Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
96s -
max time network
99s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
31/05/2024, 02:36
Static task
static1
Behavioral task
behavioral1
Sample
820805a7ff0979481275bf1bd3b1b4f9.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
820805a7ff0979481275bf1bd3b1b4f9.exe
Resource
win10v2004-20240508-en
General
-
Target
820805a7ff0979481275bf1bd3b1b4f9.exe
-
Size
153KB
-
MD5
820805a7ff0979481275bf1bd3b1b4f9
-
SHA1
6b0e02f92706f4918d25e332bf497e60cc6a1fe6
-
SHA256
984daa96d2ae4ba3a2cf118ec7cf2d5423bc9ea4da2898287b4ea1a2e39cac49
-
SHA512
9a99469ab99f4f6500393eca08d3321bcbaa11497dd33521f16f688e0db41b4749bde255d3534d54f0ff9fab20af82cc8dbb702be4215f5cc133b40ea5957d24
-
SSDEEP
3072:vCQHshN8TmQ+fG6V+kr9d+TpvDbTDp1BsSnt3I3ZdnEPn/:NshzQ+5VX+TpHHiSt3I3Zm
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation 820805a7ff0979481275bf1bd3b1b4f9.exe -
Executes dropped EXE 1 IoCs
pid Process 2432 820805a7ff0979481275bf1bd3b1b4f9.exe -
resource yara_rule behavioral2/files/0x00080000000233d9-4.dat upx behavioral2/memory/2432-16-0x0000000000400000-0x0000000000439000-memory.dmp upx behavioral2/memory/2432-18-0x0000000000400000-0x0000000000439000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 720 wrote to memory of 2432 720 820805a7ff0979481275bf1bd3b1b4f9.exe 81 PID 720 wrote to memory of 2432 720 820805a7ff0979481275bf1bd3b1b4f9.exe 81 PID 720 wrote to memory of 2432 720 820805a7ff0979481275bf1bd3b1b4f9.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\820805a7ff0979481275bf1bd3b1b4f9.exe"C:\Users\Admin\AppData\Local\Temp\820805a7ff0979481275bf1bd3b1b4f9.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:720 -
C:\Windows\Temp\MT\820805a7ff0979481275bf1bd3b1b4f9.exe"C:\Windows\Temp\MT\820805a7ff0979481275bf1bd3b1b4f9.exe"2⤵
- Executes dropped EXE
PID:2432
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
91KB
MD59311f139732df2f8c594de65105c3d1b
SHA128e8bccf6392bac26a85dd14762e8981dce17b84
SHA256cede15606163cddd1c1cddd2573a4a4782a63614c9c43d2427db0ce6f2ab7392
SHA51254bfaba067bfbc5e75ddbc1a9a80ad7832a60fa8c72ff615d464330e466ef0984305d7957336670bdeabe98b271b21f6202b13ab94fe7e88b48b938982bc73d6