Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
26/07/2024, 06:46
Static task
static1
Behavioral task
behavioral1
Sample
videoconverter.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
videoconverter.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
新云软件.url
Resource
win7-20240705-en
Behavioral task
behavioral4
Sample
新云软件.url
Resource
win10v2004-20240709-en
General
-
Target
videoconverter.exe
-
Size
4.8MB
-
MD5
c3ac5f93238988230fb90e995cab4bab
-
SHA1
85c5171673b41dbd3f79645e30dd59e1a495209e
-
SHA256
d547d017e99618979319233ac1c715477cd91c4a2719ec8c6e14204c1bea6f8b
-
SHA512
23bdfc864e61df4e7b7b325debda7933af7e04c955453af02c79e778b21bfb18df8f430c473d66ed01022874cb4dbef5bcb260df49c2c00720991ef51d31bf48
-
SSDEEP
98304:Qn0s32QsjmDiaNEuOWSZpktbLWcA+9eQUM/Gc0O4UhRhS6G5Y6FtaAU2LRgJ:xaGMiahOWeGtecnPnh6FtaKdgJ
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 4676 videoconverter.tmp -
Loads dropped DLL 2 IoCs
pid Process 4676 videoconverter.tmp 4676 videoconverter.tmp -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language videoconverter.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language videoconverter.tmp -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4676 videoconverter.tmp 4676 videoconverter.tmp 4676 videoconverter.tmp 4676 videoconverter.tmp 4676 videoconverter.tmp 4676 videoconverter.tmp -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3692 wrote to memory of 4676 3692 videoconverter.exe 84 PID 3692 wrote to memory of 4676 3692 videoconverter.exe 84 PID 3692 wrote to memory of 4676 3692 videoconverter.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\videoconverter.exe"C:\Users\Admin\AppData\Local\Temp\videoconverter.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3692 -
C:\Users\Admin\AppData\Local\Temp\is-T5R0J.tmp\videoconverter.tmp"C:\Users\Admin\AppData\Local\Temp\is-T5R0J.tmp\videoconverter.tmp" /SL5="$6023C,4821183,54272,C:\Users\Admin\AppData\Local\Temp\videoconverter.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4676
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
94KB
MD5255c028585eecab40d11aa5d70767968
SHA104d50bf607080c04f3f4faffb08c8828d1217948
SHA256e2220672dccb587c525716d13aba4eb76cb10f936feabe05b122bcb044dcafe6
SHA512a49288fab8869b08f40b4a760481c2b65472b4970f1ce2e83e0294bbe278f1bf30863436fef783254d0b262d67fc7f12bc89ed1648ebec71ed96f3f30d9aa0e4
-
Filesize
688KB
MD5c765336f0dcf4efdcc2101eed67cd30c
SHA1fa0279f59738c5aa3b6b20106e109ccd77f895a7
SHA256c5177fdc6031728e10141745cd69edbc91c92d14411a2dec6e8e8caa4f74ab28
SHA51206a67ac37c20897967e2cad453793a6ef1c7804d4c578404f845daa88c859b15b0acb51642e6ad23ca6ba6549b02d5f6c98b1fa402004bdbf9d646abab7ec891