Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    153s
  • max time network
    160s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/01/2024, 00:52

General

  • Target

    71022101e98b8c6123808487de9408d1.exe

  • Size

    938KB

  • MD5

    71022101e98b8c6123808487de9408d1

  • SHA1

    6543195ecdd6c5a5c35725791cf2c27b3b15a18c

  • SHA256

    5829afd53c402956b70d6f5ea03c3389e5a9ef0f84fcf7fa0602db5bab4041e2

  • SHA512

    c001825c4c8127f746d49ed287864aa79d3132255f0f5661a410433712a02e066f1fa94cd17516e50f1634f95f7e27588b60699e5a17f6ccd770f4c74ec460ba

  • SSDEEP

    12288:BgouF2OPlgCxbUuqEolqhlBG0EZRYx35Ua8wvJfiU3us5NhOblYNTwUkVQ+PYJc:BgouFhCwUuqDluBMfEhJX3z5mKhwbLec

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\71022101e98b8c6123808487de9408d1.exe
    "C:\Users\Admin\AppData\Local\Temp\71022101e98b8c6123808487de9408d1.exe"
    1⤵
    • Checks computer location settings
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3744
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c "C:\ProgramData\smes\u.bat"
      2⤵
        PID:3248
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\temg_tmp.bat"
        2⤵
          PID:1480

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\ProgramData\smes\u.bat

        Filesize

        44B

        MD5

        704efba1aee1454561da552dda430498

        SHA1

        d20fb96683f769eb9cef1b0a068bcba70aeab9c2

        SHA256

        80b08d35bd27636e0774ce35ab57306f76edc6a0f7058cb1f93733cdf88bf94c

        SHA512

        7e0c9ede686238703af4893af8842c05c48ab1681ae273b32d8085cf1a17aae946c0c823a0a418787522a551d684367259ff8203ebca6e4ec69b6ded95231bd0

      • C:\Users\Admin\AppData\Local\Temp\nstCFE4.tmp\AccessControl.dll

        Filesize

        10KB

        MD5

        055f4f9260e07fc83f71877cbb7f4fad

        SHA1

        a245131af1a182de99bd74af9ff1fab17977a72f

        SHA256

        4209588362785b690d08d15cd982b8d1c62c348767ca19114234b21d5df74ddc

        SHA512

        a8e82dc4435ed938f090f43df953ddad9b0075f16218c09890c996299420162d64b1dbfbf613af37769ae796717eec78204dc786b757e8b1d13d423d4ee82e26

      • C:\Users\Admin\AppData\Local\Temp\nstCFE4.tmp\FindProcDLL.dll

        Filesize

        3KB

        MD5

        8614c450637267afacad1645e23ba24a

        SHA1

        e7b7b09b5bbc13e910aa36316d9cc5fc5d4dcdc2

        SHA256

        0fa04f06a6de18d316832086891e9c23ae606d7784d5d5676385839b21ca2758

        SHA512

        af46cd679097584ff9a1d894a729b6397f4b3af17dff3e6f07bef257bc7e48ffa341d82daf298616cd5df1450fc5ab7435cacb70f27302b6db193f01a9f8391b

      • C:\Users\Admin\AppData\Local\Temp\temg_tmp.bat

        Filesize

        121B

        MD5

        b7b9302ed21ff082959c4af74edb3fee

        SHA1

        6debe82dd2d967d455cd663b91463aa6ea507bbe

        SHA256

        0bdc2e1011769c0db3ac32fd4fca8528f1a3ee2cce2551ded781792c1f911a40

        SHA512

        d06932bb340c10f65e69a31122015d606b07ee2759287e5a267563f50f10307a224c7ccfb57cdb23d081ba8fdcd115ff91b1918d524a9baef9a2532863110396

      • memory/3744-5-0x0000000010000000-0x0000000010003000-memory.dmp

        Filesize

        12KB