Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
06/09/2024, 14:14 UTC
General
-
Target
38013984ecec19ab2889f68c3404c10c434b44ad68d9e3978cb853c18742dabc.exe
-
Size
330KB
-
MD5
ee1b0e6423386f2c53869725a16c24ae
-
SHA1
c3a06587bb81b375b1f1b606e279afb41150a26d
-
SHA256
38013984ecec19ab2889f68c3404c10c434b44ad68d9e3978cb853c18742dabc
-
SHA512
61bf4006cca47161050b335b42db5e0943b892848920a24e4c3334f76d93ad18951647f1d92c942c7c64b170027da5775b7ea3e2cdb04412a31a02f1fcc9136d
-
SSDEEP
6144:fxYrRwGrWwNDCBC2iDFOIh10+7vdX6Ba/AOIPb+PqR/J7y12:fxWrNtDFf1BrRHhiR/J7B
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Drops file in Windows directory 1 IoCs
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\38013984ecec19ab2889f68c3404c10c434b44ad68d9e3978cb853c18742dabc.exe"C:\Users\Admin\AppData\Local\Temp\38013984ecec19ab2889f68c3404c10c434b44ad68d9e3978cb853c18742dabc.exe"1⤵
- Checks computer location settings
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SIAMIT~1.EXE"C:\Users\Admin\AppData\Local\Temp\SIAMIT~1.EXE" -hwnd 196988 -uninstall2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" -command "Get-WinUserLanguageList | ConvertTo-Json -Compress"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
-
DNS196.249.167.52.in-addr.arpaRemote address:8.8.8.8:53Request196.249.167.52.in-addr.arpaIN PTRResponse -
DNS81.144.22.2.in-addr.arpaRemote address:8.8.8.8:53Request81.144.22.2.in-addr.arpaIN PTRResponse81.144.22.2.in-addr.arpaIN PTRa2-22-144-81deploystaticakamaitechnologiescom
-
DNS74.32.126.40.in-addr.arpaRemote address:8.8.8.8:53Request74.32.126.40.in-addr.arpaIN PTRResponse
-
DNS95.221.229.192.in-addr.arpaRemote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
DNS97.17.167.52.in-addr.arpaRemote address:8.8.8.8:53Request97.17.167.52.in-addr.arpaIN PTRResponse
-
DNS15.164.165.52.in-addr.arpaRemote address:8.8.8.8:53Request15.164.165.52.in-addr.arpaIN PTRResponse
-
DNS183.59.114.20.in-addr.arpaRemote address:8.8.8.8:53Request183.59.114.20.in-addr.arpaIN PTRResponse
-
DNS107.12.20.2.in-addr.arpaRemote address:8.8.8.8:53Request107.12.20.2.in-addr.arpaIN PTRResponse107.12.20.2.in-addr.arpaIN PTRa2-20-12-107deploystaticakamaitechnologiescom
-
DNS172.210.232.199.in-addr.arpaRemote address:8.8.8.8:53Request172.210.232.199.in-addr.arpaIN PTRResponse
-
DNS11.227.111.52.in-addr.arpaRemote address:8.8.8.8:53Request11.227.111.52.in-addr.arpaIN PTRResponse
-
8.8.8.8:53196.249.167.52.in-addr.arpadns
DNS Request
196.249.167.52.in-addr.arpa
-
8.8.8.8:5381.144.22.2.in-addr.arpadns
DNS Request
81.144.22.2.in-addr.arpa
-
8.8.8.8:5374.32.126.40.in-addr.arpadns
DNS Request
74.32.126.40.in-addr.arpa
-
8.8.8.8:5395.221.229.192.in-addr.arpadns
DNS Request
95.221.229.192.in-addr.arpa
-
8.8.8.8:5397.17.167.52.in-addr.arpadns
DNS Request
97.17.167.52.in-addr.arpa
-
8.8.8.8:5315.164.165.52.in-addr.arpadns
DNS Request
15.164.165.52.in-addr.arpa
-
8.8.8.8:53183.59.114.20.in-addr.arpadns
DNS Request
183.59.114.20.in-addr.arpa
-
8.8.8.8:53107.12.20.2.in-addr.arpadns
DNS Request
107.12.20.2.in-addr.arpa
-
8.8.8.8:53172.210.232.199.in-addr.arpadns
DNS Request
172.210.232.199.in-addr.arpa
-
8.8.8.8:5311.227.111.52.in-addr.arpadns
DNS Request
11.227.111.52.in-addr.arpa
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD5c5e027ed9553b7c0e197da9b232213de
SHA106f84573662df0cd76ce1c1ee3c5f8a54a56f3e3
SHA256b20b85422d00b6cc739c1109587cd31042e2711a5b8147e2b1b2a42db47f82b7
SHA512abf28d69722cc699e46d80997e46ff10fce771305de0108d9c7ba454f3ae736f557c451edcd1380b8ae6fe4e122929b4d106d376e04d55548092eea8bf03e25f
-
Filesize
117KB
MD55d77bda9abaf2d713df2fb3b7db4860f
SHA164a3f12df35235d18d4af16f709bf2c03cb88032
SHA256865e73bc9f80c58fd2795709b549dc8fe8e09f86af6fc11a039cb134d4657419
SHA5120930ccf6ff6fa3cf0ebae60e69e226270f2ada40df5a8b42f5ad797d79a23618e6d632ca90ded9eacfc3905f6bee2d6db42f20b04017cfbe674fa112e49bd8b3
-
Filesize
14KB
MD58b6e9fdeba7279871f71526306ed22dd
SHA11098341a3fab76fc52d15fcd2b39d321be7a0655
SHA25635a39de3c9ccc0cd567a895ce9c503150f3e994bc5c9f552e7d1e69ee0081706
SHA512d377b2ed79e28299ff9cb50d818e987b7d6ea4f9f60ad313cf2b129d2f56414982229a846a504a71160e82c205f532df5f9fd7b2019eb8f7f20b2aa3312cf54f
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
26KB
MD50ee5c85d988e567c0fb740eb231e5e81
SHA1713547ca83b1c416603b8cc4786290af9e983712
SHA256e5ed3d2e0ba8e5e0a17b8e8e45b42e1a5d293e977c79c1856a6314bddcfc4389
SHA5128cdef4628ef05803eb38ce30546ee0099611f7fa1458148924cccd7e024a1c6fd8930909b42f8fa500b4dc3d2b3a8b7ad60a51ab72b6a439c1e080ae9864e9ca
-
Filesize
7.7MB
-
Filesize
584KB
-
Filesize
4KB
-
Filesize
5.6MB
-
Filesize
40KB
-
Filesize
128KB
-
Filesize
7.7MB
-
Filesize
4KB
-
Filesize
200KB
-
Filesize
40KB
-
Filesize
3.3MB
-
Filesize
120KB
-
Filesize
304KB
-
Filesize
408KB
-
Filesize
304KB
-
Filesize
120KB
-
Filesize
652KB
-
Filesize
6.5MB
-
Filesize
104KB
-
Filesize
408KB
-
Filesize
600KB
-
Filesize
48KB
-
Filesize
1.8MB
-
Filesize
5.2MB
-
Filesize
7.7MB
-
Filesize
136KB
-
Filesize
6.2MB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
216KB
-
Filesize
7.7MB