Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/03/2024, 23:13

General

  • Target

    97c8189bf408b9696373001409db2c99ad8728a8f2872f42a5931a965f5d4b55.exe

  • Size

    7KB

  • MD5

    ab443ea6d15f67cf20f454658ce4325b

  • SHA1

    c59f879f32f02ace94c3f7ee67dfdab3357dcbb2

  • SHA256

    97c8189bf408b9696373001409db2c99ad8728a8f2872f42a5931a965f5d4b55

  • SHA512

    6609cdf8eb9a20894bb1449bc06269a5cc4a2b6dc6b59e22fb1ca086500cbf9ee69390091d0cbb12a3f2d64403948bffffb33b706e00b850207ac8807619cf3c

  • SSDEEP

    192:GtmcWKG93nKfzum8axTcYx/W8uGkOcNYh:ZKa3KfzumXxTZxhuGDcuh

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\97c8189bf408b9696373001409db2c99ad8728a8f2872f42a5931a965f5d4b55.exe
    "C:\Users\Admin\AppData\Local\Temp\97c8189bf408b9696373001409db2c99ad8728a8f2872f42a5931a965f5d4b55.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:2336
    • C:\Users\Admin\AppData\Local\Temp\gdlwh.exe
      "C:\Users\Admin\AppData\Local\Temp\gdlwh.exe"
      2⤵
      • Executes dropped EXE
      PID:1624
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4396 --field-trial-handle=2264,i,7010714054498059916,1862725710331979271,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:1952

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\gdlwh.exe

      Filesize

      7KB

      MD5

      ea89cdf64650d79a4c8d6b125ba39ff7

      SHA1

      84e6c821f0acd26286f23d67b51f89d533c4157d

      SHA256

      e1fc53d432582e27ed7de89205bd6261e6bddaf2157754c512642d900963d194

      SHA512

      052012a93c1e213641a159b28208965072a9e58d7a16849d9a7ba9b70b4ff73bc0d5a333f2a18a71657713ba3e714b5bf987576af659507b476589dee900b310