Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/05/2024, 17:32

General

  • Target

    virussign.com_27b6bd825a546f97eef0488370acc8a0.exe

  • Size

    37KB

  • MD5

    27b6bd825a546f97eef0488370acc8a0

  • SHA1

    50262c75d6e81573795311da39f3784554cde50f

  • SHA256

    0b6c36488bcb097d2b217fd15c7794c54a7991b6c9858e2dfa2bd06c3f3c41e7

  • SHA512

    f6aa891e1c291be4407c9e775ed5222b6b3ca5dc54adbd4f40d4ed5b8aa09b359abdfdd9479b14d537d9d3fc7fe567616b650513a41222235ae286fafdf9e789

  • SSDEEP

    384:oPDUQ/pgeY/PiZpIPHbABisNtA0lYDlIq9dXrm7AG3fmPIJq96NhKl1S:+l/BEPiAvbAbDYDlJdXqEG3eyDKk

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\virussign.com_27b6bd825a546f97eef0488370acc8a0.exe
    "C:\Users\Admin\AppData\Local\Temp\virussign.com_27b6bd825a546f97eef0488370acc8a0.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1612
    • C:\Users\Admin\AppData\Local\Temp\gffos.exe
      "C:\Users\Admin\AppData\Local\Temp\gffos.exe"
      2⤵
      • Executes dropped EXE
      PID:2960

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\gffos.exe

    Filesize

    37KB

    MD5

    56cd1c76e6db9e34e5352b0e6f4135b7

    SHA1

    da5ab9ecee9e48311ee05b8cfbefa83bf7be574c

    SHA256

    fda2c6cdab82ab5ad6703ce18842db15dced49b2e1c817d7278c15ba5f4cff5d

    SHA512

    88bf86a1583bc478bb6c18f67a454046487b3f944def6818bb58c9c4e5524a69d68428249303f63dadf3539c2f02b177197f1403021b901b6197f05ecfd8ef41

  • memory/1612-0-0x0000000000400000-0x0000000000406000-memory.dmp

    Filesize

    24KB

  • memory/1612-1-0x0000000000400000-0x0000000000406000-memory.dmp

    Filesize

    24KB

  • memory/1612-7-0x0000000000570000-0x0000000000578000-memory.dmp

    Filesize

    32KB

  • memory/2960-24-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2960-23-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2960-28-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2960-27-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB