829bfd9850132dc02192459ccae5483f0bba5d7d4acb7bcfbc
SHA51220c800e2ce8a0b3577ca1b3ec5c8f1079479f51f9faff9ea2307bb81251e52a5133904ae3bbe4b047ed4e304f208753c8a6d8aac4c0192882a61e053e405b324
-
Filesize
19KB
MD52b23c69b68708c14fc214c3454e6b1bd
SHA15c923d25c14ad13dab4f05bb1423026f873e7dc4
SHA256b2eb3b20cfa82a80207cb9fe8ea7cb28faa1b35612816b7b0052e68b9c8068bd
SHA51200135ff0664e9de5f98be600773c72025f5f338e7301ab9d10b023fef672baa2ddbe3124813352eacf8d7475f0905d68dded619aa2cc3099f10b943ff3cdb8c5
-
Filesize
392KB
-
Filesize
9.6MB
-
Filesize
272KB
-
Filesize
4.8MB
-
Filesize
624KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
7.6MB
-
Filesize
9.6MB
-
Filesize
264KB
-
Filesize
4.7MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB