Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

f4570a3e1a...f9.exe

windows7-x64

9

f4570a3e1a...f9.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    149s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/03/2024, 01:57

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    f4570a3e1ae9fb5307f321983c446d9bbef183de59726bd11be5440e6faf25f9.exe

  • Size

    161KB

  • MD5

    f44f1d6941436fe095bef7425f850335

  • SHA1

    e442ae7623976fbc3b8bcd1118cdf9bd3ec2d6a3

  • SHA256

    f4570a3e1ae9fb5307f321983c446d9bbef183de59726bd11be5440e6faf25f9

  • SHA512

    afd084d03ea732dda2a331e4ffd5cbdbed6181649c520cd2a9b9522033eeaf4722b680ac920a666281f8ce6cd20c33aa6f36646e944b8b050973be544a3b850a

  • SSDEEP

    3072:qv5Ls27BIJo7LyXuM/XXXdwVBXXXhYfjCXXXDrXXXDKXXXmfXXXxXXXLIIIBoqfm:qBs27V7LyXf/XXX2VBXXXefjCXXXDrXf

Score
9/10

Malware Config

Signatures

  • Detects Windows executables referencing non-Windows User-Agents 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f4570a3e1ae9fb5307f321983c446d9bbef183de59726bd11be5440e6faf25f9.exe
    "C:\Users\Admin\AppData\Local\Temp\f4570a3e1ae9fb5307f321983c446d9bbef183de59726bd11be5440e6faf25f9.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3804
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\F4570A~1.EXE > nul
      2⤵
        PID:4016
    • C:\Windows\Debug\egkhost.exe
      C:\Windows\Debug\egkhost.exe
      1⤵
      • Executes dropped EXE
      • Checks processor information in registry
      PID:3184

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Windows\debug\egkhost.exe
      Filesize

      161KB

      MD5

      c67559301fa6b512c901c2e5542fdc5b

      SHA1

      4a9a10a229ebf43a3219d977d7415c3793f542bc

      SHA256

      25120f71ce7a84b15457f8d64af3f60dca8ceac7e6a65e8d1d0a7bc55093f08f

      SHA512

      ceaf16aedf97a364be74c1ece4c1c45400ba1fbad1a6cbb68059aae6aa18433a58849c50fa17c05f870fb0f84c21b072545f95fb34c774091bc875b8351cda97

      Download Submit