Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    102s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/08/2024, 13:06

General

  • Target

    c83c1a67a2d39dd131ba716842b83010N.exe

  • Size

    63KB

  • MD5

    c83c1a67a2d39dd131ba716842b83010

  • SHA1

    9e2b7ad2af2559464affc6dd64ddd32d441c18ca

  • SHA256

    b6888b8925cbcfc980e4e0ea8a9d68ff2e7a1289ed456abdfdc8f614312abd62

  • SHA512

    42a4b9416773bedb16bf45e55c3ef6a8854e6b958cbb133e785b6950ab1e59290929657760bc23480942a58e9b11220381b3a37f955e2e37d37f8cfb45462e6d

  • SSDEEP

    1536:lAo0ej2d6rnJwwvlKlIUBP6v8tvGE9UHrSdghj8bvHRIkhbUIchUh80mhDoOho8F:lAo1lOwvlKlXBP6v8tvGE9UHrSdghj8e

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c83c1a67a2d39dd131ba716842b83010N.exe
    "C:\Users\Admin\AppData\Local\Temp\c83c1a67a2d39dd131ba716842b83010N.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2620
    • C:\Windows\microsofthelp.exe
      "C:\Windows\microsofthelp.exe"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      PID:4048

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\microsofthelp.exe

    Filesize

    63KB

    MD5

    1f601ac3338ef1097b802d3449737151

    SHA1

    0b2c4b44776ed1294ed23efc08f67db5ed5c67b3

    SHA256

    237907b25a42e1c2156493e64fb28b650c8d310228383da066cdf5fbc253f627

    SHA512

    2c13747d6eea693caba4e6513062faf462d4a97716958454297dd8e10cff0802b9374283ef952a21b6b6744685d64b5f0de6175068d144dd9b8549f63c34bb2a

  • memory/2620-0-0x0000000000400000-0x000000000040F000-memory.dmp

    Filesize

    60KB

  • memory/2620-4-0x0000000000400000-0x000000000040F000-memory.dmp

    Filesize

    60KB

  • memory/4048-6-0x0000000000400000-0x000000000040F000-memory.dmp

    Filesize

    60KB