Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    138s
  • max time network
    160s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/02/2024, 12:35

General

  • Target

    8f2a75310286d05ce5aee4f7a3c1b40c.exe

  • Size

    94KB

  • MD5

    8f2a75310286d05ce5aee4f7a3c1b40c

  • SHA1

    2caf5dd981b76badb8f2e98ad37ff6130d1eba10

  • SHA256

    635454dddf996a913567fb13134369eb926969eaa8bbad84530fbdff28f6afeb

  • SHA512

    ea55cc76f86e5a6a777f40b717ac275168920344324bc639a91e1566f5fc2e83301b7e7e0b774f4d5780606dfb30f18f37b59d91f4ee1fdbd86f3ae631b258f0

  • SSDEEP

    1536:ffg+M2Y9oH+cpTKeyaI0Z/od8bDbRvU5yYeVYXrgITAGXBB3exYEjpepikFIy:ffgyY9oH+cTKGI0Z/oooeVYXrgI0GXW4

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8f2a75310286d05ce5aee4f7a3c1b40c.exe
    "C:\Users\Admin\AppData\Local\Temp\8f2a75310286d05ce5aee4f7a3c1b40c.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4608
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Nzb..bat" > nul 2> nul
      2⤵
        PID:3124

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\Nzb..bat

      Filesize

      210B

      MD5

      f9e8a757138e167ae5de853b7e4a19a7

      SHA1

      b34457a2047755e12f8db9e2bff048b145c260c5

      SHA256

      29a4f0aa1846939dfc3ccd3704b31fc98d21d664f19a3a4d39cf99d5683bbec2

      SHA512

      c9622babbf8e62cc0a336af03c3a58fc873688bfdc2b7e9539029c0c8cb1b62890b2f23e3779189a502963a42d0c4dab74c656f7089a78de68c9c91a26b9e85f

    • memory/4608-0-0x0000000000400000-0x000000000041D000-memory.dmp

      Filesize

      116KB

    • memory/4608-1-0x0000000000400000-0x000000000041D000-memory.dmp

      Filesize

      116KB

    • memory/4608-2-0x0000000000400000-0x000000000041D000-memory.dmp

      Filesize

      116KB

    • memory/4608-3-0x0000000002190000-0x0000000002191000-memory.dmp

      Filesize

      4KB

    • memory/4608-4-0x0000000000400000-0x000000000041D000-memory.dmp

      Filesize

      116KB

    • memory/4608-5-0x0000000000400000-0x000000000041D000-memory.dmp

      Filesize

      116KB

    • memory/4608-6-0x00000000021F0000-0x000000000220B000-memory.dmp

      Filesize

      108KB

    • memory/4608-7-0x00000000021F0000-0x000000000220B000-memory.dmp

      Filesize

      108KB

    • memory/4608-9-0x0000000000400000-0x000000000041D000-memory.dmp

      Filesize

      116KB

    • memory/4608-11-0x0000000000400000-0x000000000041D000-memory.dmp

      Filesize

      116KB