Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    119s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/08/2024, 09:28

General

  • Target

    8cb12865a71d87d7311228712db74940N.exe

  • Size

    2.3MB

  • MD5

    8cb12865a71d87d7311228712db74940

  • SHA1

    5015be61802f5b83ca32d637f30df892d8aca0e2

  • SHA256

    376b0d8fb80858c81d3e0536b9dc4e7be10948118f1aefe449a1f3d32eadbc9d

  • SHA512

    0ce4b7ec46da883a6485195f7d3b872a9bd3fef8593b595069868f05720c593a17060dd92ffbc7b7c0b91e362a9abd2365a280eed02090ee1e0e4053f4861e68

  • SSDEEP

    49152:ub+yLLwRrB3tRPltBW5LqLM4DtipK6FvMK7m/1OavYc+F:jwLu13B68g+tiptm9Uc+F

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Drops file in System32 directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\8cb12865a71d87d7311228712db74940N.exe
    "C:\Users\Admin\AppData\Local\Temp\8cb12865a71d87d7311228712db74940N.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    PID:2688

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\DC++ Share\RCX903B.tmp

    Filesize

    62KB

    MD5

    b126345317624479f78fbf30b3a1fe5a

    SHA1

    655c966bf7bbf96ee49c83062d30b9dba17d693c

    SHA256

    8723d2d97d52f6d3b63968594c93bf2c5b5300b306c9670be4616cb134964301

    SHA512

    d0be6d608b5f4e482287d16e6587e00be1b4390f78efc3ce63008f99be7358e65f0eef9eba330d845462b64fa7a86cc3f1395b863ad0f8d01c0b790fc2f4c02d

  • C:\Windows\SysWOW64\xdccPrograms\7zG.exe

    Filesize

    2.3MB

    MD5

    8cb12865a71d87d7311228712db74940

    SHA1

    5015be61802f5b83ca32d637f30df892d8aca0e2

    SHA256

    376b0d8fb80858c81d3e0536b9dc4e7be10948118f1aefe449a1f3d32eadbc9d

    SHA512

    0ce4b7ec46da883a6485195f7d3b872a9bd3fef8593b595069868f05720c593a17060dd92ffbc7b7c0b91e362a9abd2365a280eed02090ee1e0e4053f4861e68

  • memory/2688-93-0x0000000000400000-0x0000000000416000-memory.dmp

    Filesize

    88KB

  • memory/2688-94-0x0000000000400000-0x0000000000416000-memory.dmp

    Filesize

    88KB

  • memory/2688-95-0x0000000000400000-0x0000000000416000-memory.dmp

    Filesize

    88KB

  • memory/2688-96-0x0000000000400000-0x0000000000416000-memory.dmp

    Filesize

    88KB

  • memory/2688-97-0x0000000000400000-0x0000000000416000-memory.dmp

    Filesize

    88KB

  • memory/2688-98-0x0000000000400000-0x0000000000416000-memory.dmp

    Filesize

    88KB

  • memory/2688-99-0x0000000000400000-0x0000000000416000-memory.dmp

    Filesize

    88KB

  • memory/2688-100-0x0000000000400000-0x0000000000416000-memory.dmp

    Filesize

    88KB

  • memory/2688-101-0x0000000000400000-0x0000000000416000-memory.dmp

    Filesize

    88KB

  • memory/2688-102-0x0000000000400000-0x0000000000416000-memory.dmp

    Filesize

    88KB