Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
02/08/2024, 19:15
General
-
Target
1e68534366344db8cd3dd0a60fae3bcc14ab7408c9d1bba1421c83d38cf4d9d4.exe
-
Size
3.1MB
-
MD5
3c42714034cd9bb851ea0f3f031f4f85
-
SHA1
2d762fedabee69e7d4ade09bc96528056a148c7c
-
SHA256
1e68534366344db8cd3dd0a60fae3bcc14ab7408c9d1bba1421c83d38cf4d9d4
-
SHA512
4934e07910cb7a5b0abc4b5413a33cc890247ec52e2fb6534dfae43fef7c335669d0d48750ed41df090430bd36ca8edf7eaa96ff8ed38982bd33f425b56952ce
-
SSDEEP
49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBJ9w4Su+LNfej:+R0pI/IQlUoMPdmpSpR4JkNfej
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1e68534366344db8cd3dd0a60fae3bcc14ab7408c9d1bba1421c83d38cf4d9d4.exe"C:\Users\Admin\AppData\Local\Temp\1e68534366344db8cd3dd0a60fae3bcc14ab7408c9d1bba1421c83d38cf4d9d4.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\UserDotJ6\devoptiec.exeC:\UserDotJ6\devoptiec.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.1MB
MD5c42ac3a28ef4569fdb8bf3440b5b478b
SHA17d626ade0451d2e768b380e65ab2bd175cddd332
SHA256fe273abd446868f0926e5ae1f2c2e703378498c62adba78b892041e5f110f5b2
SHA5124781e42234fd7348b81524cb45e5bc32081deb7a16424207fab36fee26ac10e4434b3a9ca046a0f67f2de088ff005232d95bc86541cf25a151ced40ac4a0efa0
-
Filesize
3.1MB
MD5d331bd6bc0525b5325988f3bf3c953d7
SHA1f212a741db2b111201d563959982435071e956fb
SHA256f2b6cacfcd8c5bf64cf72e0b9a82911ef0b921010cefcd8696669e4a9fea0b2c
SHA512847675663fac5fdb742e141f8828b7a731087d98720ce3f0caec7db8b1a114b8b7188e6f3d3c24fecb3872c1c4ab6573ff7823b91e9560068a3355dc3f39e976
-
Filesize
205B
MD5257ce2abd34ab234cfc4504414faf861
SHA1d5aada576d78a541ddfb76ae3311a654b04f23e5
SHA256fda6b3eb228e89892ce0e747958ad80f0c1a1040aa959db9e4a162fa2a2eff94
SHA512d49762a959aa5e1c28cb8958802b764468d12e3a4c725fd83e0433fc311f602b344e4511f8d872657ea618c00feb116d156472e1d138a092f3afcdeae602a730