Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
93s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
08/09/2024, 20:55
Static task
static1
Behavioral task
behavioral1
Sample
3b8ff2b8bbd9d56a3091740f19b58114d35db44848dce67db685c864b5fc3299.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
3b8ff2b8bbd9d56a3091740f19b58114d35db44848dce67db685c864b5fc3299.exe
Resource
win10v2004-20240802-en
General
-
Target
3b8ff2b8bbd9d56a3091740f19b58114d35db44848dce67db685c864b5fc3299.exe
-
Size
2.7MB
-
MD5
f6486a530d39541ddd6d9aa8fda39efb
-
SHA1
f98c06a6d964599124f607dcb450aa30e1dedf6e
-
SHA256
3b8ff2b8bbd9d56a3091740f19b58114d35db44848dce67db685c864b5fc3299
-
SHA512
90ac1dc6bca6d0dcde037fe6a991a4b4f9b24f88427c70f4009da0ff89615e0ad92a26a86f92071598943be030e716e1c60c9581afcde3b837ffdbf07ff6d014
-
SSDEEP
49152:WrXdF4A9mZwpwh36IHASx2MxxEE98ZG+4LtLwhv/IqjvF:WrXdFeh36IHASx2MfEEVl/q
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation 3b8ff2b8bbd9d56a3091740f19b58114d35db44848dce67db685c864b5fc3299.exe -
Executes dropped EXE 2 IoCs
pid Process 5072 tgfnwmrkyh.exe 1496 tgfnwmrkyh.tmp -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 10 IoCs
description ioc Process File created C:\Program Files (x86)\MYPGNotes\unins000.dat tgfnwmrkyh.tmp File created C:\Program Files (x86)\MYPGNotes\is-937MC.tmp tgfnwmrkyh.tmp File created C:\Program Files (x86)\MYPGNotes\is-CHT6K.tmp tgfnwmrkyh.tmp File created C:\Program Files (x86)\MYPGNotes\is-GK5K5.tmp tgfnwmrkyh.tmp File opened for modification C:\Program Files (x86)\MYPGNotes\unins000.dat tgfnwmrkyh.tmp File opened for modification C:\Program Files (x86)\MYPGNotes\AppleNote.exe tgfnwmrkyh.tmp File opened for modification C:\Program Files (x86)\MYPGNotes\Qt5Concurrent.dll tgfnwmrkyh.tmp File created C:\Program Files (x86)\MYPGNotes\is-PCJBJ.tmp tgfnwmrkyh.tmp File created C:\Program Files (x86)\MYPGNotes\is-KGVR4.tmp tgfnwmrkyh.tmp File created C:\Program Files (x86)\MYPGNotes\is-S48HO.tmp tgfnwmrkyh.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3b8ff2b8bbd9d56a3091740f19b58114d35db44848dce67db685c864b5fc3299.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tgfnwmrkyh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tgfnwmrkyh.tmp -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 396 3b8ff2b8bbd9d56a3091740f19b58114d35db44848dce67db685c864b5fc3299.exe 396 3b8ff2b8bbd9d56a3091740f19b58114d35db44848dce67db685c864b5fc3299.exe 396 3b8ff2b8bbd9d56a3091740f19b58114d35db44848dce67db685c864b5fc3299.exe 396 3b8ff2b8bbd9d56a3091740f19b58114d35db44848dce67db685c864b5fc3299.exe 1496 tgfnwmrkyh.tmp 1496 tgfnwmrkyh.tmp -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1496 tgfnwmrkyh.tmp -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 396 wrote to memory of 1064 396 3b8ff2b8bbd9d56a3091740f19b58114d35db44848dce67db685c864b5fc3299.exe 84 PID 396 wrote to memory of 1064 396 3b8ff2b8bbd9d56a3091740f19b58114d35db44848dce67db685c864b5fc3299.exe 84 PID 396 wrote to memory of 1064 396 3b8ff2b8bbd9d56a3091740f19b58114d35db44848dce67db685c864b5fc3299.exe 84 PID 1064 wrote to memory of 5072 1064 cmd.exe 87 PID 1064 wrote to memory of 5072 1064 cmd.exe 87 PID 1064 wrote to memory of 5072 1064 cmd.exe 87 PID 5072 wrote to memory of 1496 5072 tgfnwmrkyh.exe 89 PID 5072 wrote to memory of 1496 5072 tgfnwmrkyh.exe 89 PID 5072 wrote to memory of 1496 5072 tgfnwmrkyh.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\3b8ff2b8bbd9d56a3091740f19b58114d35db44848dce67db685c864b5fc3299.exe"C:\Users\Admin\AppData\Local\Temp\3b8ff2b8bbd9d56a3091740f19b58114d35db44848dce67db685c864b5fc3299.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:396 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\tgfnwmrkyh.exe" /VERYSILENT2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\tgfnwmrkyh.exe"C:\Users\Admin\AppData\Local\Temp\tgfnwmrkyh.exe" /VERYSILENT3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5072 -
C:\Users\Admin\AppData\Local\Temp\is-EJ44L.tmp\tgfnwmrkyh.tmp"C:\Users\Admin\AppData\Local\Temp\is-EJ44L.tmp\tgfnwmrkyh.tmp" /SL5="$6024A,232785,54272,C:\Users\Admin\AppData\Local\Temp\tgfnwmrkyh.exe" /VERYSILENT4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:1496
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
900KB
MD5f8b110dc2063d3b29502aa7042d26122
SHA11a0fd3db79eadc1ce714f6267d476ddbec0f5e79
SHA256e8730b0bf8f94cbb8babbfefb32cef8e8d19ec823f28c33a7d48c78589710762
SHA512f3125d3f575aff68105ebb3eadbce30547d34e12237d8ebbc555c6fe12bcc0a5ea85a38e26f2900d70af70ec07efde3b8cd65dc0fdada637496531245ea5052f
-
Filesize
526KB
MD59beea33ea128fd25ad509ae7ff7bcff3
SHA13a87a124b47d68bf8eb1d1a4f9695fb2b2a52660
SHA256e0634bc21490c472b233aaec047438feae557f0d57ea5b78b3b48260916e2b4e
SHA512292996177bbb804ea3f6ad51fdb74707f1a1a35d50d8ae7b082d88cbb476bae1a883133c9e1dc4cefce78bc71f8d65276e5cdaeeef03088bc54beb41269dc5b3