Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    103s
  • max time network
    105s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/08/2024, 12:22

General

  • Target

    b931920c17042d36d1fcaac5ca6cac20N.exe

  • Size

    9.8MB

  • MD5

    b931920c17042d36d1fcaac5ca6cac20

  • SHA1

    bb7a8d7cfcd28aafc210fa988f2b3356dbcd0feb

  • SHA256

    e7d65d47715eb27f4385a5fe74335623081feb128d330ed5c9fb2c5f9da08394

  • SHA512

    c2bd1d959d20be185fc2ecafa04e1a1b3fc0aa711e57572e5d48cd9f4052afb5f522d8e11344a2e292fb0b2c8324eec8a5a5c652983fac1b799bac8769494bd9

  • SSDEEP

    98304:rGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGyooooooooooooooooooq:Q

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in System32 directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\b931920c17042d36d1fcaac5ca6cac20N.exe
    "C:\Users\Admin\AppData\Local\Temp\b931920c17042d36d1fcaac5ca6cac20N.exe"
    1⤵
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    PID:3896
  • C:\Windows\SysWOW64\svrwsc.exe
    C:\Windows\SysWOW64\svrwsc.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    PID:1020

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\svrwsc.exe

    Filesize

    10.3MB

    MD5

    3882e0f24280645ae1236ff550bb9671

    SHA1

    96ef3dbc760d30459c2172b8c7da16376f8cf25b

    SHA256

    aed5dd3ff238564d4695266cd83913f4c13d0ff6ebe484d1f88f484fed2cd79c

    SHA512

    7385e3a8d4f63e2030ff2d33b765222001e7aced2ed2dee338c5df796ffe055a3574694469cd5059ecfcc8874f94527a06759d76dcddd4b08b47f3d0fe1026f1

  • memory/1020-8-0x0000000000400000-0x000000000042B000-memory.dmp

    Filesize

    172KB

  • memory/1020-7-0x0000000000400000-0x000000000042B000-memory.dmp

    Filesize

    172KB

  • memory/3896-0-0x0000000000400000-0x000000000042B000-memory.dmp

    Filesize

    172KB

  • memory/3896-1-0x0000000000401000-0x0000000000402000-memory.dmp

    Filesize

    4KB

  • memory/3896-3-0x0000000000400000-0x000000000042B000-memory.dmp

    Filesize

    172KB

  • memory/3896-2-0x0000000000400000-0x000000000042B000-memory.dmp

    Filesize

    172KB

  • memory/3896-11-0x0000000000400000-0x000000000042B000-memory.dmp

    Filesize

    172KB