Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
03/08/2024, 04:54
General
-
Target
095034e4bae9880c6e72b16c735abd25e85c2b3657cc31bf92a43d0d8ee63843.exe
-
Size
3.5MB
-
MD5
923d31abc2ffc486388ba3c2be189768
-
SHA1
8faabc22bff8c38c315086fbf05385836e912c8b
-
SHA256
095034e4bae9880c6e72b16c735abd25e85c2b3657cc31bf92a43d0d8ee63843
-
SHA512
7dd3fced346987e7ceb0a60fabf5399a3bc76c28716562ab39cab9c650f0ccecf1311500d00f903380847eec9d95e24036ae70f6a7da336f9a081020dad37fde
-
SSDEEP
98304:RHgkWJ0FghU2CAAddNxpztClVkoOSfJNAUW4gPuAOo:RxWJU00ddNxpzlobhCUW4gWu
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 33 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 7 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\095034e4bae9880c6e72b16c735abd25e85c2b3657cc31bf92a43d0d8ee63843.exe"C:\Users\Admin\AppData\Local\Temp\095034e4bae9880c6e72b16c735abd25e85c2b3657cc31bf92a43d0d8ee63843.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\RQLauncher.core.exe"C:\Users\Admin\AppData\Local\RQLauncher.core.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4200,i,13995403245988825027,7033610968827661507,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
23KB
MD534f8c150ba8ed065614e3a70dbcf4a1a
SHA15ed899eac4c1111f09dd88392f00332cf3fbf24f
SHA256754a3e6b0dfa950e0fdd7c1df20677417f1e816ad1450d6b704e127cfac9946f
SHA5120672d4e18472a9e416e6a475487bf19772557cf78c0bb8604d137b4a2c1824877de7da2af90cffc11a52d5d0921ff8744f27ac8f0a1726456ec0d4de2c642387
-
Filesize
8KB
MD5afa663230f1c002e79841a9682a7e773
SHA113ad2246a161fa890f3c53c74dfabf5e29e7f880
SHA25668ba95cdc5604d1e420be6693c77094db026bb6229fdb3f69c82689bfa463809
SHA512aad41c988bb901c1a3ebb0ba9010a37412bb22d084afcfc12224461a56d7d428be9c30614b9cf9d61bf72326ee17bb027383689ae2bc091a3585fa55e04b7791
-
Filesize
64KB
MD57761b8886c05035b1140ac97f3ff1310
SHA15cf483afbc56f38cac267077016d76788e795463
SHA25689ad681a87b383da12539724604909d1049d8492e21143e9b9ba2a84855e99cd
SHA51256ea5fe824f3d3d7c2d73098d536987c876504db24d91a4d029b496d3ff0d74b23ed9ebd8c2dafdf98db1a318ec6f817fc5153c569c89ec52fee4516d781b0a5
-
Filesize
13KB
MD55692df2ac519e68e4be052f18706b03e
SHA1d76794c651ac8e320a5b461be88a7926c490f044
SHA256be11c30644d3051fd12bedbf12e7a98249ea577e414fa541fc2c0083a48c9d99
SHA51229a41c4038918d0e9a8159c4c7206e972ecfe2a0ae0894eb4a6ad6b3c57786c9013d0971881071a3c3f6dadbff91f0a73f4b88f03bb5e22b906c93a42cdc14b6
-
Filesize
20KB
MD55220eefd7753e11b99d73faf39fbb486
SHA17d8264be4fcb17f81acb8b1add980cd96a6fd856
SHA256ed5bc605f7f9fcc382183abef06c354dad946abb42a07631712077b2157d6bc9
SHA51281e483bd76240543704194c0eb0c8a9e7dc46aa535653e7d5590e00c002b2980237ada793c05c0eedd5d1a92de90055867b21be665ff94fac038e280939c66c1
-
Filesize
36KB
MD52a234fe4c85e7d2a495684aced5ede53
