Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
14/01/2024, 12:35
Static task
static1
Behavioral task
behavioral1
Sample
5b40bd174024d939d54e53284555b5c9.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
5b40bd174024d939d54e53284555b5c9.exe
Resource
win10v2004-20231215-en
General
-
Target
5b40bd174024d939d54e53284555b5c9.exe
-
Size
471KB
-
MD5
5b40bd174024d939d54e53284555b5c9
-
SHA1
df3908890c1b77e5166b7b58a008151410ff5a2d
-
SHA256
0520b8cbb3869b829bfd9850132dc02192459ccae5483f0bba5d7d4acb7bcfbc
-
SHA512
20c800e2ce8a0b3577ca1b3ec5c8f1079479f51f9faff9ea2307bb81251e52a5133904ae3bbe4b047ed4e304f208753c8a6d8aac4c0192882a61e053e405b324
-
SSDEEP
6144:Vmsyd7BspOWZ+Stxo3Gc2uqy3gu88mWCMpCRWFf2Kj+m+6XmYr:BpO3StxwGc2c3tfmfsCRA22+m+8p
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation 5b40bd174024d939d54e53284555b5c9.exe -
Executes dropped EXE 1 IoCs
pid Process 4540 worker.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4540 worker.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4540 worker.exe 4540 worker.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4756 wrote to memory of 4540 4756 5b40bd174024d939d54e53284555b5c9.exe 89 PID 4756 wrote to memory of 4540 4756 5b40bd174024d939d54e53284555b5c9.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\5b40bd174024d939d54e53284555b5c9.exe"C:\Users\Admin\AppData\Local\Temp\5b40bd174024d939d54e53284555b5c9.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\Users\Admin\AppData\Local\Temp\DM\worker.exe"C:\Users\Admin\AppData\Local\Temp\DM\worker.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4540
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
471KB
MD55b40bd174024d939d54e53284555b5c9
SHA1df3908890c1b77e5166b7b58a008151410ff5a2d
SHA2560520b8cbb3869b829bfd9850132dc02192459ccae5483f0bba5d7d4acb7bcfbc
SHA51220c800e2ce8a0b3577ca1b3ec5c8f1079479f51f9faff9ea2307bb81251e52a5133904ae3bbe4b047ed4e304f208753c8a6d8aac4c0192882a61e053e405b324
-
Filesize
19KB
MD52b23c69b68708c14fc214c3454e6b1bd
SHA15c923d25c14ad13dab4f05bb1423026f873e7dc4
SHA256b2eb3b20cfa82a80207cb9fe8ea7cb28faa1b35612816b7b0052e68b9c8068bd
SHA51200135ff0664e9de5f98be600773c72025f5f338e7301ab9d10b023fef672baa2ddbe3124813352eacf8d7475f0905d68dded619aa2cc3099f10b943ff3cdb8c5