Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    141s
  • max time network
    125s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/07/2024, 06:46

General

  • Target

    videoconverter.exe

  • Size

    4.8MB

  • MD5

    c3ac5f93238988230fb90e995cab4bab

  • SHA1

    85c5171673b41dbd3f79645e30dd59e1a495209e

  • SHA256

    d547d017e99618979319233ac1c715477cd91c4a2719ec8c6e14204c1bea6f8b

  • SHA512

    23bdfc864e61df4e7b7b325debda7933af7e04c955453af02c79e778b21bfb18df8f430c473d66ed01022874cb4dbef5bcb260df49c2c00720991ef51d31bf48

  • SSDEEP

    98304:Qn0s32QsjmDiaNEuOWSZpktbLWcA+9eQUM/Gc0O4UhRhS6G5Y6FtaAU2LRgJ:xaGMiahOWeGtecnPnh6FtaKdgJ

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\videoconverter.exe
    "C:\Users\Admin\AppData\Local\Temp\videoconverter.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3692
    • C:\Users\Admin\AppData\Local\Temp\is-T5R0J.tmp\videoconverter.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-T5R0J.tmp\videoconverter.tmp" /SL5="$6023C,4821183,54272,C:\Users\Admin\AppData\Local\Temp\videoconverter.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:4676

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\is-PURFQ.tmp\FileDeEx.dll

    Filesize

    94KB

    MD5

    255c028585eecab40d11aa5d70767968

    SHA1

    04d50bf607080c04f3f4faffb08c8828d1217948

    SHA256

    e2220672dccb587c525716d13aba4eb76cb10f936feabe05b122bcb044dcafe6

    SHA512

    a49288fab8869b08f40b4a760481c2b65472b4970f1ce2e83e0294bbe278f1bf30863436fef783254d0b262d67fc7f12bc89ed1648ebec71ed96f3f30d9aa0e4

  • C:\Users\Admin\AppData\Local\Temp\is-T5R0J.tmp\videoconverter.tmp

    Filesize

    688KB

    MD5

    c765336f0dcf4efdcc2101eed67cd30c

    SHA1

    fa0279f59738c5aa3b6b20106e109ccd77f895a7

    SHA256

    c5177fdc6031728e10141745cd69edbc91c92d14411a2dec6e8e8caa4f74ab28

    SHA512

    06a67ac37c20897967e2cad453793a6ef1c7804d4c578404f845daa88c859b15b0acb51642e6ad23ca6ba6549b02d5f6c98b1fa402004bdbf9d646abab7ec891

  • memory/3692-0-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/3692-2-0x0000000000401000-0x000000000040B000-memory.dmp

    Filesize

    40KB

  • memory/3692-20-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/4676-13-0x0000000000400000-0x00000000004BC000-memory.dmp

    Filesize

    752KB

  • memory/4676-17-0x0000000003A70000-0x0000000003A8C000-memory.dmp

    Filesize

    112KB

  • memory/4676-22-0x0000000003A70000-0x0000000003A8C000-memory.dmp

    Filesize

    112KB

  • memory/4676-21-0x0000000000400000-0x00000000004BC000-memory.dmp

    Filesize

    752KB

  • memory/4676-28-0x0000000003A70000-0x0000000003A8C000-memory.dmp

    Filesize

    112KB