Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
12/03/2024, 06:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c2ae41799abd0aec2f314e0bd87bb133.exe
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
c2ae41799abd0aec2f314e0bd87bb133.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
c2ae41799abd0aec2f314e0bd87bb133.exe
-
Size
32KB
-
MD5
c2ae41799abd0aec2f314e0bd87bb133
-
SHA1
65d79365725ff9db88dc0a805af3043a345d5527
-
SHA256
9c30af80b1157a7b58928f68d1953b682e1a86cc517dd2d9a5c2e24b0138ffa8
-
SHA512
2058d0f835fc08b692127212d5096997095af700f589a3b5eddca45e0b7ad617172e3ed818ec32c7790fc395f15363f014d15882c87e4b16a94d34032a15ae26
-
SSDEEP
768:0gle1KJVkUyy0zjKLWYuCHyujGbtdekYaAnbcuyD7Ue5J:dM1KJFyy0PKLWYuAyuqbD8nouy8eX
Score
7/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation c2ae41799abd0aec2f314e0bd87bb133.exe -
Loads dropped DLL 1 IoCs
pid Process 3724 c2ae41799abd0aec2f314e0bd87bb133.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\240604765.TMP c2ae41799abd0aec2f314e0bd87bb133.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\Common Files\realteck\geoidq.pif c2ae41799abd0aec2f314e0bd87bb133.exe File opened for modification C:\Program Files (x86)\Common Files\realteck\geoidq.pif c2ae41799abd0aec2f314e0bd87bb133.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings explorer.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3724 c2ae41799abd0aec2f314e0bd87bb133.exe 3724 c2ae41799abd0aec2f314e0bd87bb133.exe 3724 c2ae41799abd0aec2f314e0bd87bb133.exe 3724 c2ae41799abd0aec2f314e0bd87bb133.exe 3724 c2ae41799abd0aec2f314e0bd87bb133.exe 3724 c2ae41799abd0aec2f314e0bd87bb133.exe 3724 c2ae41799abd0aec2f314e0bd87bb133.exe 3724 c2ae41799abd0aec2f314e0bd87bb133.exe 3724 c2ae41799abd0aec2f314e0bd87bb133.exe 3724 c2ae41799abd0aec2f314e0bd87bb133.exe 3724 c2ae41799abd0aec2f314e0bd87bb133.exe 3724 c2ae41799abd0aec2f314e0bd87bb133.exe 3724 c2ae41799abd0aec2f314e0bd87bb133.exe 3724 c2ae41799abd0aec2f314e0bd87bb133.exe 3724 c2ae41799abd0aec2f314e0bd87bb133.exe 3724 c2ae41799abd0aec2f314e0bd87bb133.exe 3724 c2ae41799abd0aec2f314e0bd87bb133.exe 3724 c2ae41799abd0aec2f314e0bd87bb133.exe 3724 c2ae41799abd0aec2f314e0bd87bb133.exe 3724 c2ae41799abd0aec2f314e0bd87bb133.exe 3724 c2ae41799abd0aec2f314e0bd87bb133.exe 3724 c2ae41799abd0aec2f314e0bd87bb133.exe 3724 c2ae41799abd0aec2f314e0bd87bb133.exe 3724 c2ae41799abd0aec2f314e0bd87bb133.exe 3724 c2ae41799abd0aec2f314e0bd87bb133.exe 3724 c2ae41799abd0aec2f314e0bd87bb133.exe 3724 c2ae41799abd0aec2f314e0bd87bb133.exe 3724 c2ae41799abd0aec2f314e0bd87bb133.exe 3724 c2ae41799abd0aec2f314e0bd87bb133.exe 3724 c2ae41799abd0aec2f314e0bd87bb133.exe 3724 c2ae41799abd0aec2f314e0bd87bb133.exe 3724 c2ae41799abd0aec2f314e0bd87bb133.exe 3724 c2ae41799abd0aec2f314e0bd87bb133.exe 3724 c2ae41799abd0aec2f314e0bd87bb133.exe 3724 c2ae41799abd0aec2f314e0bd87bb133.exe 3724 c2ae41799abd0aec2f314e0bd87bb133.exe 3724 c2ae41799abd0aec2f314e0bd87bb133.exe 3724 c2ae41799abd0aec2f314e0bd87bb133.exe 3724 c2ae41799abd0aec2f314e0bd87bb133.exe 3724 c2ae41799abd0aec2f314e0bd87bb133.exe 3724 c2ae41799abd0aec2f314e0bd87bb133.exe 3724 c2ae41799abd0aec2f314e0bd87bb133.exe 3724 c2ae41799abd0aec2f314e0bd87bb133.exe 3724 c2ae41799abd0aec2f314e0bd87bb133.exe 3724 c2ae41799abd0aec2f314e0bd87bb133.exe 3724 c2ae41799abd0aec2f314e0bd87bb133.exe 3724 c2ae41799abd0aec2f314e0bd87bb133.exe 3724 c2ae41799abd0aec2f314e0bd87bb133.exe 3724 c2ae41799abd0aec2f314e0bd87bb133.exe 3724 c2ae41799abd0aec2f314e0bd87bb133.exe 3724 c2ae41799abd0aec2f314e0bd87bb133.exe 3724 c2ae41799abd0aec2f314e0bd87bb133.exe 3724 c2ae41799abd0aec2f314e0bd87bb133.exe 3724 c2ae41799abd0aec2f314e0bd87bb133.exe 3724 c2ae41799abd0aec2f314e0bd87bb133.exe 3724 c2ae41799abd0aec2f314e0bd87bb133.exe 3724 c2ae41799abd0aec2f314e0bd87bb133.exe 3724 c2ae41799abd0aec2f314e0bd87bb133.exe 3724 c2ae41799abd0aec2f314e0bd87bb133.exe 3724 c2ae41799abd0aec2f314e0bd87bb133.exe 3724 c2ae41799abd0aec2f314e0bd87bb133.exe 3724 c2ae41799abd0aec2f314e0bd87bb133.exe 3724 c2ae41799abd0aec2f314e0bd87bb133.exe 3724 c2ae41799abd0aec2f314e0bd87bb133.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3724 c2ae41799abd0aec2f314e0bd87bb133.exe Token: SeDebugPrivilege 3724 c2ae41799abd0aec2f314e0bd87bb133.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3724 wrote to memory of 4964 3724 c2ae41799abd0aec2f314e0bd87bb133.exe 92 PID 3724 wrote to memory of 4964 3724 c2ae41799abd0aec2f314e0bd87bb133.exe 92 PID 3724 wrote to memory of 4964 3724 c2ae41799abd0aec2f314e0bd87bb133.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\c2ae41799abd0aec2f314e0bd87bb133.exe"C:\Users\Admin\AppData\Local\Temp\c2ae41799abd0aec2f314e0bd87bb133.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3724 -
C:\Windows\SysWOW64\explorer.exe"C:\Windows\System32\explorer.exe"2⤵
- Modifies registry class
PID:4964
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12.2MB
MD5bf83eacedf518e5fdb0d5a6a4e6f3c5b
SHA10299af0dd327a53a4d789674d550b6531a93b9dc
SHA256a2ff82aa1fb39b52f7b832e18863f274ed81b044c5362fca28fd7bb15c8f6c5f
SHA512aea511fdca03d13924def1b3099fa2663f7f012bee7c741b35aca332d2324ead8b1eb7121f165c1a46d50bd7764e12bec8bd0bdec9029742d9f5340173fad718