Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
3c161f5826a...0N.exe
windows7-x64
7c161f5826a...0N.exe
windows10-2004-x64
7$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDIR/inetc.dll
windows7-x64
3$PLUGINSDIR/inetc.dll
windows10-2004-x64
37za.exe
windows7-x64
37za.exe
windows10-2004-x64
3Analysis
-
max time kernel
94s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
03/09/2024, 10:20
Static task
static1
Behavioral task
behavioral1
Sample
c161f5826a69c4844b4c9cf8e3975070N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
c161f5826a69c4844b4c9cf8e3975070N.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/inetc.dll
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/inetc.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
7za.exe
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
7za.exe
Resource
win10v2004-20240802-en
General
-
Target
c161f5826a69c4844b4c9cf8e3975070N.exe
-
Size
292KB
-
MD5
c161f5826a69c4844b4c9cf8e3975070
-
SHA1
8f1c4a1894292fc7e8cdbf90eb16d1aaf7a1e67f
-
SHA256
afb48e01d2b3315ca103644db00e6c9c1ab57b831e151fd777052bdfb3ce5e29
-
SHA512
9b038e5713110273ea44450fd35d2ae881aea07caf477a9048f6055a2ec315a233fbe671029f437c625fb6296b5bb2e9b69f53722b24b2e43619f51a6917660e
-
SSDEEP
6144:iQ3NtLnM3DoFFjuvf/toNQ8dqLuJoU0U7Hd8CntQOHHM+HFFTjXdpNnT2rJ:NtLnM3D0Fw/tN8dkmLtpHHHrh7
Malware Config
Signatures
-
Loads dropped DLL 5 IoCs
pid Process 2232 c161f5826a69c4844b4c9cf8e3975070N.exe 2232 c161f5826a69c4844b4c9cf8e3975070N.exe 2232 c161f5826a69c4844b4c9cf8e3975070N.exe 2232 c161f5826a69c4844b4c9cf8e3975070N.exe 2232 c161f5826a69c4844b4c9cf8e3975070N.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c161f5826a69c4844b4c9cf8e3975070N.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10KB
MD57fbda5b7be6256996d4e59e5f6949918
SHA12d36c0e0bfbe450675c6ed044e715abaa85a252a
SHA2569bb31f7f02231e3166bf52385d804c06da9740e9c6f0bda807b01052ae9fdcd4
SHA512bc0d36aa6f50041bad05cf48d909ed5a387bff5b111f657591161a288c1be5c20b8c5d69e557b5ea395726d91601b9e6303da81555e053090cfcbf5d44be7f82
-
Filesize
20KB
MD5e541458cfe66ef95ffbea40eaaa07289
SHA1caec1233f841ee72004231a3027b13cdeb13274c
SHA2563bce87b66d9272c82421920c34b0216e12c57a437d1955c36f23c74c1a01d420
SHA5120bf6313e4cb7bbdcfba828fb791540b630adc58c43aa4b5ba77790367d0f34f76077cd84cc62e2a2c98c788a88547f32a11e549873d172c5aa2753124847cd0c