Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    145s
  • max time network
    139s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/08/2024, 00:12

General

  • Target

    e957d9e103a9e0c3b52d285e66cc17fc7b6b6b1b15a2662081e7320c47555aab.exe

  • Size

    3.8MB

  • MD5

    243fb2d941347bb9da31a7db9e6c9c5f

  • SHA1

    ecb18811a3289981c310e7a3acfde37149361eaf

  • SHA256

    e957d9e103a9e0c3b52d285e66cc17fc7b6b6b1b15a2662081e7320c47555aab

  • SHA512

    c7b42c52ef17257a6715f73d761211e04ca28d52d08a6fbe8003f43733244d5891648947a0a4cc10982f01a8943c4905e1f3a2263543ce083c6c855dacc5fe41

  • SSDEEP

    49152:0sNwoFRoyw9Yxq8A5CVzPIygMuSGOp09B/pwJrN6GFVfoPpNf9CXmYnMBR/Gl1:bNwoFWyFGCTgBVPG5o28N1bYnMBK

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies system certificate store 2 TTPs 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e957d9e103a9e0c3b52d285e66cc17fc7b6b6b1b15a2662081e7320c47555aab.exe
    "C:\Users\Admin\AppData\Local\Temp\e957d9e103a9e0c3b52d285e66cc17fc7b6b6b1b15a2662081e7320c47555aab.exe"
    1⤵
    • Loads dropped DLL
    • Writes to the Master Boot Record (MBR)
    • System Location Discovery: System Language Discovery
    • Modifies system certificate store
    PID:404

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\{2A7C20BE-3F05-4e8b-B32A-9BB12A9B7240}.tmp\NetBridge.dll

    Filesize

    238KB

    MD5

    8786d469338c30e0ba9fedfc62bd5197

    SHA1

    5fb12028ceae9772f938e1b98b699f0e02e32718

    SHA256

    beeaf8b72f7008e9adabacfcd85e32a50747a0dfb5c86802aeb973bd1f5c3d2f

    SHA512

    5db1e5b78e62cda81a63e8e712e720f87a7c7a539237a55a9098c076f9fb4e0b5adb83383c23657b4ccc90c117e55e3946a399cdf3d15cb94444b203d9d6c45c

  • C:\Users\Admin\AppData\Local\Temp\{5A710E09-7BD9-4733-A338-71039D55F478}.tmp\7z.dll

    Filesize

    1.1MB

    MD5

    2706693dda10c6cc79eed24c56d4e5ef

    SHA1

    4f34ef1bd49273a0d260b9dab15c73eb0ccb6383

    SHA256

    0edad8a1af22d5b97c1f324791c86243a6ecce7b5a9d2f30415af99aba9129c3

    SHA512

    7e7f7ae894528587ba33b6e10999549bb9a2ec2748b5662fa1b8806e5f4ce33af47507b3ef2954f2747a76b5b7c775c1cd671061f577c5016d1f8ba165bbe21c