Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

9c2a076307...0N.exe

windows7-x64

10

9c2a076307...0N.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    119s
  • max time network
    115s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/09/2024, 14:46

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    9c2a076307b1a2940c386db058e2fa40N.exe

  • Size

    236KB

  • MD5

    9c2a076307b1a2940c386db058e2fa40

  • SHA1

    fd7e0508bb11e5ae3b5ce15da11b4da73d520eb2

  • SHA256

    54c9a3e913624fd1d77a222b541c34c2984279e10d4c0b9fe1c343f44495134e

  • SHA512

    38e4232480a5cb81a31c689a05fd091cabadde8af52938ca4ae142f28a40138317fbc586a88ffdf6af6e97726fdb70a510ddb7e906d2dac0a31525af09570efd

  • SSDEEP

    6144:f5wgk3vnS/Gi+YdQEp9szHR8uBAoW0EOIp5J+i:2gk3vnS/Gi+YdQEp9szHR8uBAo/Swi

Score
10/10
discoveryevasionpersistence

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
    evasion
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 50 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9c2a076307b1a2940c386db058e2fa40N.exe
    "C:\Users\Admin\AppData\Local\Temp\9c2a076307b1a2940c386db058e2fa40N.exe"
    1⤵
    • Modifies visiblity of hidden/system files in Explorer
    • Checks computer location settings
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4584
    • C:\Users\Admin\yeeedix.exe
      "C:\Users\Admin\yeeedix.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:1392

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\yeeedix.exe
    Filesize

    236KB

    MD5

    6c657aef57e472150200926ebc992a2c

    SHA1

    ee221771fb73e878a62eee26f508faee93651e29

    SHA256

    f55c27928febde344bf65e3a04d9edaaa327e988d8c687a1ee9ff22d74a16a88

    SHA512

    7c1a34cd4d91265bfaf9ed259ba15e5fcf640db1e3edd826090eeaf291e900b39363ceba9665658d6492c1051999211c429a265a7fa5a576ef781e7df5192bdd

    Download Submit