Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
14/09/2024, 09:00
General
-
Target
$PLUGINSDIR/bomgar-scc.exe
-
Size
763KB
-
MD5
043cac1683f5cab7d079925a4b8a0fed
-
SHA1
509ee93fcee9b59e6d383f30e55e52f88747e9b8
-
SHA256
25eae86c681f75d42985aa9d9ebc097167354bfb81419abc686c24492eadf211
-
SHA512
f1d4fb37f9866f6ca21622e6a0bf1c9993595bcc9480b91f80714d88fdc715ceb214403b53e427b237a61ca07891e8a7cf468b27551b68eb3583a20447d953d2
-
SSDEEP
12288:V7a27+406MfKJ+VyiDcbPS92LDhMpwphkfPGoCBLrlTbyP/hca9H0eA5VkWbIOj:37+4w/IgcbPDDphkuBLcHhF9H0RkWbIi
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\bomgar-scc.exe"C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\bomgar-scc.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
54B
MD51ac1c78bd1edd689a9ee729a5da64986
SHA1fef32e8d12e2dc3eb849e2295e923473f6534df7
SHA256283d1698bba02f1487d1e5e982309a61d5ecc5786f603e0eb4c2db9d57f9fb11
SHA512f908b55d6a8fd5c0843c461b5d783e785627653815a48e2ab7329572cff25e75149c4b82a7d3473631e4240c646f5435638ad2cb218d6b51ef96f9a84ba99e52
-
Filesize
2.3MB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
2.3MB
-
Filesize
4KB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB