Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    94s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/08/2024, 00:28

General

  • Target

    33ecfd22acdcc5c13789cead1b4dd520N.exe

  • Size

    96KB

  • MD5

    33ecfd22acdcc5c13789cead1b4dd520

  • SHA1

    d8a5e739f4ee7a5d6cbe921463221d236a7a3925

  • SHA256

    5893bd4bad1fe837d8ca85d0adfe3c3041308d5bfad70b28cdf6ad2a005331dd

  • SHA512

    4578b809b5d2235377f6a20e3c9c3d516bbf298af0189223c87a807fb35dd6e610bbb214deba2cb2d70e19230453548d316d7c26e2f287a18b2fa6b175123424

  • SSDEEP

    1536:4MeSb99e8Q89H1UbLSLeocTzFJ0T72VpIc:hDe4eBTzFJ0T728c

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 27 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\33ecfd22acdcc5c13789cead1b4dd520N.exe
    "C:\Users\Admin\AppData\Local\Temp\33ecfd22acdcc5c13789cead1b4dd520N.exe"
    1⤵
    • Modifies visiblity of hidden/system files in Explorer
    • Checks computer location settings
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4256
    • C:\Users\Admin\voobiiw.exe
      "C:\Users\Admin\voobiiw.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:4900

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\voobiiw.exe

    Filesize

    96KB

    MD5

    87c3911f91babc6cea17b8a14f78c83f

    SHA1

    87d60e849cd3dda6ecc5787d2b545bb86e4f7540

    SHA256

    2aa8e4420b9e935c396afa9762d7c3054436fa4063e156d4c9f1b8543573c52f

    SHA512

    06073f29684641a1055fc3231b2bc138c72ab72a3576b6e1c77644f75395e69b1909f6851732d8e84a46899871f950a4c09bdd9c057269a213d986ea67b0a627