Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
111s -
max time network
103s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
17/08/2024, 18:49
General
-
Target
fd1c4cbf9d453ae4c1ca38738a340200N.exe
-
Size
33KB
-
MD5
fd1c4cbf9d453ae4c1ca38738a340200
-
SHA1
58c60758587a65050b403f1e3556d0255f3060c7
-
SHA256
4a1b16364c0928824aa286ffa2d028965723cbd35c8fc04b36562736c281df47
-
SHA512
9833acc01d95a9246b568a30885a2f595a75a0ce897ec122ee605782e4a111915e0831d7f02ac75cbe599861600da48fe3e2c4ca32d8524f05500771bb946146
-
SSDEEP
768:4noSEjp9Plchfr6TUqnbcuyD7UYK4pavvvZeee26666HEEExTtqqqqBttttv:4oSEZWTUUqnouy8YXEvvvZeee5Lttttv
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fd1c4cbf9d453ae4c1ca38738a340200N.exe"C:\Users\Admin\AppData\Local\Temp\fd1c4cbf9d453ae4c1ca38738a340200N.exe"1⤵
- Checks computer location settings
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\FD1C4C~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\Debug\igkhost.exeC:\Windows\Debug\igkhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
34KB
MD5b040b39829000ff996fcc4a34db88b45
SHA14b5ea12151976eae8e66d16c9dade2320f3b274f
SHA2567ac92d7185846f0954cd26d888ee788571f2537ba56164f299475f3d8360738f
SHA5120b1fce892fd26fb59b4fbe8e62f0b6e64cb2f8a868de67252f9c6810b4d3502c228ece099f7798dd420f60e28a30a28bff6457c3b85916de61d6faebbf5b8a57
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
56KB