Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
95s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
09/09/2024, 20:17
Static task
static1
Behavioral task
behavioral1
Sample
f6fd69c06dd8f916595ec21a46b6c820N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
f6fd69c06dd8f916595ec21a46b6c820N.exe
Resource
win10v2004-20240802-en
General
-
Target
f6fd69c06dd8f916595ec21a46b6c820N.exe
-
Size
272KB
-
MD5
f6fd69c06dd8f916595ec21a46b6c820
-
SHA1
1f3948bf199f3a9c111c57830b6e362329917bbd
-
SHA256
98606fcd2eb5c33ddd1077715b745573c1e544d23211668c73bda8c056903243
-
SHA512
eaecb1d10853b378f0f4176231130d058ab371a74138368d8734661235c6d5c7eee95ccc10fcddc55a1046d7fcb098afc1a2835b106670912baa300002dba0f5
-
SSDEEP
6144:WDXjeM+x6t7Hs+qPAEuVnR6NAXvcHs+qH:WXjenxm7sIEuSNAXvcsH
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1484 f6fd69c06dd8f916595ec21a46b6c820N.exe -
Executes dropped EXE 1 IoCs
pid Process 1484 f6fd69c06dd8f916595ec21a46b6c820N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f6fd69c06dd8f916595ec21a46b6c820N.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1824 f6fd69c06dd8f916595ec21a46b6c820N.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 1824 f6fd69c06dd8f916595ec21a46b6c820N.exe 1484 f6fd69c06dd8f916595ec21a46b6c820N.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1824 wrote to memory of 1484 1824 f6fd69c06dd8f916595ec21a46b6c820N.exe 85 PID 1824 wrote to memory of 1484 1824 f6fd69c06dd8f916595ec21a46b6c820N.exe 85 PID 1824 wrote to memory of 1484 1824 f6fd69c06dd8f916595ec21a46b6c820N.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\f6fd69c06dd8f916595ec21a46b6c820N.exe"C:\Users\Admin\AppData\Local\Temp\f6fd69c06dd8f916595ec21a46b6c820N.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\f6fd69c06dd8f916595ec21a46b6c820N.exeC:\Users\Admin\AppData\Local\Temp\f6fd69c06dd8f916595ec21a46b6c820N.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:1484
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
272KB
MD5fde3facad08c97fea60395d89f8a6217
SHA1e56e178977d13608ea61ce7a05b4ee534fa371d1
SHA2562ee1face9bd1ec9fb1849174a9f047efad6eb484dcf0bd74169706ca8d732a5d
SHA512a76c20106cab9149303518af4b3e471123aec67f82436c87c46e134ecb0eec8414ca96dc678bb0189263f445fe984adaf3097712662c75aa411b9721cfb1109a