Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    96s
  • max time network
    97s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/09/2024, 10:03

General

  • Target

    e6994fbfa1a399eb3b2bdc43a7781c372dafef7852784a6f74bff052b70fa251N.exe

  • Size

    1.8MB

  • MD5

    9629c09dd115b3482c72e19d7bceb440

  • SHA1

    9c9642a1c1261d99df9e5d1fff7e97ce3c629b1f

  • SHA256

    e6994fbfa1a399eb3b2bdc43a7781c372dafef7852784a6f74bff052b70fa251

  • SHA512

    58daa52d2f448eadcf927b368345bea9d8765e3a149e78322467fe9f81b47f5101649ddbd2ebc93ac0afdfa4f93c8cf9c4bc59518dbc0ea74f5b8a75cfde6af1

  • SSDEEP

    24576:9xFYGY9+9d/G7P9lkQ/exnzGn4dLsUvqkaT+0BpCCh+PDedNdUhZuIBWcC2YYtxn:ON26FOnzGn6LJvqkwnpC+mWd6uIccpsi

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e6994fbfa1a399eb3b2bdc43a7781c372dafef7852784a6f74bff052b70fa251N.exe
    "C:\Users\Admin\AppData\Local\Temp\e6994fbfa1a399eb3b2bdc43a7781c372dafef7852784a6f74bff052b70fa251N.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4968
    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
      "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:1742194 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\e6994fbfa1a399eb3b2bdc43a7781c372dafef7852784a6f74bff052b70fa251N.exe" "__IRCT:0" "__IRTSS:0" "__IRSID:S-1-5-21-2412658365-3084825385-3340777666-1000"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:3260

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

    Filesize

    1.3MB

    MD5

    dec931e86140139380ea0df57cd132b6

    SHA1

    b717fd548382064189c16cb94dda28b1967a5712

    SHA256

    5ffd4b20dccfb84c8890abdb780184a7651e760aefba4ab0c6fba5b2a81f97d9

    SHA512

    14d594e88c4a1f0ec8bc1b4fe2d66e26358f907b1106c047ada35d500ca9e608f1ce5a57599453cf10f11f4d9f1948ced9056ce8bd944b16eca7e9b83e8b27af

  • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll

    Filesize

    318KB

    MD5

    b5fc476c1bf08d5161346cc7dd4cb0ba

    SHA1

    280fac9cf711d93c95f6b80ac97d89cf5853c096

    SHA256

    12cb9b8f59c00ef40ea8f28bfc59a29f12dc28332bf44b1a5d8d6a8823365650

    SHA512

    17fa97f399287b941e958d2d42fe6adb62700b01d9dbe0c824604e8e06d903b330f9d7d8ffb109bfb7f6742f46e7e9cedad6981f0d94d629b8402d0a0174f697

  • memory/3260-12-0x0000000000400000-0x00000000007CB000-memory.dmp

    Filesize

    3.8MB

  • memory/3260-24-0x0000000000400000-0x00000000007CB000-memory.dmp

    Filesize

    3.8MB