Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
93s -
max time network
113s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
28/02/2024, 09:33
Static task
static1
Behavioral task
behavioral1
Sample
ab92553392399eb29fd766645331624f.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ab92553392399eb29fd766645331624f.exe
Resource
win10v2004-20240226-en
General
-
Target
ab92553392399eb29fd766645331624f.exe
-
Size
150KB
-
MD5
ab92553392399eb29fd766645331624f
-
SHA1
7313794977a4e0a6654c1e089620d0efe14ca344
-
SHA256
4f5644b3080f5142b16bad5345916d73c55d45ceb9c5f65160e3952cb03d4716
-
SHA512
8027b18415aef5048c3476930dea8596fdda9238fbc1c61aec62eb4c095f55907b6593569e2b0deb953d4fe5ded831601dad2dd9df2fa69eb8d00b5f0c0c585a
-
SSDEEP
3072:hUVMf+osr7kaDioQciE3t/01BDpAzhtbB9GdfCdt7VBpHEioayYSDHLImHeP7E:hkw+BrYTRciRA1RB+S7r1WDDNj
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation ab92553392399eb29fd766645331624f.exe -
Executes dropped EXE 1 IoCs
pid Process 4256 1.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\1.exe ab92553392399eb29fd766645331624f.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 1908 4256 WerFault.exe 89 -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 428 ab92553392399eb29fd766645331624f.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 428 wrote to memory of 4256 428 ab92553392399eb29fd766645331624f.exe 89 PID 428 wrote to memory of 4256 428 ab92553392399eb29fd766645331624f.exe 89 PID 428 wrote to memory of 4256 428 ab92553392399eb29fd766645331624f.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\ab92553392399eb29fd766645331624f.exe"C:\Users\Admin\AppData\Local\Temp\ab92553392399eb29fd766645331624f.exe"1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:428 -
C:\Windows\1.exe"C:\Windows\1.exe"2⤵
- Executes dropped EXE
PID:4256 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4256 -s 2243⤵
- Program crash
PID:1908
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4256 -ip 42561⤵PID:220
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
131KB
MD52fe1a4b5d26343029291cb6bced9f508
SHA12d4ecc208ca8ac41332a133110d11130d0cc216f
SHA256e8a665f351e024924a721b035bc6d43f1c6c6fdfaf5361194af4a8eb94e63a49
SHA512a6b9fd9861283a65448358048a2d8f9451ef8b2f74c17da2a26f8088ed4cd2c0cf79a479bd6ce95669f7c74bdcb5c5dd1104a30a9367029dc2b0cd284eeb7e53