Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    118s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/08/2024, 15:27

General

  • Target

    d7513faa25b3030731bd4610c74f2050N.exe

  • Size

    64KB

  • MD5

    d7513faa25b3030731bd4610c74f2050

  • SHA1

    63abbe97e10222ca0245b4d5d9d1d92fab5690cb

  • SHA256

    cc330e80886b0b1cbb10112116ec9ac9c009796b4153da021af298435426933c

  • SHA512

    a9bbafc6d065025b053b3e3334d885b94ffcf01820d419fbe07258fb5c4cbfbc1618ded8f8f11ab5fe07414217b8ac349878d1abf38740f6a8ad57baaf92aff4

  • SSDEEP

    1536:NAo0Tj2d6rnJwwvl4ulkP6vghzwYu7vih9GueIh9j2IoHAjU+EmkcU+uhIehXeh4:NAoglOwvl4ulkP6vghzwYu7vih9GueIc

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d7513faa25b3030731bd4610c74f2050N.exe
    "C:\Users\Admin\AppData\Local\Temp\d7513faa25b3030731bd4610c74f2050N.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2952
    • C:\Windows\microsofthelp.exe
      "C:\Windows\microsofthelp.exe"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      PID:1376

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\microsofthelp.exe

    Filesize

    64KB

    MD5

    d8de0621053863c4c5d4d4f2998ea6f3

    SHA1

    75516cbccd893c2067aaedc1cd36cc3467027c96

    SHA256

    177e4f9820ed6b18b244c6a15265cd7444a64bfd76366bd02bdeb2b66c44c727

    SHA512

    783e4037761257d3d1f01c10657eda978bff5b176fca504223e4a79636d1984c5ccc90a9d88576940681b24af97978626751fd1e6a72cdbc373bac0dfe877bec

  • memory/1376-6-0x0000000000400000-0x000000000040F000-memory.dmp

    Filesize

    60KB

  • memory/2952-0-0x0000000000400000-0x000000000040F000-memory.dmp

    Filesize

    60KB

  • memory/2952-4-0x0000000000400000-0x000000000040F000-memory.dmp

    Filesize

    60KB