Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    103s
  • max time network
    105s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/08/2024, 16:24

General

  • Target

    dc8c3a3c9dfa7e4144e6ba88c42a6c30N.exe

  • Size

    36KB

  • MD5

    dc8c3a3c9dfa7e4144e6ba88c42a6c30

  • SHA1

    8e90cd92aa6073726e72d15e53efc6b677fb4470

  • SHA256

    c8c906a1b261efbca2f192c7dcdcbe73d17b5cfc5c5205713243176b05b1f3cf

  • SHA512

    eb2d33b410db3a44152001509a1dc9fe589bedec0aad7791dd39ba0b0d74b8a54e03f2d3450610d2fefc00c5764cf7d2610f75b792a49941b28c0498843a50bb

  • SSDEEP

    384:KrxUgySC4zdy4OyzLeReRcnnX7pi608SO2/yO5YsTg8ULbkVq+kwu2uPs5VlHxkz:ek6zdTiLLpTSOYyYY47UhtPsDxxyqg

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Runs .reg file with regedit 1 IoCs
  • Suspicious behavior: RenamesItself 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\dc8c3a3c9dfa7e4144e6ba88c42a6c30N.exe
    "C:\Users\Admin\AppData\Local\Temp\dc8c3a3c9dfa7e4144e6ba88c42a6c30N.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:912
    • C:\Windows\SysWOW64\regedit.exe
      regedit.exe /s C:\Users\Admin\AppData\Local\Temp\~dfds3.reg
      2⤵
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Runs .reg file with regedit
      PID:4868

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\~dfds3.reg

    Filesize

    166B

    MD5

    f44153ef26be29552cf320325ad8b72e

    SHA1

    74ac72ba2ff0f871e59b11c95ad707372662370c

    SHA256

    767009fb8726500a4bc54b2ee744cc3ada64fdf16a44e22ff9dfe7652e2a439f

    SHA512

    1d42a4dba1d8d0df9f8fedfba384ffdbcff3103c8ba360f255b5d7e8a46128f40521e4d16cf6de04365b3b6ffad8bc681cf7042d92867ab3d912601a3d5e6e65

  • C:\Users\Admin\AppData\Local\WinHttp.exe

    Filesize

    36KB

    MD5

    fddbded159dd7d27b662f9ff4041b82c

    SHA1

    60f71cf1711d94441fda7154ccd65340ef1a2749

    SHA256

    d8ad33e0a8a3cb9bef3290b4dd2d644b4384ae3de68a3dfd79c90cab2ae808af

    SHA512

    2bae9c65415333c6635249f8d4b063322f9f76c0f888574caff67ff5193324e407c9695f9cc55b47f90d0ee71684f1289f180d98257ae654a2bcf7d76efc85f1

  • memory/912-0-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

  • memory/912-11-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB