Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/04/2024, 20:51

General

  • Target

    35d84579de71a7dd0de1deef45157fa96d4e9be51702cc78a9f22a355dbf26ed.exe

  • Size

    204KB

  • MD5

    4c587616b34b14a4f488d4925dc40a83

  • SHA1

    fbea1bde742fbbc11055a5afb963cb4c8d54d327

  • SHA256

    35d84579de71a7dd0de1deef45157fa96d4e9be51702cc78a9f22a355dbf26ed

  • SHA512

    6d278d62dad5ee70f2ed0019703a43aaecf9d762929ce9d3630f940baecbb5a343ceaf53f444eb91af91b0e3d992032d66a8195157e4827179490808d9bc69f8

  • SSDEEP

    3072:kmlW8tB0tQ9nLHbB9W0c1TqECzR/mkSYGrl9ymgYUWYQ:/0E4QxL7B9W0c1RCzR/fSmlu

Score
10/10

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 27 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\35d84579de71a7dd0de1deef45157fa96d4e9be51702cc78a9f22a355dbf26ed.exe
    "C:\Users\Admin\AppData\Local\Temp\35d84579de71a7dd0de1deef45157fa96d4e9be51702cc78a9f22a355dbf26ed.exe"
    1⤵
    • Modifies visiblity of hidden/system files in Explorer
    • Checks computer location settings
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4532
    • C:\Users\Admin\voauz.exe
      "C:\Users\Admin\voauz.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:4812

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\voauz.exe

    Filesize

    204KB

    MD5

    3eda69ba881e10081f6223a8f1a5d69a

    SHA1

    8720a5c2e1636fdb6b26ed1154e9de53b3378d5b

    SHA256

    c00a9576f6a82677a2bfad63424556a0539669e3809ddadbed43ca67968630b2

    SHA512

    c5ed020a4f6335dcafd78227fd220e1a6281d7f8565af8f06105582785a3321f68e33b3264b8dbf1b8b27df7b96c605875e5d65e83d884d026eddeca2500e3c1