Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    128s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/08/2024, 20:22

General

  • Target

    4a69630818393e22ff3bf09b012efd014cfb5e5f9df0ff36f019162f9f6480c7.exe

  • Size

    816KB

  • MD5

    7784a85f880f62c767c0bc99d8d9a287

  • SHA1

    5c811cf2cb739a81c0268b47c7725e311c750f56

  • SHA256

    4a69630818393e22ff3bf09b012efd014cfb5e5f9df0ff36f019162f9f6480c7

  • SHA512

    373e7793b465707f149c5ee306391051ca09637473b3401fbbcacf1e21c479e1f8b4dc67b98a185c62f663bcc6e2cabf550c11fcf2baffd9e0db8a3fb38acfc4

  • SSDEEP

    12288:4jauDReWumGU9+8cSX6vFr1BeedPsCVQJ9S/sdQRYfRDzPh7X1kmR8OqPrqLBqOf:4DDitU9+8cSX6wyCwB3TtQ

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4a69630818393e22ff3bf09b012efd014cfb5e5f9df0ff36f019162f9f6480c7.exe
    "C:\Users\Admin\AppData\Local\Temp\4a69630818393e22ff3bf09b012efd014cfb5e5f9df0ff36f019162f9f6480c7.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3444
    • C:\ProgramData\dprnoc.exe
      "C:\ProgramData\dprnoc.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      PID:5072

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Documents and Settings .exe

    Filesize

    816KB

    MD5

    25b989b106004103ee405ecc185c75f4

    SHA1

    ee4903ddad5c00975b9bad227f703fcda443c2b3

    SHA256

    a21c7767ca76082ba0e6d44b22e56b39834c95fae8103e91bdccaa8229952ef5

    SHA512

    cd6a7e1acfec65da4497b4faabe33fae981bb5abce4cf284065ebaf7fe2b8d173e18362d0a6f6dedc52849095bf2af9b2f6ffe143d119d82c36def467fcff061

  • C:\ProgramData\Saaaalamm\Mira.h

    Filesize

    136KB

    MD5

    cb4c442a26bb46671c638c794bf535af

    SHA1

    8a742d0b372f2ddd2d1fdf688c3c4ac7f9272abf

    SHA256

    f8d2c17bdf34ccfb58070ac8b131a8d95055340101a329f9a7212ac5240d0c25

    SHA512

    074a31e8da403c0a718f93cbca50574d8b658921193db0e6e20eacd232379286f14a3698cd443dc740d324ad19d74934ae001a7ad64b88897d8afefbc9a3d4e3

  • C:\ProgramData\dprnoc.exe

    Filesize

    679KB

    MD5

    5c8cbac5860877f840d46e29a31f21f0

    SHA1

    c8df1cb1e2d02f59fc1d2cda0ba69b8bcdfe6ced

    SHA256

    401a289ae15891941d443d91b4a4399ebec410a64eb8adb1f0d722c295fc077d

    SHA512

    89e784be8aa7ac7211fe7ed0bd1268f946ac22d63d37620a4f5023c5a642e7c7c8af207e49caee3c2f55872df8f37a89199b416aa786fed7ac2222469b1dec77

  • memory/3444-0-0x0000000000400000-0x0000000000474000-memory.dmp

    Filesize

    464KB

  • memory/3444-1-0x0000000000400000-0x0000000000474000-memory.dmp

    Filesize

    464KB

  • memory/3444-8-0x0000000000400000-0x0000000000474000-memory.dmp

    Filesize

    464KB

  • memory/5072-130-0x0000000000400000-0x0000000000448000-memory.dmp

    Filesize

    288KB