Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    139s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/08/2024, 09:34

General

  • Target

    r2vtool.exe

  • Size

    1.7MB

  • MD5

    0272c4aeb9c8b662d36a258c08ff2a8b

  • SHA1

    19a0a21da77374855750d022577a1412acc41f5a

  • SHA256

    d49bfb34bca086faa277ae294a8d0e483b3a7cf02efe83157231e1d0c03b7f61

  • SHA512

    55d7f562fa5fb745214558c925e93a157d95fc72862c5122f11cf6755f765c64f5eb05d3c713058ca74ac0f274b9e7290bd87f30122ef3c69ee7b9a6468f3b6d

  • SSDEEP

    49152:xMiLjp78t+HvKj3YMMPlrAeMMSGYw6cEzW:eE7dPKzsPlE2SV8

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 3 IoCs
  • Drops file in System32 directory 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\r2vtool.exe
    "C:\Users\Admin\AppData\Local\Temp\r2vtool.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    PID:2112

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\GLCBE7D.tmp

    Filesize

    157KB

    MD5

    fbd929bfc7b4a9e4fa4506655bab4c4a

    SHA1

    b4df84de80729a04ed90dc976a3e730a568f24f8

    SHA256

    adf8dea5d36b58cf621e2bb0c4549f94e0919308dd7cc1215d942417c45e54a4

    SHA512

    b310e79848dc2a3c6a4524e0b120e2e3dd73ecb6852c65a9eec368045f7bab0b141210726476dd3cb0c1d9008e1f34149f35c03a0156a9eef7d4a7fbc61ea1b4

  • C:\Users\Admin\AppData\Local\Temp\GLKC0B2.tmp

    Filesize

    30KB

    MD5

    3df61e5730883b2d338addd7acbe4bc4

    SHA1

    03166e6230231e7e3583cf9c8944f4967aa1bf1b

    SHA256

    2efe9a54c8eb878711d9b6cd18f276838645aff52fe69d8a864376cb258ec616

    SHA512

    36e9d705d22dad3d952b4da578a990f2b63ec2f9fbf2734efdaea9ecbd4f07a8d7232792eb5bdd81c553354d51334993cb6103c377f3483a680eac9e41cd2087