Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
10/04/2024, 05:44
Behavioral task
behavioral1
Sample
1e805c0b8a34c6295ec6e7d02c0f0539.exe
Resource
win7-20240221-en
General
-
Target
1e805c0b8a34c6295ec6e7d02c0f0539.exe
-
Size
342KB
-
MD5
1e805c0b8a34c6295ec6e7d02c0f0539
-
SHA1
79ab51cb5f5b2b4141eb1a3ec88ee45aca06d027
-
SHA256
c696b1ba3409aa799769815a4bcc1da27e52e80b8fc2731d6e1713ff52be9160
-
SHA512
38a508d1100e91f4845b6933dfc432d4c8ef658da1d2bc817cc7dfb3e4e17c4386fb4685e8a3ffb4cc6a312853b81ee49be8c97e0758ab68aabd445f286dadea
-
SSDEEP
6144:Nd7rpL43btmQ58Z27zw39gY2FeZhrL8Jt:X7dL4AZ0U9gY2Fhz
Malware Config
Extracted
urelas
218.54.31.165
218.54.31.226
Signatures
-
resource yara_rule behavioral2/files/0x0002000000021d42-32.dat aspack_v212_v242 -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation 1e805c0b8a34c6295ec6e7d02c0f0539.exe Key value queried \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation codum.exe Key value queried \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation ajlisi.exe -
Executes dropped EXE 3 IoCs
pid Process 1380 codum.exe 4636 ajlisi.exe 3872 filed.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3872 filed.exe 3872 filed.exe 3872 filed.exe 3872 filed.exe 3872 filed.exe 3872 filed.exe 3872 filed.exe 3872 filed.exe 3872 filed.exe 3872 filed.exe 3872 filed.exe 3872 filed.exe 3872 filed.exe 3872 filed.exe 3872 filed.exe 3872 filed.exe 3872 filed.exe 3872 filed.exe 3872 filed.exe 3872 filed.exe 3872 filed.exe 3872 filed.exe 3872 filed.exe 3872 filed.exe 3872 filed.exe 3872 filed.exe 3872 filed.exe 3872 filed.exe 3872 filed.exe 3872 filed.exe 3872 filed.exe 3872 filed.exe 3872 filed.exe 3872 filed.exe 3872 filed.exe 3872 filed.exe 3872 filed.exe 3872 filed.exe 3872 filed.exe 3872 filed.exe 3872 filed.exe 3872 filed.exe 3872 filed.exe 3872 filed.exe 3872 filed.exe 3872 filed.exe 3872 filed.exe 3872 filed.exe 3872 filed.exe 3872 filed.exe 3872 filed.exe 3872 filed.exe 3872 filed.exe 3872 filed.exe 3872 filed.exe 3872 filed.exe 3872 filed.exe 3872 filed.exe 3872 filed.exe 3872 filed.exe 3872 filed.exe 3872 filed.exe 3872 filed.exe 3872 filed.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 3772 wrote to memory of 1380 3772 1e805c0b8a34c6295ec6e7d02c0f0539.exe 87 PID 3772 wrote to memory of 1380 3772 1e805c0b8a34c6295ec6e7d02c0f0539.exe 87 PID 3772 wrote to memory of 1380 3772 1e805c0b8a34c6295ec6e7d02c0f0539.exe 87 PID 3772 wrote to memory of 4776 3772 1e805c0b8a34c6295ec6e7d02c0f0539.exe 88 PID 3772 wrote to memory of 4776 3772 1e805c0b8a34c6295ec6e7d02c0f0539.exe 88 PID 3772 wrote to memory of 4776 3772 1e805c0b8a34c6295ec6e7d02c0f0539.exe 88 PID 1380 wrote to memory of 4636 1380 codum.exe 90 PID 1380 wrote to memory of 4636 1380 codum.exe 90 PID 1380 wrote to memory of 4636 1380 codum.exe 90 PID 4636 wrote to memory of 3872 4636 ajlisi.exe 102 PID 4636 wrote to memory of 3872 4636 ajlisi.exe 102 PID 4636 wrote to memory of 3872 4636 ajlisi.exe 102 PID 4636 wrote to memory of 4392 4636 ajlisi.exe 103 PID 4636 wrote to memory of 4392 4636 ajlisi.exe 103 PID 4636 wrote to memory of 4392 4636 ajlisi.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\1e805c0b8a34c6295ec6e7d02c0f0539.exe"C:\Users\Admin\AppData\Local\Temp\1e805c0b8a34c6295ec6e7d02c0f0539.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3772 -
C:\Users\Admin\AppData\Local\Temp\codum.exe"C:\Users\Admin\AppData\Local\Temp\codum.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1380 -
C:\Users\Admin\AppData\Local\Temp\ajlisi.exe"C:\Users\Admin\AppData\Local\Temp\ajlisi.exe" OK3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\filed.exe"C:\Users\Admin\AppData\Local\Temp\filed.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3872
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "4⤵PID:4392
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "2⤵PID:4776
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
276B
MD52b304a44c6cca72085cf0b05f7aa3795
SHA132000767f611829ec66aead42dccf9a2d601d972
SHA2564b74b0bed07c35ac6fbe5c275f96a8f06b81a1f32d93e2390ae1f1c2e7cf71e8
SHA51240aac327cbc311cd1a3d33c6fd6f6666a255a2eda96dcaeef406ee7a5bc6bdaef8cf870266c351484c2c7fa3c294c40bb11c28ba616458a2e4ee0c5432000d1b
-
Filesize
224B
MD5cc8df6f29246dee6df6f7eebed3f5745
SHA1bb5775dab6e8b45fd362add783cb76ab09050568
SHA256d23ebb7464d9db8268131685e425d3a3019a1d123980a203fca1a7f2d47eb296
SHA5127e4c9571856d4fd73cb313a3daaf584d1c408812c6cb2119eb4dd9dd2264c68faf3cf0187efc34e103faf032cd09bb2fbc1343b1dc293a1d44b1ec238b184ff0
-
Filesize
342KB
MD51352eedeee97d1b612a365045754df06
SHA1d52c87e85c51f9a0adf7bd17807a2e2fb070c043
SHA256e67c3bb9012e1e1b1ef67ae99c0b6cdc489cebf37d5152ea0ee6ffd49fc8f79d
SHA51226fb255f8add5d684d885d6287bc1344d47c03620eb13f1af4eb05722e12c53436be63781642b6667fefb4d18cacf1755ad430b88574de6a9e8ca1e78ff769b7
-
Filesize
136KB
MD5739e35984ed54c806e950c7290b94274
SHA15b56327d36eb2ce3c2cdec4e511a776a85eb4e0c
SHA256541efd367be3f69683d70d394d57e812c659e56c48bd608b5b028e6e9a18fc57
SHA5120d1d81bab6e2a6cb25b0f31528c6921ca3cc0cfbe509dd684d1dab3879ae54d052035cc0bbb41e3cf797cc3c41117de4a68ce6a21df907f32f4f309cb33c8485
-
Filesize
512B
MD5bbd575a4c13d643137491b0dd7d91b84
SHA139871f59de696d369c94dad686773805985daed7
SHA256e2dae17b6be9459107b2dee69997a4097a8b0ccd1584a181f27d10eec096f5c7
SHA512f257a24f3131edadd554f615615800b211cb9a50160d42d664221f9081417485da5445126aaa0acb081812880f7a463958583fb0001168c2be17ffdaa7ea2802