Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    143s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/05/2024, 04:06

General

  • Target

    f1fdef9f6fa0dd917be4b21fe2135e83499a198a38511f2a3fcbf1497424eec0.exe

  • Size

    70KB

  • MD5

    047c7f180b7249188259d89bebca1081

  • SHA1

    491ed4fb0abde863b8dae3aaae12a3aea9141574

  • SHA256

    f1fdef9f6fa0dd917be4b21fe2135e83499a198a38511f2a3fcbf1497424eec0

  • SHA512

    fd6764b0cda9a6c271cb19b15c136e0ea657f16c108c2334b08fc6d4a2bce8d380eca91b9e5bf2c48a3e0e7a98933ac4605c14d0a0ff9ae28809d788ecab0cad

  • SSDEEP

    384:dbnwR2FRnlaeZC1t32L8bG2RbuQb90PGDyaT5jR9BsjeFTiCaqiw/2NwNRdvA65:dDwRAnRAGeiPPGDNv6bwteGR1r5

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f1fdef9f6fa0dd917be4b21fe2135e83499a198a38511f2a3fcbf1497424eec0.exe
    "C:\Users\Admin\AppData\Local\Temp\f1fdef9f6fa0dd917be4b21fe2135e83499a198a38511f2a3fcbf1497424eec0.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:656
    • C:\Users\Admin\AppData\Local\Temp\hummy.exe
      "C:\Users\Admin\AppData\Local\Temp\hummy.exe"
      2⤵
      • Executes dropped EXE
      PID:4284
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4120 --field-trial-handle=2284,i,15722001240173834669,15048020084704567542,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:4804

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\hummy.exe

      Filesize

      71KB

      MD5

      82d12ac92a827c18877a2155230f4306

      SHA1

      f6046c3c65424507f7d6a5711530bb10877bef30

      SHA256

      98810f018a2321fd7241384f697413e87409a71ccee243058996b4adff36d4c6

      SHA512

      9195c8f1a96269d99aae1c8fd7563c86381969891909057508b61d3376f4d23cadc0e029da0a875997ded7b7594ef4485291c0fbc8d17907c1728fc5953cc320