Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
29/08/2024, 16:25
Static task
static1
Behavioral task
behavioral1
Sample
8a31ca87b44095b2d642519cb949c944e2ae434f6652d1ee8772ce1e1168dae0.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
8a31ca87b44095b2d642519cb949c944e2ae434f6652d1ee8772ce1e1168dae0.exe
Resource
win10v2004-20240802-en
General
-
Target
8a31ca87b44095b2d642519cb949c944e2ae434f6652d1ee8772ce1e1168dae0.exe
-
Size
34.1MB
-
MD5
4d64dc26add3df7d8fbe10f48e8eda25
-
SHA1
b085e74be196cff9e00c2273f10bd3cd919fa77b
-
SHA256
8a31ca87b44095b2d642519cb949c944e2ae434f6652d1ee8772ce1e1168dae0
-
SHA512
4532171c3b5cf52932edbea45501eecf4ca6883cf7acc042b59162942b5f4136ea38f0c1f15424fcbfe9f37beb07631cb4b2c8e415515815d0e2a2a53e1d8261
-
SSDEEP
786432:dUafUN8vBN8vJOd3k9Q4sfA3Ui0AUkmaSC4vrWpiVh/XaM:dUafUuZNcJF9jGfi0NaSrYij
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 936 8a31ca87b44095b2d642519cb949c944e2ae434f6652d1ee8772ce1e1168dae0.tmp -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8a31ca87b44095b2d642519cb949c944e2ae434f6652d1ee8772ce1e1168dae0.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8a31ca87b44095b2d642519cb949c944e2ae434f6652d1ee8772ce1e1168dae0.tmp -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2260 wrote to memory of 936 2260 8a31ca87b44095b2d642519cb949c944e2ae434f6652d1ee8772ce1e1168dae0.exe 85 PID 2260 wrote to memory of 936 2260 8a31ca87b44095b2d642519cb949c944e2ae434f6652d1ee8772ce1e1168dae0.exe 85 PID 2260 wrote to memory of 936 2260 8a31ca87b44095b2d642519cb949c944e2ae434f6652d1ee8772ce1e1168dae0.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\8a31ca87b44095b2d642519cb949c944e2ae434f6652d1ee8772ce1e1168dae0.exe"C:\Users\Admin\AppData\Local\Temp\8a31ca87b44095b2d642519cb949c944e2ae434f6652d1ee8772ce1e1168dae0.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\is-PBBRI.tmp\8a31ca87b44095b2d642519cb949c944e2ae434f6652d1ee8772ce1e1168dae0.tmp"C:\Users\Admin\AppData\Local\Temp\is-PBBRI.tmp\8a31ca87b44095b2d642519cb949c944e2ae434f6652d1ee8772ce1e1168dae0.tmp" /SL5="$7023C,35359418,147968,C:\Users\Admin\AppData\Local\Temp\8a31ca87b44095b2d642519cb949c944e2ae434f6652d1ee8772ce1e1168dae0.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:936
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\is-PBBRI.tmp\8a31ca87b44095b2d642519cb949c944e2ae434f6652d1ee8772ce1e1168dae0.tmp
Filesize1.2MB
MD588839fa0bbe92e6c37493fe7c0205cf3
SHA16267d2fbc3de499a7c853763f65996b0d86db455
SHA2565f571594b4266d05b14f2696bcf3a7e3c658e87b24096d0b90b0077346c543de
SHA512672b6b7d2653930eb523eb8d808bfca689390382c8d6845e158675243884f08f3249b588212f33108db3187e97873d47e9543e8bbba67036c9394caf20545c25