Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
103s -
max time network
105s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
23/08/2024, 12:22
Behavioral task
behavioral1
Sample
b931920c17042d36d1fcaac5ca6cac20N.exe
Resource
win7-20240708-en
General
-
Target
b931920c17042d36d1fcaac5ca6cac20N.exe
-
Size
9.8MB
-
MD5
b931920c17042d36d1fcaac5ca6cac20
-
SHA1
bb7a8d7cfcd28aafc210fa988f2b3356dbcd0feb
-
SHA256
e7d65d47715eb27f4385a5fe74335623081feb128d330ed5c9fb2c5f9da08394
-
SHA512
c2bd1d959d20be185fc2ecafa04e1a1b3fc0aa711e57572e5d48cd9f4052afb5f522d8e11344a2e292fb0b2c8324eec8a5a5c652983fac1b799bac8769494bd9
-
SSDEEP
98304:rGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGyooooooooooooooooooq:Q
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1020 svrwsc.exe -
resource yara_rule behavioral2/memory/3896-0-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/3896-2-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/files/0x00090000000233ef-5.dat upx behavioral2/memory/1020-7-0x0000000000400000-0x000000000042B000-memory.dmp upx -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\svrwsc.exe b931920c17042d36d1fcaac5ca6cac20N.exe File created C:\Windows\SysWOW64\svrwsc.exe svrwsc.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b931920c17042d36d1fcaac5ca6cac20N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b931920c17042d36d1fcaac5ca6cac20N.exe"C:\Users\Admin\AppData\Local\Temp\b931920c17042d36d1fcaac5ca6cac20N.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3896
-
C:\Windows\SysWOW64\svrwsc.exeC:\Windows\SysWOW64\svrwsc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1020
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10.3MB
MD53882e0f24280645ae1236ff550bb9671
SHA196ef3dbc760d30459c2172b8c7da16376f8cf25b
SHA256aed5dd3ff238564d4695266cd83913f4c13d0ff6ebe484d1f88f484fed2cd79c
SHA5127385e3a8d4f63e2030ff2d33b765222001e7aced2ed2dee338c5df796ffe055a3574694469cd5059ecfcc8874f94527a06759d76dcddd4b08b47f3d0fe1026f1