Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
131s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
21/08/2024, 02:17
Static task
static1
Behavioral task
behavioral1
Sample
c239349587f9cd75f79c2490c851a64883c55f608195b2572e5c1fa73d1432ac.exe
Resource
win7-20240708-en
General
-
Target
c239349587f9cd75f79c2490c851a64883c55f608195b2572e5c1fa73d1432ac.exe
-
Size
25.6MB
-
MD5
ef9323bf9b60b2fa7436bd1923d222bb
-
SHA1
d633535341399ae503de6e19e18c0a13840c9483
-
SHA256
c239349587f9cd75f79c2490c851a64883c55f608195b2572e5c1fa73d1432ac
-
SHA512
547bd693a7d72a5c7b194d21a9a1954f139d2890bc29c36ef9fcc3a7a4b15221b021521b5fe08c35b58f9b8f7bfb73d42d73bfbb09ea50f9a339f43ffb10c55c
-
SSDEEP
98304:2Dv/WQ6G2lRP7lO0wrUO00iAZ6sammO51fJBEd4reXzOKMXnsZF3g:mlARP7lp2UO+457Cd+eXSzns4
Malware Config
Extracted
lumma
https://interactiedovspm.shop/api
https://potentioallykeos.shop/api
https://charecteristicdxp.shop/api
https://cagedwifedsozm.shop/api
https://deicedosmzj.shop/api
https://southedhiscuso.shop/api
https://consciousourwi.shop/api
https://tenntysjuxmz.shop/api
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2312 set thread context of 3668 2312 c239349587f9cd75f79c2490c851a64883c55f608195b2572e5c1fa73d1432ac.exe 99 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BitLockerToGo.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 2312 wrote to memory of 3668 2312 c239349587f9cd75f79c2490c851a64883c55f608195b2572e5c1fa73d1432ac.exe 99 PID 2312 wrote to memory of 3668 2312 c239349587f9cd75f79c2490c851a64883c55f608195b2572e5c1fa73d1432ac.exe 99 PID 2312 wrote to memory of 3668 2312 c239349587f9cd75f79c2490c851a64883c55f608195b2572e5c1fa73d1432ac.exe 99 PID 2312 wrote to memory of 3668 2312 c239349587f9cd75f79c2490c851a64883c55f608195b2572e5c1fa73d1432ac.exe 99 PID 2312 wrote to memory of 3668 2312 c239349587f9cd75f79c2490c851a64883c55f608195b2572e5c1fa73d1432ac.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\c239349587f9cd75f79c2490c851a64883c55f608195b2572e5c1fa73d1432ac.exe"C:\Users\Admin\AppData\Local\Temp\c239349587f9cd75f79c2490c851a64883c55f608195b2572e5c1fa73d1432ac.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exeC:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe2⤵
- System Location Discovery: System Language Discovery
PID:3668
-