Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
157s -
max time network
165s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
29/02/2024, 03:31
Behavioral task
behavioral1
Sample
d8efc3a4092fc2f5e36938dff8fabc99.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
d8efc3a4092fc2f5e36938dff8fabc99.exe
Resource
win10v2004-20240226-en
General
-
Target
d8efc3a4092fc2f5e36938dff8fabc99.exe
-
Size
34KB
-
MD5
d8efc3a4092fc2f5e36938dff8fabc99
-
SHA1
194f99ddc2d39401e77d66c4efbead29178651a1
-
SHA256
a6cec81e625dac4847ed7a37ad2509b0cff0a5307f9733cf726fcc14c5281467
-
SHA512
683ce64560669223f5f54ee313de4de5d7be8df10587e940b01ba3ebf8b770445dbc3bae600cba38573766afe636c035296bef31b9eb9952d43f366af8bd23ea
-
SSDEEP
768:qUmnjFom/kLyMro2GtOOtEvwDpjeMLam5ax6:qUmnpomddpMOtEvwDpjjaYa4
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation d8efc3a4092fc2f5e36938dff8fabc99.exe -
Executes dropped EXE 1 IoCs
pid Process 3056 asih.exe -
resource yara_rule behavioral2/memory/2000-0-0x0000000000500000-0x000000000050F000-memory.dmp upx behavioral2/files/0x000a00000002322e-13.dat upx behavioral2/memory/2000-17-0x0000000000500000-0x000000000050F000-memory.dmp upx behavioral2/memory/3056-26-0x0000000000500000-0x000000000050F000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2000 wrote to memory of 3056 2000 d8efc3a4092fc2f5e36938dff8fabc99.exe 90 PID 2000 wrote to memory of 3056 2000 d8efc3a4092fc2f5e36938dff8fabc99.exe 90 PID 2000 wrote to memory of 3056 2000 d8efc3a4092fc2f5e36938dff8fabc99.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\d8efc3a4092fc2f5e36938dff8fabc99.exe"C:\Users\Admin\AppData\Local\Temp\d8efc3a4092fc2f5e36938dff8fabc99.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
PID:3056
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
34KB
MD5bb91d1538d0c9936f73a8b7a6f548290
SHA16ba5b14cb7f36ca7b27b7d8cf980fd99af4dd57e
SHA256f57ca224788a428c17b0c6235937e924ac8d21ead3ff5e6cba88c5d15fcd0efd
SHA512f6b1885c39ac07fe4771a5610178e23c349226b98a54e17371857f74ce02596e0d058fdd18e7c750e365706296ebd4111e00d265bc9433c658e664304e012387