Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
09/09/2024, 21:40
General
-
Target
5499f1666140a15d197578099b296075b7b9c76a3714daba521139d6b479394f.exe
-
Size
2.3MB
-
MD5
c448e7ba48015f2161bcdc520efdd0be
-
SHA1
9ad690b77c7809b44d7816ea2d0dfdae05a82989
-
SHA256
5499f1666140a15d197578099b296075b7b9c76a3714daba521139d6b479394f
-
SHA512
b41371f280bc93a58233f0623b6321e364e722977e99529b025bf9d2d8a43ad32d577bf8b007f3698471cf0af5376d5e4e2369ee407a9bfdab4b7e24d9a17a16
-
SSDEEP
49152:6kQTAQfGuxOtReiPjyuECu02Qo81wnXy1DQnC:6ayxOTVeXTQrwilQnC
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5499f1666140a15d197578099b296075b7b9c76a3714daba521139d6b479394f.exe"C:\Users\Admin\AppData\Local\Temp\5499f1666140a15d197578099b296075b7b9c76a3714daba521139d6b479394f.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ren.exe"C:\Users\Admin\AppData\Local\Temp\ren.exe" C:\Users\Admin\AppData\Local\Temp\5499f1666140a15d197578099b296075b7b9c76a3714daba521139d6b479394f.exe 47522⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\vP3nIjov83.exe"C:\Users\Admin\AppData\Local\Temp\vP3nIjov83.exe" run 49403⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
67KB
MD5b48ee45a24990664d7392baeef2fe115
SHA104f6578a3b2461938b48f5bf9c6160a209cd30c4
SHA2562100f1991075959c04fb3f5acb994cc229f47523fddd7357887135ea27624a94
SHA512c960f132567a6c0030f23a6fc48ac19cc4db59b9852adb2253ebbaf837257e2cc5baf7e6598a2d58f6fe94bd7743ff124cc6b79fcabe658847caa0f3b796cfbb
-
Filesize
180KB
MD5f636949e31ebde732ed742647d114aef
SHA1ea8f00281cad5554be7e0f9399c7575e40ee5eeb
SHA25673f6b7c9d2c8bd72ff05b9476fe13c31d81a62304e33951282837de59090ad52
SHA512e81b5eb76a9bf11dabc444f33f0293b0099d409b9256ce33793e89cac80244899561d575d2b9136a53d5b30dfb980576fbf58402ad5f7c36544273bc87966715
-
Filesize
2.3MB
MD5ac8eee60ecf8af7adc4100ca42c6a5eb
SHA1b66c953b1ccc7197f7aa755e7c9372b1751d9f0a
SHA256755be3446b1145ccf9737c89865031e75075f3ff9f8cf5d3e80167b2fa3fc74d
SHA512c303d5780e47fb5cd101ae0cba6120bf6770e770551a963e0bd75bdfe296bbb782040ceff300ced34095202a35c840248dbd95bfdd1a92790a98a29fbb517175
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
408KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
584KB
-
Filesize
7.7MB
-
Filesize
40KB
-
Filesize
1.8MB
-
Filesize
7.7MB
-
Filesize
4KB
-
Filesize
2.3MB
-
Filesize
7.7MB
-
Filesize
2.3MB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
2.3MB
-
Filesize
5.6MB
-
Filesize
7.7MB
-
Filesize
112KB
-
Filesize
112KB
-
Filesize
7.7MB
-
Filesize
7.7MB