Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
153s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
24/01/2024, 00:52
Static task
static1
Behavioral task
behavioral1
Sample
71022101e98b8c6123808487de9408d1.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
71022101e98b8c6123808487de9408d1.exe
Resource
win10v2004-20231215-en
General
-
Target
71022101e98b8c6123808487de9408d1.exe
-
Size
938KB
-
MD5
71022101e98b8c6123808487de9408d1
-
SHA1
6543195ecdd6c5a5c35725791cf2c27b3b15a18c
-
SHA256
5829afd53c402956b70d6f5ea03c3389e5a9ef0f84fcf7fa0602db5bab4041e2
-
SHA512
c001825c4c8127f746d49ed287864aa79d3132255f0f5661a410433712a02e066f1fa94cd17516e50f1634f95f7e27588b60699e5a17f6ccd770f4c74ec460ba
-
SSDEEP
12288:BgouF2OPlgCxbUuqEolqhlBG0EZRYx35Ua8wvJfiU3us5NhOblYNTwUkVQ+PYJc:BgouFhCwUuqDluBMfEhJX3z5mKhwbLec
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation 71022101e98b8c6123808487de9408d1.exe -
Loads dropped DLL 2 IoCs
pid Process 3744 71022101e98b8c6123808487de9408d1.exe 3744 71022101e98b8c6123808487de9408d1.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3744 71022101e98b8c6123808487de9408d1.exe 3744 71022101e98b8c6123808487de9408d1.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3744 wrote to memory of 3248 3744 71022101e98b8c6123808487de9408d1.exe 89 PID 3744 wrote to memory of 3248 3744 71022101e98b8c6123808487de9408d1.exe 89 PID 3744 wrote to memory of 3248 3744 71022101e98b8c6123808487de9408d1.exe 89 PID 3744 wrote to memory of 1480 3744 71022101e98b8c6123808487de9408d1.exe 90 PID 3744 wrote to memory of 1480 3744 71022101e98b8c6123808487de9408d1.exe 90 PID 3744 wrote to memory of 1480 3744 71022101e98b8c6123808487de9408d1.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\71022101e98b8c6123808487de9408d1.exe"C:\Users\Admin\AppData\Local\Temp\71022101e98b8c6123808487de9408d1.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3744 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "C:\ProgramData\smes\u.bat"2⤵PID:3248
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\temg_tmp.bat"2⤵PID:1480
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
44B
MD5704efba1aee1454561da552dda430498
SHA1d20fb96683f769eb9cef1b0a068bcba70aeab9c2
SHA25680b08d35bd27636e0774ce35ab57306f76edc6a0f7058cb1f93733cdf88bf94c
SHA5127e0c9ede686238703af4893af8842c05c48ab1681ae273b32d8085cf1a17aae946c0c823a0a418787522a551d684367259ff8203ebca6e4ec69b6ded95231bd0
-
Filesize
10KB
MD5055f4f9260e07fc83f71877cbb7f4fad
SHA1a245131af1a182de99bd74af9ff1fab17977a72f
SHA2564209588362785b690d08d15cd982b8d1c62c348767ca19114234b21d5df74ddc
SHA512a8e82dc4435ed938f090f43df953ddad9b0075f16218c09890c996299420162d64b1dbfbf613af37769ae796717eec78204dc786b757e8b1d13d423d4ee82e26
-
Filesize
3KB
MD58614c450637267afacad1645e23ba24a
SHA1e7b7b09b5bbc13e910aa36316d9cc5fc5d4dcdc2
SHA2560fa04f06a6de18d316832086891e9c23ae606d7784d5d5676385839b21ca2758
SHA512af46cd679097584ff9a1d894a729b6397f4b3af17dff3e6f07bef257bc7e48ffa341d82daf298616cd5df1450fc5ab7435cacb70f27302b6db193f01a9f8391b
-
Filesize
121B
MD5b7b9302ed21ff082959c4af74edb3fee
SHA16debe82dd2d967d455cd663b91463aa6ea507bbe
SHA2560bdc2e1011769c0db3ac32fd4fca8528f1a3ee2cce2551ded781792c1f911a40
SHA512d06932bb340c10f65e69a31122015d606b07ee2759287e5a267563f50f10307a224c7ccfb57cdb23d081ba8fdcd115ff91b1918d524a9baef9a2532863110396