Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
09/09/2024, 07:33
Static task
static1
Behavioral task
behavioral1
Sample
bbcd738e0bb9c392ee9c94ef8d02d4f0N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
bbcd738e0bb9c392ee9c94ef8d02d4f0N.exe
Resource
win10v2004-20240802-en
General
-
Target
bbcd738e0bb9c392ee9c94ef8d02d4f0N.exe
-
Size
23KB
-
MD5
bbcd738e0bb9c392ee9c94ef8d02d4f0
-
SHA1
5a275397f6fe8bd21404844f57b2fc51f81daeea
-
SHA256
799859c0e6ee90d66c8777b1385be1df02360f7f58544dc9f85d170401dfdbed
-
SHA512
a6d5e08c7ce90c70ab6317e589bce9ed87761dee1288259ef30690fa0dd840298fdfa98b0cd84c6e0e66daecbe31afc9ddc706b6c7ad316a4911dc49c6cc4be9
-
SSDEEP
384:lPGlPywfM1TPh8OqeJOSo1sg62meXSku2x:lPGlPywf6LOSEDmGx
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation bbcd738e0bb9c392ee9c94ef8d02d4f0N.exe -
Executes dropped EXE 1 IoCs
pid Process 5048 budha.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbcd738e0bb9c392ee9c94ef8d02d4f0N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language budha.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1140 wrote to memory of 5048 1140 bbcd738e0bb9c392ee9c94ef8d02d4f0N.exe 84 PID 1140 wrote to memory of 5048 1140 bbcd738e0bb9c392ee9c94ef8d02d4f0N.exe 84 PID 1140 wrote to memory of 5048 1140 bbcd738e0bb9c392ee9c94ef8d02d4f0N.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\bbcd738e0bb9c392ee9c94ef8d02d4f0N.exe"C:\Users\Admin\AppData\Local\Temp\bbcd738e0bb9c392ee9c94ef8d02d4f0N.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1140 -
C:\Users\Admin\AppData\Local\Temp\budha.exe"C:\Users\Admin\AppData\Local\Temp\budha.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5048
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
23KB
MD53049bdcc5cb8eecb94b9758b9f062a65
SHA17ce85c3086f11a7d78d3332566981c632378cb1f
SHA256212682c519b08f3d153d04a2e569e6985695a9d8f7fd5e6c7b17c4fa8167cbc8
SHA51253014931b10894c2aeb7ed048c49d94a0cf9219ad73c656f9e0619112f556a48ad44aeb97d2500434f19cab751675e548e1af45cf1f42c3ce1d31180707df2da