Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/03/2024, 21:16

General

  • Target

    898ff5567d3d35505827f207a6084076499cecdc6b7d08e46d3423a7df8fe09e.exe

  • Size

    32KB

  • MD5

    a4f1aa09d04498473138967a32f151ee

  • SHA1

    0d00b4552326b3dbb81d954c66d1a82a3755f4cf

  • SHA256

    898ff5567d3d35505827f207a6084076499cecdc6b7d08e46d3423a7df8fe09e

  • SHA512

    8ff4bb26613ecaf654af0e8bfd6236a4fa9131db0b107c8a7ac12cf5caae3fa50c8e916117e454d04479b8efcd9d0a1c90f858c78738a81b38ae25ad59d68cf8

  • SSDEEP

    384:sAI5y8tO/IgoM7cslMSa8AWpC81HMPQQQCH3oS97PeTL/oxFTSkuWmg:sAI5y4MnESa8AWoHnKv/2FWkJ1

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\898ff5567d3d35505827f207a6084076499cecdc6b7d08e46d3423a7df8fe09e.exe
    "C:\Users\Admin\AppData\Local\Temp\898ff5567d3d35505827f207a6084076499cecdc6b7d08e46d3423a7df8fe09e.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:776
    • C:\Users\Admin\AppData\Local\Temp\ieupdate.exe
      "C:\Users\Admin\AppData\Local\Temp\ieupdate.exe"
      2⤵
      • Executes dropped EXE
      PID:1856

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\ieupdate.exe

    Filesize

    32KB

    MD5

    bee2c663c2852b557093f0312b03e3a2

    SHA1

    3934489ca86c66fb33db97daa41018dd3e1178eb

    SHA256

    4f37953bb37781f66891dec01485eea2e9b2db738d22d6aa4e3c41edcf85e0df

    SHA512

    b9462d878000f933972e2ee84eafb71da751a71e41c8ed0b5d16885fe049f993f656b8bf61a2817a7c11309349cb5c34cef3805689ff08a931f3edcfa3b6b98c

  • memory/776-0-0x0000000000400000-0x0000000000407000-memory.dmp

    Filesize

    28KB

  • memory/1856-9-0x0000000000400000-0x0000000000407000-memory.dmp

    Filesize

    28KB