Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
21/08/2024, 02:31
General
-
Target
e92c5cf7509dd9792fac8202fb08295dfc9e5f18663db81bf07990de1bc85893.exe
-
Size
2.8MB
-
MD5
d5351a9afa0356b886f609ff7f53603d
-
SHA1
7368de3db110e4398be3edd3afdd6bc48f7bb9fd
-
SHA256
e92c5cf7509dd9792fac8202fb08295dfc9e5f18663db81bf07990de1bc85893
-
SHA512
8c36c8ba6569eab077c25d2f7ec4da93eb660d7223fbc534b09aae663c858d4c4aa79d0b7cacec9da63f74daf3395e860eb22b2ae21df127a6c78b779bfd155f
-
SSDEEP
49152:HBuZrEU1Uk/NWuyh3kw8bgyjvpnLw7vN/86wY6s02ahtTN84eE3Tos5Vm6:hkL1Uk/c338ZvpnLo+fY62SbReEhJ
Malware Config
Signatures
-
Checks for any installed AV software in registry 1 TTPs 6 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
-
Suspicious behavior: EnumeratesProcesses 14 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e92c5cf7509dd9792fac8202fb08295dfc9e5f18663db81bf07990de1bc85893.exe"C:\Users\Admin\AppData\Local\Temp\e92c5cf7509dd9792fac8202fb08295dfc9e5f18663db81bf07990de1bc85893.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-V2UK3.tmp\e92c5cf7509dd9792fac8202fb08295dfc9e5f18663db81bf07990de1bc85893.tmp"C:\Users\Admin\AppData\Local\Temp\is-V2UK3.tmp\e92c5cf7509dd9792fac8202fb08295dfc9e5f18663db81bf07990de1bc85893.tmp" /SL5="$5020A,1870827,1112064,C:\Users\Admin\AppData\Local\Temp\e92c5cf7509dd9792fac8202fb08295dfc9e5f18663db81bf07990de1bc85893.exe"2⤵
- Checks for any installed AV software in registry
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10KB
MD5f23a523b82ad9103a9ac1dcc33eca72f
SHA15363bb6b51923441ef56638576307cc252f05a71
SHA25659853c413b0813ded6f1e557959768d6662f010f49884d36b62c13038fac739c
SHA512514ec63f7ed80d0708f7e2355fad8a558b4dcf2d0122ff98fe7c3ca1f40e7cd04e8869ca7a3b95622c0848c0d99306d7e791b86ca69b9e240beae959ca6285be
-
Filesize
2.0MB
MD5b83f5833e96c2eb13f14dcca805d51a1
SHA19976b0a6ef3dabeab064b188d77d870dcdaf086d
SHA25600e667b838a4125c8cf847936168bb77bb54580bc05669330cb32c0377c4a401
SHA5128641b351e28b3c61ed6762adbca165f4a5f2ee26a023fd74dd2102a6258c0f22e91b78f4a3e9fba6094b68096001de21f10d6495f497580847103c428d30f7bb
-
Filesize
3.3MB
MD5dfb84f0b32159220a4a1465628b5a751
SHA1efe579c8abc58197846cc1cf236d0d47c63adcd8
SHA256527b0d6950701702b71588d925210bfa0abd545d64f4522771a0f6c57d90dbfe
SHA512e2eafd9c381ee644e01e5c2ae25a7e36d20843ccf87e6b5015aba7756e43dd4986cc394e741b1bfdc3e6ea6ff80ef947ef53fd7299dfbe61649db38f0d2d4e16
-
Filesize
1.1MB
-
Filesize
728KB
-
Filesize
1.1MB
-
Filesize
3.3MB
-
Filesize
1.2MB
-
Filesize
3.3MB
-
Filesize
3.3MB
