Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
117s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
09/09/2024, 01:53
Static task
static1
Behavioral task
behavioral1
Sample
ea529a42001fb614bd3d9c3d8b9b1640N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ea529a42001fb614bd3d9c3d8b9b1640N.exe
Resource
win10v2004-20240802-en
General
-
Target
ea529a42001fb614bd3d9c3d8b9b1640N.exe
-
Size
6.6MB
-
MD5
ea529a42001fb614bd3d9c3d8b9b1640
-
SHA1
9a78db6bccfeba5a1eb35241c03af1d6740c451e
-
SHA256
123fa1e0f2bc48e07a8f8cfb28ebc5d88ea76db7bebe6b1eedeeeda4154113ed
-
SHA512
0adbcae73216d7ee5d626e83b06147398994c1a3054acf293f9fffa3202f376bdf48bc7ce117203b610c7c7e595a1336f21e3878be33f37cb5815fcc32a6cec5
-
SSDEEP
98304:GEL9hLM+W6XmXDEM5PxFNvK8wmzi2bXitsPpShc28UCbJjT3/pGiIB:Dz/XwDEMBNvK8w2bStsz287bJv3/Fq
Malware Config
Signatures
-
Suspicious use of NtSetInformationThreadHideFromDebugger 31 IoCs
pid Process 4616 ea529a42001fb614bd3d9c3d8b9b1640N.exe 4616 ea529a42001fb614bd3d9c3d8b9b1640N.exe 4616 ea529a42001fb614bd3d9c3d8b9b1640N.exe 4616 ea529a42001fb614bd3d9c3d8b9b1640N.exe 4616 ea529a42001fb614bd3d9c3d8b9b1640N.exe 4616 ea529a42001fb614bd3d9c3d8b9b1640N.exe 4616 ea529a42001fb614bd3d9c3d8b9b1640N.exe 4616 ea529a42001fb614bd3d9c3d8b9b1640N.exe 4616 ea529a42001fb614bd3d9c3d8b9b1640N.exe 4616 ea529a42001fb614bd3d9c3d8b9b1640N.exe 4616 ea529a42001fb614bd3d9c3d8b9b1640N.exe 4616 ea529a42001fb614bd3d9c3d8b9b1640N.exe 4616 ea529a42001fb614bd3d9c3d8b9b1640N.exe 4616 ea529a42001fb614bd3d9c3d8b9b1640N.exe 4616 ea529a42001fb614bd3d9c3d8b9b1640N.exe 4616 ea529a42001fb614bd3d9c3d8b9b1640N.exe 4616 ea529a42001fb614bd3d9c3d8b9b1640N.exe 4616 ea529a42001fb614bd3d9c3d8b9b1640N.exe 4616 ea529a42001fb614bd3d9c3d8b9b1640N.exe 4616 ea529a42001fb614bd3d9c3d8b9b1640N.exe 4616 ea529a42001fb614bd3d9c3d8b9b1640N.exe 4616 ea529a42001fb614bd3d9c3d8b9b1640N.exe 4616 ea529a42001fb614bd3d9c3d8b9b1640N.exe 4616 ea529a42001fb614bd3d9c3d8b9b1640N.exe 4616 ea529a42001fb614bd3d9c3d8b9b1640N.exe 4616 ea529a42001fb614bd3d9c3d8b9b1640N.exe 4616 ea529a42001fb614bd3d9c3d8b9b1640N.exe 4616 ea529a42001fb614bd3d9c3d8b9b1640N.exe 4616 ea529a42001fb614bd3d9c3d8b9b1640N.exe 4616 ea529a42001fb614bd3d9c3d8b9b1640N.exe 4616 ea529a42001fb614bd3d9c3d8b9b1640N.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ea529a42001fb614bd3d9c3d8b9b1640N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RunDll32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4616 ea529a42001fb614bd3d9c3d8b9b1640N.exe 4616 ea529a42001fb614bd3d9c3d8b9b1640N.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4616 ea529a42001fb614bd3d9c3d8b9b1640N.exe 4616 ea529a42001fb614bd3d9c3d8b9b1640N.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4616 wrote to memory of 2932 4616 ea529a42001fb614bd3d9c3d8b9b1640N.exe 96 PID 4616 wrote to memory of 2932 4616 ea529a42001fb614bd3d9c3d8b9b1640N.exe 96 PID 4616 wrote to memory of 2932 4616 ea529a42001fb614bd3d9c3d8b9b1640N.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\ea529a42001fb614bd3d9c3d8b9b1640N.exe"C:\Users\Admin\AppData\Local\Temp\ea529a42001fb614bd3d9c3d8b9b1640N.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Windows\SysWOW64\RunDll32.exeRunDll32.exe InetCpl.cpl,ResetIEtoDefaults2⤵
- System Location Discovery: System Language Discovery
PID:2932
-