Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    98s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/08/2024, 17:29

General

  • Target

    9cd99a65e2659613039cbfbd336a8f90N.exe

  • Size

    784KB

  • MD5

    9cd99a65e2659613039cbfbd336a8f90

  • SHA1

    48681c97f74e6e4fbac763fe99e0022075674537

  • SHA256

    f8c6e89acc7370fa4bcb8827f74adbf8abe21b1aae549ef4785fbaf3f3b14fdc

  • SHA512

    b76d6d77ee3e19daf5f389a6aa3f24654199c25daec7c6d5abe6e190f6ce0844141ea9625849401f1bf63aeb0ec5fe0c36b4e90be0e3f41f486bd60577524734

  • SSDEEP

    24576:41b3jes09zLMNRgoDPETLRu5oSmnh2g7JLEI:4VeN9zQNRgkwRu5DQ2+L3

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Drops file in System32 directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\9cd99a65e2659613039cbfbd336a8f90N.exe
    "C:\Users\Admin\AppData\Local\Temp\9cd99a65e2659613039cbfbd336a8f90N.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    PID:4824

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\DC++ Share\RCX5D98.tmp

    Filesize

    90KB

    MD5

    77fc370a001ed6f4d7257edfc7fa9cf9

    SHA1

    553f0fe589013524b58659d893806327597e5d9d

    SHA256

    7a7661f17db785a1a73bb5718d4adabda766aefec901fc28d94b29af1bff68dd

    SHA512

    81ab4a7b721e10433dcaaec81198973d4f07f176cacac5fc10a3be36d056a1b46c46ac40f0673c5c83479d0de3df375abb7501a8de52a66bca1dceb084b47c2f

  • C:\Windows\SysWOW64\xdccPrograms\7zFM.exe

    Filesize

    930KB

    MD5

    e0a583d1eb5dd9552f843151f873be86

    SHA1

    d3ac6316aa8b98d70e557f94a8c37bbc6162a268

    SHA256

    b74a8e267a27b13014b40de7c37f5265c1d7c5e4f6bea631d477ea1ae34f7373

    SHA512

    eed1afe55ad7f9914c3d266e9ec43fcfe63da1f242cdbfc01ff1c5d6d44baa1d25194a5666c81059f42ec4b33cda3202f0d500013211665bd3e04a2c5e93eb9a

  • memory/4824-0-0x0000000000400000-0x0000000000419000-memory.dmp

    Filesize

    100KB

  • memory/4824-20-0x0000000000400000-0x0000000000419000-memory.dmp

    Filesize

    100KB