Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/08/2024, 16:25

General

  • Target

    8a31ca87b44095b2d642519cb949c944e2ae434f6652d1ee8772ce1e1168dae0.exe

  • Size

    34.1MB

  • MD5

    4d64dc26add3df7d8fbe10f48e8eda25

  • SHA1

    b085e74be196cff9e00c2273f10bd3cd919fa77b

  • SHA256

    8a31ca87b44095b2d642519cb949c944e2ae434f6652d1ee8772ce1e1168dae0

  • SHA512

    4532171c3b5cf52932edbea45501eecf4ca6883cf7acc042b59162942b5f4136ea38f0c1f15424fcbfe9f37beb07631cb4b2c8e415515815d0e2a2a53e1d8261

  • SSDEEP

    786432:dUafUN8vBN8vJOd3k9Q4sfA3Ui0AUkmaSC4vrWpiVh/XaM:dUafUuZNcJF9jGfi0NaSrYij

Score
4/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8a31ca87b44095b2d642519cb949c944e2ae434f6652d1ee8772ce1e1168dae0.exe
    "C:\Users\Admin\AppData\Local\Temp\8a31ca87b44095b2d642519cb949c944e2ae434f6652d1ee8772ce1e1168dae0.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2260
    • C:\Users\Admin\AppData\Local\Temp\is-PBBRI.tmp\8a31ca87b44095b2d642519cb949c944e2ae434f6652d1ee8772ce1e1168dae0.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-PBBRI.tmp\8a31ca87b44095b2d642519cb949c944e2ae434f6652d1ee8772ce1e1168dae0.tmp" /SL5="$7023C,35359418,147968,C:\Users\Admin\AppData\Local\Temp\8a31ca87b44095b2d642519cb949c944e2ae434f6652d1ee8772ce1e1168dae0.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:936

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\is-PBBRI.tmp\8a31ca87b44095b2d642519cb949c944e2ae434f6652d1ee8772ce1e1168dae0.tmp

    Filesize

    1.2MB

    MD5

    88839fa0bbe92e6c37493fe7c0205cf3

    SHA1

    6267d2fbc3de499a7c853763f65996b0d86db455

    SHA256

    5f571594b4266d05b14f2696bcf3a7e3c658e87b24096d0b90b0077346c543de

    SHA512

    672b6b7d2653930eb523eb8d808bfca689390382c8d6845e158675243884f08f3249b588212f33108db3187e97873d47e9543e8bbba67036c9394caf20545c25

  • memory/936-7-0x0000000000400000-0x0000000000532000-memory.dmp

    Filesize

    1.2MB

  • memory/936-13-0x0000000000400000-0x0000000000532000-memory.dmp

    Filesize

    1.2MB

  • memory/2260-2-0x0000000000401000-0x0000000000412000-memory.dmp

    Filesize

    68KB

  • memory/2260-0-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/2260-12-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB