Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/04/2024, 21:08

General

  • Target

    489ea846f892d2eb3bd097dcc52f7d52d9f91caf82c956d0bce528b32c45a749.exe

  • Size

    160KB

  • MD5

    02403d610d70d5bdb9cd5435a95fa131

  • SHA1

    15d6ed60f1b4df30a8d0ac62529a783e807b1b45

  • SHA256

    489ea846f892d2eb3bd097dcc52f7d52d9f91caf82c956d0bce528b32c45a749

  • SHA512

    edb5395efb5b1e4804d7e2ab764d3e2d5413110d74ae9f891bc3384b14e00c683e96c522994ef8b5c94cd9e7ebcbd2e7552573fb0135d2279bf6fe3788525de3

  • SSDEEP

    768:YJXL+uSmvNAci2FhoJ0h4h2hQJVNjDkp57xXp5Rmg5Fh4hqhxOhDhzhnhvhzhOhs:Y9qhcimJh4h2hON6x5puwVT0B

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 51 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\489ea846f892d2eb3bd097dcc52f7d52d9f91caf82c956d0bce528b32c45a749.exe
    "C:\Users\Admin\AppData\Local\Temp\489ea846f892d2eb3bd097dcc52f7d52d9f91caf82c956d0bce528b32c45a749.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4480
    • C:\Users\Admin\tiefom.exe
      "C:\Users\Admin\tiefom.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4760

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\tiefom.exe

    Filesize

    160KB

    MD5

    ca19f6ac05a7813450854b822b3f0af0

    SHA1

    7f12ef55a3aa3ea92866925bbb3e755988128f5b

    SHA256

    599fe3581526a41d83a10d437e2ef51e4973f0e2c9e961f6a03920bdaa68c5b3

    SHA512

    a331329f9cbc41427fc690cde9aa237e1b09348933a945f87d1bf411445be71654e28140c4f303c362548463102ed6825c69567502fc66100ec8ca48fd4684db