Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    144s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/02/2024, 03:02

General

  • Target

    4894bc7735bca984d5f26b10fec4d3a9a11dd2c0b97c9b425b273cc591867fae.exe

  • Size

    1.9MB

  • MD5

    5ae89e6fcf3c74e56e704249ee135743

  • SHA1

    73e63b6a8dece9aa3c30bd10208e51eb0fcb384d

  • SHA256

    4894bc7735bca984d5f26b10fec4d3a9a11dd2c0b97c9b425b273cc591867fae

  • SHA512

    2c340d86fd92704d17e1ad2cdd515230d69b36f58510ddd62cc48a4c97ea30b1beb54c8a893a01aac6fcb11f6b4a621b632dec178adf0f110f7bdf36c0630d19

  • SSDEEP

    49152:anGImUVyvKVnTP4dy9f4bjoeUh8XJGgsRZa65N:aGIEStD4E9Q/XUyka4

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4894bc7735bca984d5f26b10fec4d3a9a11dd2c0b97c9b425b273cc591867fae.exe
    "C:\Users\Admin\AppData\Local\Temp\4894bc7735bca984d5f26b10fec4d3a9a11dd2c0b97c9b425b273cc591867fae.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:2420
    • C:\Windows\SysWOW64\regsvr32.exe
      "C:\Windows\System32\regsvr32.exe" -u mU9OPFEE.J /s
      2⤵
      • Loads dropped DLL
      PID:5964

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\mU9OPFEE.J

    Filesize

    1.7MB

    MD5

    dc9c2979b45a80c4cff1044d0897fe93

    SHA1

    e6068411c5e6d105815030367a11112459c7e30b

    SHA256

    7954cdb6ca140a51fafdd9750a729bc6e6efdd7d8a3f04dd0d79cf43eb0629ff

    SHA512

    9cb48868011f0a5f6fb0c6a6b8bea068990178e8a95c85e5157ac90ef87debac41919221ec8e4f46246e4d32b396fbe76c24c62fd9c13cc49f63e57331377bd5

  • memory/5964-4-0x0000000010000000-0x00000000101AD000-memory.dmp

    Filesize

    1.7MB

  • memory/5964-6-0x0000000000720000-0x0000000000726000-memory.dmp

    Filesize

    24KB

  • memory/5964-7-0x00000000024F0000-0x000000000261E000-memory.dmp

    Filesize

    1.2MB

  • memory/5964-8-0x0000000002620000-0x0000000002731000-memory.dmp

    Filesize

    1.1MB

  • memory/5964-11-0x0000000002620000-0x0000000002731000-memory.dmp

    Filesize

    1.1MB

  • memory/5964-9-0x0000000002620000-0x0000000002731000-memory.dmp

    Filesize

    1.1MB

  • memory/5964-12-0x0000000010000000-0x00000000101AD000-memory.dmp

    Filesize

    1.7MB

  • memory/5964-15-0x0000000002620000-0x0000000002731000-memory.dmp

    Filesize

    1.1MB

  • memory/5964-16-0x0000000002740000-0x0000000004083000-memory.dmp

    Filesize

    25.3MB

  • memory/5964-17-0x00000000008B0000-0x00000000009B0000-memory.dmp

    Filesize

    1024KB

  • memory/5964-19-0x0000000004090000-0x000000000418F000-memory.dmp

    Filesize

    1020KB

  • memory/5964-22-0x0000000004090000-0x000000000418F000-memory.dmp

    Filesize

    1020KB

  • memory/5964-23-0x00000000002D0000-0x00000000002E1000-memory.dmp

    Filesize

    68KB

  • memory/5964-24-0x000000006A5C0000-0x000000006A613000-memory.dmp

    Filesize

    332KB