SHA11af6cd5bdb962616591fd65bb85b929fc277afb5
SHA256c9c9ff5072e78c2efb04dbecbab3f89a4b983fca2e775a15c9f49295928cca67
SHA5122c1c18a99820af6ca85dcf024ab9526550bf360fcddf42a1aa841d729b5aaa6b3b5eab433b5de2979b99199bc034f3ef589650125f57332d2bca6136c2e2dfed
-
Filesize
70KB
MD553cdcf20b8528883c3f4b0ca116c743a
SHA1206516e0094dcd3efd4c3b663091bc7e905ad2cf
SHA256c145eedfb5a519f8695b31d10344430cd4d7bef718453a3b6949475f7e35fae5
SHA5127dc2c4415dcc194ba94a25471c8d68ee55ac3054ddf029c6cf4ba48d6e0b2bb8fd3d124dd713db9f96bb9e55f96a3eb48e199791e19a1706d4191dad8dffca4f
-
Filesize
840KB
MD52dd3a800e8c71831a107aae5a20c32c9
SHA19e3c83b792e6000403f747ca7b1e4aae58d21ff2
SHA256d6844cf7ab1a4066324b36769d7b5f640d795c41cc0bb1751299704e3ea33b66
SHA51283d54d2139943ef36c2b7d21ed6420fb3f6a7fcde560d187a7e0f3be983d243be5512a338251df76a951adbdc804db8bd6d84308f5e17057ab84798274b1db8f
-
Filesize
683KB
MD56815034209687816d8cf401877ec8133
SHA11248142eb45eed3beb0d9a2d3b8bed5fe2569b10
SHA2567f912b28a07c226e0be3acfb2f57f050538aba0100fa1f0bf2c39f1a1f1da814
SHA5123398094ce429ab5dcdecf2ad04803230669bb4accaef7083992e9b87afac55841ba8def2a5168358bd17e60799e55d076b0e5ca44c86b9e6c91150d3dc37c721
-
Filesize
91KB
MD5a2186853c0b88019b635ba63e96bf7c5
SHA1739ada37d3b925a73bc869fd3d3efabbbde2c9e8
SHA256c75ab3361eaf9222dcc82af32c02febc2040c335497ec6c801aa16654c768b1c
SHA512237e2376bb7b8352a5c2094997fee5ec6f85c33c259a0b5f302f21044b85574f3294598cae8d305d1da7fe50fe9d4bbd8621825c9fbab3ff6ff883118b395681
-
Filesize
2.6MB
MD57ad7cbb64d03b3e3eead67888a85aca2
SHA1364778d5a96ea07f99fd6fb356474615bd7e18d0
SHA256e68526d6e5426c60598b80ca34d55c1d949bf9831430b9823b0b3a052db87539
SHA51238566df54fc2a43e1eb7e5d32325ea5088552fb3e004e2a8d85db7e8e4755989f4ee8b86bc7652a906237d3764d7615eddf3e6b6254283c8b2aea76a944cbe57
-
Filesize
19KB
MD584ceb02d7529777fdc90b7a1e17e2318
SHA14874f1b2d72ecc9c3012acb2168ad0a825edabff
SHA256a4ca1aac08cc713a04624387155540e7343e1cea67d6dfce52287464d15d64dd
SHA51242210065d268e5e60f76a66678d63317100bbe2c071efc82b3f788ef39ab5ac7de50c1582dda81835e57c9cd840ca75bd6f2396620deef667c62537727d9a330
-
Filesize
49KB
MD5fc56330d940a430b90d13106735c4127
SHA1ec7ee5333223b7299abdbc190992adfc0e0f978d
SHA256cb023ab86d4082b77a84ffd24d048102be674fa897d9a9dddb32a259bb0fc1b0
SHA512cecbe11f5ba41fa53b920f0c1279e360ddf177865a9bde02f032c4417a7b684ef49372ea487fd7e2f5cb9fd7f7e7f6539bdafae07923f207c3e9602bc9d637ee
-
Filesize
88KB
MD5d91846401fe0c461d85ecf8d713cd367
SHA1afb85118f9c749ce42edd364081a88b1b44260d2
SHA25666c72010e9842b2484efe0ddbfd89cae72fce783cfe8f51fb68588aa4671e1d2
SHA5126ec06183289f536ffd035b76aa07358cb87a7193ed94a36acb926654c1a0dfa5377f761eedc0383e956afcb959c72fdfa9c10518a0d946d05e9613e9e619d777
-
Filesize
193KB
MD5665e355cbed5fe5f7bebc3cb23e68649
