Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
-
submitted
05/07/2024, 23:25
General
-
Target
7e31c9ae4cd06fe69fb0673b0487b2832883a8ff5e4344c40f92fa2bdf4da4f0.exe
-
Size
467KB
-
MD5
cc93a3358bb6f22c7fe079ff7929fb68
-
SHA1
aa406c38384c33ed88eabc8d23d00b11607de408
-
SHA256
7e31c9ae4cd06fe69fb0673b0487b2832883a8ff5e4344c40f92fa2bdf4da4f0
-
SHA512
1ac16dd681dfaa889cbbba70153ed8f7acfd20b45e8f3a5b82687d19928e8aa8f77b1b3bb71e053511e65598dada5016e360a8105a40326ccfe2f673864cebc7
-
SSDEEP
12288:pWBm+95nHfF2mgewFX5HEB/qaz2giyyDHaet7:pWBz95ndbgfX5kB/LhyWeB
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies registry class 1 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of SetWindowsHookEx 8 IoCs
-
Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7e31c9ae4cd06fe69fb0673b0487b2832883a8ff5e4344c40f92fa2bdf4da4f0.exe"C:\Users\Admin\AppData\Local\Temp\7e31c9ae4cd06fe69fb0673b0487b2832883a8ff5e4344c40f92fa2bdf4da4f0.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AA3A.tmp"C:\Users\Admin\AppData\Local\Temp\AA3A.tmp" --pingC:\Users\Admin\AppData\Local\Temp\7e31c9ae4cd06fe69fb0673b0487b2832883a8ff5e4344c40f92fa2bdf4da4f0.exe 529D9023526FB3C7D24A66409739C6F2D99855C8244238286663153391999EA1AD1DC96614BD3179DFA44B29993B3AB63AE397219D8C566521FEDE352955B2192⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\7e31c9ae4cd06fe69fb0673b0487b2832883a8ff5e4344c40f92fa2bdf4da4f0.doc" /o ""3⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
35KB
MD559975947e6db92e743655ebdf2e3c495
SHA15e967d85a4df28f9fed485156919a14fb411d18d
SHA25683c9df8884ffd5b51bdbdb9314d587477ecf50c3144c6c230ded3a3041f24e05
SHA5121cdc533bcc9bf50c69dd3a516c4fff8f24cf2ba9ecf1df885c12d4f459727b63c2d7f1a388ac0a4ac2fe59fe1bd5f5cb623001c736df33490fb245e06d7af692
-
Filesize
467KB
MD5ff8204124d583de14ec069857bcdf148
SHA192b64774390e105fb160576380e256214c3feaca
SHA2564832717295959fa5e1bd6c867d4fd27692410535d2c559fbdee34adc52e9ccf5
SHA5125138e32787ae9f370fc76ab6b9a282819325eb0bcf8ce381ba5e4dc8f94fdadc690e618f11d0f0da5e163b117bf82a62c667b0ca5759965e31638c0291e4cd69
-
Filesize
245KB
MD5f883b260a8d67082ea895c14bf56dd56
SHA17954565c1f243d46ad3b1e2f1baf3281451fc14b
SHA256ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353
SHA512d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
504KB
-
Filesize
504KB
-
Filesize
504KB
-
Filesize
504KB