Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
26/07/2024, 21:31
General
-
Target
590f9ca9f78e3e327775dbf3ab224870N.exe
-
Size
6.3MB
-
MD5
590f9ca9f78e3e327775dbf3ab224870
-
SHA1
9e034a3f5cab924dd4c0e731d50dc729b99c2a39
-
SHA256
f818115503d9283f70514bf7907039e492915fa20196060688875791a10e33d4
-
SHA512
1ee8be3f43cf2f4f1f34dff9628ec5408cf2617d88883e6316099420ca3c213be6b782116c3fab99c170c0c11ca828e03caf6e91aad35c28c0e266fabfdc1a2d
-
SSDEEP
98304:5fmxwGe9FAQW0v9VpPbkXXg/shWb3qtuSkIUoiGcdFm7TSXHoM0zxNX61ru/x:dbvzpTkXXbU3qtuSkgiGpSXonNq1e
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 2 IoCs
-
Drops file in Program Files directory 5 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\590f9ca9f78e3e327775dbf3ab224870N.exe"C:\Users\Admin\AppData\Local\Temp\590f9ca9f78e3e327775dbf3ab224870N.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\drmsoft5053e\HeatDistortion_1.0.32_Installer_x64.exe"C:\Program Files\drmsoft5053e\HeatDistortion_1.0.32_Installer_x64.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files\drmsoft5053e\HeatDistortion_1.0.32_Installer_x64.exe"C:\Program Files\drmsoft5053e\HeatDistortion_1.0.32_Installer_x64.exe" /UAC3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.1MB
MD5b41eb1ddbe6d1496a6a48e462653ee77
SHA175a1863596bade1e396d3f1b04cfde8104d531d8
SHA256a8bacafd9237cbfac63719d45dc88b425dce1df39116ac31066470d4fdfc90b5
SHA512edb035db92beaf0b66f3e7f0cab984e521b3e170a1b7acff61f8ee78f17205aa5e51d82cb55852c492ef2bad845822a75892b6dded8a062ad95d6e55e914ff9d
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB