Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
20/08/2024, 19:19
Static task
static1
Behavioral task
behavioral1
Sample
dz2008.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
dz2008.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
新云软件.url
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
新云软件.url
Resource
win10v2004-20240802-en
General
-
Target
dz2008.exe
-
Size
897KB
-
MD5
3c86d925c9cc1b545a4993b1127ab53b
-
SHA1
a7cae96385445c9ce140e3ab686e2429e2598004
-
SHA256
2a171788d31427315c32f2bf2d44893620ce8c2358d65e7d71be0d76317a1777
-
SHA512
2843eca06096e0869eb91965577d351490db72e5e613a21bd9ad53514814b91bd9a2c5f46521bbbb574b52075389c31bad187013ada9f7b52e9fb4aaa928ee9e
-
SSDEEP
24576:EpnizlZeAdlneEwzJfGEAPr08Usa3kY2+mO8K:aizlZzdebsdrI13O+mOF
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 4776 is-U0ARP.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dz2008.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language is-U0ARP.tmp -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1664 wrote to memory of 4776 1664 dz2008.exe 86 PID 1664 wrote to memory of 4776 1664 dz2008.exe 86 PID 1664 wrote to memory of 4776 1664 dz2008.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\dz2008.exe"C:\Users\Admin\AppData\Local\Temp\dz2008.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\is-JOHN7.tmp\is-U0ARP.tmp"C:\Users\Admin\AppData\Local\Temp\is-JOHN7.tmp\is-U0ARP.tmp" /SL4 $70246 "C:\Users\Admin\AppData\Local\Temp\dz2008.exe" 687279 522242⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4776
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
634KB
MD5d291acbf9866b8846fe0629e690feb1a
SHA1293314b11340d798d3c74e2416e2a43f267a25d6
SHA256ab3e1fa210171e5ed2decc615c9328379ee3d29b55ee0e5d7ef6bece43f583eb
SHA512320e68a67fdcf13dc25640cf68468abd9e0dc51b647f95277eebbd06c7c5ee298b1f68d4a01deb886979e42cbc3eddf16ac4db18884a96b1535598ba11ba36ed