Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
25/07/2024, 21:03
Static task
static1
Behavioral task
behavioral1
Sample
46f976a9587222506de3b88881ae582e12313ac965f6c07617f16021cce4bdf1.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
46f976a9587222506de3b88881ae582e12313ac965f6c07617f16021cce4bdf1.exe
Resource
win10v2004-20240704-en
General
-
Target
46f976a9587222506de3b88881ae582e12313ac965f6c07617f16021cce4bdf1.exe
-
Size
9KB
-
MD5
eb74a16e1ad912343958959813ecf442
-
SHA1
b6f80ed332ea4c44dfcc9ad0191f37818d3eca04
-
SHA256
46f976a9587222506de3b88881ae582e12313ac965f6c07617f16021cce4bdf1
-
SHA512
97f42afea86d7571f1f7763035a48fbe824d9bec52e7cb7ce3bf157bb7c465711b6784d41c48412d2266626c0b5c95637c881b0b6701716ab5dae64278a0dd61
-
SSDEEP
96:zb+u4l46fPl6C8w/Z3cy4cfnp35veaiUgCsGZkM6m2As1c4SYgXuN4yYjB:WHO6V6CXZSYp0aiZCpc1ZSYgXu2fjB
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\Control Panel\International\Geo\Nation 46f976a9587222506de3b88881ae582e12313ac965f6c07617f16021cce4bdf1.exe Key value queried \REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\Control Panel\International\Geo\Nation ffengh.exe -
Executes dropped EXE 1 IoCs
pid Process 3912 ffengh.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 46f976a9587222506de3b88881ae582e12313ac965f6c07617f16021cce4bdf1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffengh.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3356 wrote to memory of 3912 3356 46f976a9587222506de3b88881ae582e12313ac965f6c07617f16021cce4bdf1.exe 83 PID 3356 wrote to memory of 3912 3356 46f976a9587222506de3b88881ae582e12313ac965f6c07617f16021cce4bdf1.exe 83 PID 3356 wrote to memory of 3912 3356 46f976a9587222506de3b88881ae582e12313ac965f6c07617f16021cce4bdf1.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\46f976a9587222506de3b88881ae582e12313ac965f6c07617f16021cce4bdf1.exe"C:\Users\Admin\AppData\Local\Temp\46f976a9587222506de3b88881ae582e12313ac965f6c07617f16021cce4bdf1.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3356 -
C:\Users\Admin\AppData\Local\Temp\ffengh.exe"C:\Users\Admin\AppData\Local\Temp\ffengh.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3912
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
9KB
MD5da86f7a00e378e730b307f9054635da4
SHA18d60aadd24be2b1a51de2197361e3d68ba87702c
SHA25652725e02cc1052d4fc6aaef127dd7e2b815ec746237ebae21672e5035e554d54
SHA512d11a9409fb61d01ac869ec165edb3ed38fee189b0a4f3572eb7ad1e36fc3aef9c9597e6058b60f40dc8620559b4eae38f2a27f79ea4b21c335375693f1c79897