Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240704-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/07/2024, 02:25

General

  • Target

    98cdf3bac921f39a53e362d1481d42564b6e5eb88d6c72885c4e3c174a104ced.exe

  • Size

    42KB

  • MD5

    8cd6d1fadaaab81a74c35f138a370f54

  • SHA1

    be2c612d2bc655239397d6a9bb6c1f85d86c0a3d

  • SHA256

    98cdf3bac921f39a53e362d1481d42564b6e5eb88d6c72885c4e3c174a104ced

  • SHA512

    b95e04a8ab87166394be1a78ffd50815131ecb4fab30f6ec479896acfde95f5591afbc0f757648c2bda3d2ef40a8ec2421b12dd800c7c84707d0ce4c31b44aa9

  • SSDEEP

    768:mUz4HXnmTggggggLvggggggggSvNltsdUk7Nz1XzTx6QXTDcVna:BMH3lNMKkPzT8Qsa

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\98cdf3bac921f39a53e362d1481d42564b6e5eb88d6c72885c4e3c174a104ced.exe
    "C:\Users\Admin\AppData\Local\Temp\98cdf3bac921f39a53e362d1481d42564b6e5eb88d6c72885c4e3c174a104ced.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:3472
    • C:\Users\Admin\AppData\Local\Temp\zzyap.exe
      "C:\Users\Admin\AppData\Local\Temp\zzyap.exe"
      2⤵
      • Executes dropped EXE
      PID:4444

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\zzyap.exe

    Filesize

    42KB

    MD5

    317b11a835839a56e09678a8dc487a00

    SHA1

    f99e4ab3f4f67f51668b6e774235d3e0fdfa09f9

    SHA256

    79aaefd6d2fd0e861488f62005bb10523bbf54c81ab96a92eafd123e29c8e742

    SHA512

    a36df6fabcf54be71e8e55be06a184f6c5be0418a261615d300a990c578caf0bcf683e63cd29604118111339a8a5c797eaf3ef14dadbe7211cad213b6c876af9

  • memory/3472-0-0x0000000000401000-0x0000000000402000-memory.dmp

    Filesize

    4KB

  • memory/4444-12-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB