Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    151s
  • max time network
    160s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/01/2024, 12:35

General

  • Target

    5b40bd174024d939d54e53284555b5c9.exe

  • Size

    471KB

  • MD5

    5b40bd174024d939d54e53284555b5c9

  • SHA1

    df3908890c1b77e5166b7b58a008151410ff5a2d

  • SHA256

    0520b8cbb3869b829bfd9850132dc02192459ccae5483f0bba5d7d4acb7bcfbc

  • SHA512

    20c800e2ce8a0b3577ca1b3ec5c8f1079479f51f9faff9ea2307bb81251e52a5133904ae3bbe4b047ed4e304f208753c8a6d8aac4c0192882a61e053e405b324

  • SSDEEP

    6144:Vmsyd7BspOWZ+Stxo3Gc2uqy3gu88mWCMpCRWFf2Kj+m+6XmYr:BpO3StxwGc2c3tfmfsCRA22+m+8p

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5b40bd174024d939d54e53284555b5c9.exe
    "C:\Users\Admin\AppData\Local\Temp\5b40bd174024d939d54e53284555b5c9.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4756
    • C:\Users\Admin\AppData\Local\Temp\DM\worker.exe
      "C:\Users\Admin\AppData\Local\Temp\DM\worker.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:4540

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\DM\parent.txt

    Filesize

    471KB

    MD5

    5b40bd174024d939d54e53284555b5c9

    SHA1

    df3908890c1b77e5166b7b58a008151410ff5a2d

    SHA256

    0520b8cbb3869b829bfd9850132dc02192459ccae5483f0bba5d7d4acb7bcfbc

    SHA512

    20c800e2ce8a0b3577ca1b3ec5c8f1079479f51f9faff9ea2307bb81251e52a5133904ae3bbe4b047ed4e304f208753c8a6d8aac4c0192882a61e053e405b324

  • C:\Users\Admin\AppData\Local\Temp\DM\worker.exe

    Filesize

    19KB

    MD5

    2b23c69b68708c14fc214c3454e6b1bd

    SHA1

    5c923d25c14ad13dab4f05bb1423026f873e7dc4

    SHA256

    b2eb3b20cfa82a80207cb9fe8ea7cb28faa1b35612816b7b0052e68b9c8068bd

    SHA512

    00135ff0664e9de5f98be600773c72025f5f338e7301ab9d10b023fef672baa2ddbe3124813352eacf8d7475f0905d68dded619aa2cc3099f10b943ff3cdb8c5

  • memory/4540-21-0x000000001FB10000-0x000000001FB72000-memory.dmp

    Filesize

    392KB

  • memory/4540-25-0x00007FFCD1440000-0x00007FFCD1DE1000-memory.dmp

    Filesize

    9.6MB

  • memory/4540-15-0x000000001B780000-0x000000001B7C4000-memory.dmp

    Filesize

    272KB

  • memory/4540-16-0x000000001BFB0000-0x000000001C47E000-memory.dmp

    Filesize

    4.8MB

  • memory/4540-17-0x000000001C520000-0x000000001C5BC000-memory.dmp

    Filesize

    624KB

  • memory/4540-18-0x0000000001170000-0x0000000001178000-memory.dmp

    Filesize

    32KB

  • memory/4540-19-0x0000000001160000-0x0000000001170000-memory.dmp

    Filesize

    64KB

  • memory/4540-20-0x0000000001160000-0x0000000001170000-memory.dmp

    Filesize

    64KB

  • memory/4540-13-0x00007FFCD1440000-0x00007FFCD1DE1000-memory.dmp

    Filesize

    9.6MB

  • memory/4540-12-0x00007FFCD1440000-0x00007FFCD1DE1000-memory.dmp

    Filesize

    9.6MB

  • memory/4540-24-0x0000000001160000-0x0000000001170000-memory.dmp

    Filesize

    64KB

  • memory/4540-14-0x0000000001160000-0x0000000001170000-memory.dmp

    Filesize

    64KB

  • memory/4540-34-0x0000000022420000-0x0000000022BC6000-memory.dmp

    Filesize

    7.6MB

  • memory/4540-35-0x00007FFCD1440000-0x00007FFCD1DE1000-memory.dmp

    Filesize

    9.6MB

  • memory/4540-36-0x0000000020A00000-0x0000000020A42000-memory.dmp

    Filesize

    264KB

  • memory/4540-37-0x0000000020A50000-0x0000000020F07000-memory.dmp

    Filesize

    4.7MB

  • memory/4540-38-0x0000000001160000-0x0000000001170000-memory.dmp

    Filesize

    64KB

  • memory/4540-39-0x0000000001160000-0x0000000001170000-memory.dmp

    Filesize

    64KB

  • memory/4540-40-0x0000000001160000-0x0000000001170000-memory.dmp

    Filesize

    64KB

  • memory/4540-43-0x0000000001160000-0x0000000001170000-memory.dmp

    Filesize

    64KB

  • memory/4540-44-0x0000000001160000-0x0000000001170000-memory.dmp

    Filesize

    64KB