Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    136s
  • max time network
    125s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/07/2024, 23:26

General

  • Target

    7ea0a3f65a1140ab00b48072d62c75d5bd1712d71ff1af58c58677383907c25d.exe

  • Size

    17KB

  • MD5

    4ea5e819c37598d86c5be9a35f6300c9

  • SHA1

    94e5050630feaf1832ca0407c41272967b610fb6

  • SHA256

    7ea0a3f65a1140ab00b48072d62c75d5bd1712d71ff1af58c58677383907c25d

  • SHA512

    5188eaebbab1c51b3bdd5269bb3127980bf7870231353b0a0e79f8375e9b432278a17631e892e849b648325e62adeed61d371862b2946bb0ced8af32715cf8b6

  • SSDEEP

    384:xiOQWRIga02iBunne0vq0/Cz9W5q5a8t+j:xVhRm0z+rC8Yt+j

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7ea0a3f65a1140ab00b48072d62c75d5bd1712d71ff1af58c58677383907c25d.exe
    "C:\Users\Admin\AppData\Local\Temp\7ea0a3f65a1140ab00b48072d62c75d5bd1712d71ff1af58c58677383907c25d.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:956
    • C:\Users\Admin\AppData\Local\Temp\budha.exe
      "C:\Users\Admin\AppData\Local\Temp\budha.exe"
      2⤵
      • Executes dropped EXE
      PID:704

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\budha.exe

    Filesize

    17KB

    MD5

    16a4adae13aff62891e8fbd167ce8b24

    SHA1

    086d08e7684969b830275998ef93c4cdb97ecd77

    SHA256

    8899b4bb843b073b1fb8096bf018f021b6f141efd0b889340a9094b0b6d88501

    SHA512

    672676f3fb7fa1661e2d42c913481f81ebb454e69f774521f17c9a22ec17ea44cbd4dc829bce0edba0179bcd9800d856406a0e57193600d8a5f762df76f4c6b6

  • memory/956-0-0x0000000000400000-0x0000000000407000-memory.dmp

    Filesize

    28KB

  • memory/956-9-0x0000000000400000-0x0000000000407000-memory.dmp

    Filesize

    28KB