Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
93s -
max time network
100s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
06/08/2024, 17:16
Static task
static1
Behavioral task
behavioral1
Sample
d201c803ee9567896434d0b020e581b0N.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
d201c803ee9567896434d0b020e581b0N.exe
Resource
win10v2004-20240802-en
General
-
Target
d201c803ee9567896434d0b020e581b0N.exe
-
Size
73KB
-
MD5
d201c803ee9567896434d0b020e581b0
-
SHA1
bcc969af18aca58dd58284dee5aa2e3d8041473b
-
SHA256
e6f1556e9b44de300129592c9282a7b932c45ea57a1cf3be2ad480ec7fa44b5a
-
SHA512
db2b55fa98d19bfe682ff428158ec392c0af4f2675f72687fc2cada09ae8049acdd5ed8a9d2cfb081c6d73b1a748e08b66627b28c3cf69b267d40cdb5ee65172
-
SSDEEP
1536:hbkaWqFWZmj2aZK5QPqfhVWbdsmA+RjPFLC+e5hc0ZGUGf2g:hwa5XCONPqfcxA+HFshcOg
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 3624 [email protected] -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d201c803ee9567896434d0b020e581b0N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language [email protected] Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2364 wrote to memory of 1488 2364 d201c803ee9567896434d0b020e581b0N.exe 85 PID 2364 wrote to memory of 1488 2364 d201c803ee9567896434d0b020e581b0N.exe 85 PID 2364 wrote to memory of 1488 2364 d201c803ee9567896434d0b020e581b0N.exe 85 PID 1488 wrote to memory of 3624 1488 cmd.exe 86 PID 1488 wrote to memory of 3624 1488 cmd.exe 86 PID 1488 wrote to memory of 3624 1488 cmd.exe 86 PID 3624 wrote to memory of 364 3624 [email protected] 87 PID 3624 wrote to memory of 364 3624 [email protected] 87 PID 3624 wrote to memory of 364 3624 [email protected] 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\d201c803ee9567896434d0b020e581b0N.exe"C:\Users\Admin\AppData\Local\Temp\d201c803ee9567896434d0b020e581b0N.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c [email protected]2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\[email protected]3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3624 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 00.exe4⤵
- System Location Discovery: System Language Discovery
PID:364
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\[email protected]
Filesize73KB
MD5a10428d248cbf03d5c39017c29c414ea
SHA16ed49ca1e811584356544d605eeb84c1302a29c9
SHA25686e9d0a040d947469540590264fefc9106d51aa20b9b37ad342c014698aa7c30
SHA5127730f350ea2fa05ba171b9b450d5c94110b0ac50367e96cf94d15564bd4b199dc0b3af90d631b3cbde9201f33766d40ffc5951e28edaed07eda77cf34b4ff243
-
Filesize
2KB
MD57b621943a35e7f39cf89f50cc48d7b94
SHA12858a28cf60f38025fffcd0ba2ecfec8511c197d
SHA256bef04c2f89dc115ce2763558933dba1767bf30cda6856d335ae68955923f9991
SHA5124169e664ad4e7e6891a05ceed78465e0ec44879b37fc0de97c014945e10c161f6bfb040efc24edc136e69bb115b2a1327b04cefb58141f712da856129872e8f1