SHA11c2cefafba48ba7aaab746f660debd34f2f4b14c
SHA256b5d20736f84f335ef4c918a5ba41c3a0d7189397c71b166ccc6c342427a94ece
SHA5125300d39365e84a67010ae4c282d7e05172563119afb84dc1b0610217683c7d110803aef02945034a939262f6a7ecf629b52c0e93c1cd63d52ca7a3b3e607bb7d
-
Filesize
32KB
MD50f384afcf671483188b9019d3b7457a7
SHA179a73a170ba0596d8e84a432dd2caa2faf831bee
SHA2562c9cad6410e37e44fa73cccb576f418184f1ae5a0a257e165a136bdaa941a0c6
SHA512713dfea9fcad5dd6924c3fdeb0d279d104c85df5c12b2ca125868fa71a6f2db14f098473233902d5783d8276369d6f9903ab4c096fc88daee10a84cba418090f
-
Filesize
3.9MB
MD5e1677ec0e21e27405e65e31419980348
SHA1666de481c46e2c21b8f0decc7e9115fc61d28acd
SHA256c2c7ca6505ad10826e6b92319ce7aa355392b0cbd092a0fb8d4381c2d31268bf
SHA51231ea9e22a2de873ad71c56386b45f510cc89b63eff5526f75a9de7987c65e91bff9ae141cb47b49b986992a53d9a6e73fa3199a04f0bde665d4928112fd13070
-
Filesize
41KB
MD511d24edc131a2beaeee512f84717e0e9
SHA1cbe337ea2f5dcfa68ba3ff83d1568f7d2d8db5d4
SHA256a3228b1d2b28b018d679b4597e7e99eee5d36f6b14cd0d53e32b2e6202a19584
SHA5129e8979697ed57baa0b1bc1d45ed148dbe671f211c2c51f0207e9492dd2e2d89a042aa6b4eddd341a5b28d5ca9b4b8b2ad5ef405d78c9566d5cae1417b4cbdbaa
-
Filesize
16KB
MD5ff3aea9b024cabdcda5357ed33fb073a
SHA109c5cb86b660a195a94542d0f3c77499cbfdaf76
SHA256e89a63f8dcd0e4c076e97cba8fa63d4bbd3a4512239f10e90b7bece68d285092
SHA512e61b153d014cb36bdf3fecf42ccdf9a8ed60b6acace72c2c2b9860c0bfcb5db5feed9271930b725e1d7b53aa526b68c4de0e8fa1e6ceb04e9ed505562e9a203a
-
Filesize
4KB
MD55e9b8abc9cb376b8e2a66d5f5ff2b8fc
SHA14b23d02ac94a3d3ae18eb584d4329cb0d3c139db
SHA256c156d3f8f52066baa70b390f03f2f8c54e3eb78c69e2560d00630b4f9b28e6b5
SHA51296f9c1c93424877b605701da9a49e79dacf9f0f8b5bfe07dc104e9acfb5bb532901ade7759639d918c1e8322442fbf0f4115196a9bcd7afdfeac40525f3a9646
-
Filesize
7.7MB
-
Filesize
40KB
-
Filesize
7.7MB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
344KB
-
Filesize
704KB
-
Filesize
88KB
-
Filesize
48KB
-
Filesize
120KB
-
Filesize
200KB
-
Filesize
72KB
-
Filesize
40KB
-
Filesize
40KB
-
Filesize
408KB
-
Filesize
88KB
-
Filesize
864KB
-
Filesize
7.7MB
-
Filesize
32KB
-
Filesize
56KB
-
Filesize
112KB
-
Filesize
3.3MB
-
Filesize
40KB
-
Filesize
296KB
-
Filesize
112KB
-
Filesize
4KB
-
Filesize
32KB
-
Filesize
6.1MB
-
Filesize
704KB
-
Filesize
2.6MB
-
Filesize
7.7MB
-
Filesize
40KB
-
Filesize
864KB
-
Filesize
32KB
-
Filesize
40KB
-
Filesize
472KB
-
Filesize
88KB
-
Filesize
7.7MB
-
Filesize
56KB
-
Filesize
7.7MB
-
Filesize
72KB
-
Filesize
4KB
-
Filesize
40KB
-
Filesize
224KB
-
Filesize
120KB
-
Filesize
32KB
-
Filesize
56KB
-
Filesize
7.7MB
-
Filesize
104KB
-
Filesize
136KB
-
Filesize
848KB
-
Filesize
32KB
-
Filesize
88KB
-
Filesize
7.7MB
-
Filesize
568KB
-
Filesize
48KB
-
Filesize
3.5MB
-
Filesize
472KB