Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    94s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/09/2024, 11:12

General

  • Target

    19b2698fa39c941ea15aca963f5c44d7ebef4efde59ba6bc1797bfbf03b63a2bN.exe

  • Size

    78KB

  • MD5

    9b10d73626631e088946f5ffce9ba880

  • SHA1

    708a469dfb42d8ad9640d31897d0c247e7055e28

  • SHA256

    19b2698fa39c941ea15aca963f5c44d7ebef4efde59ba6bc1797bfbf03b63a2b

  • SHA512

    e7f0cb49a473d6243e4dee04eb5d6e2f414a1a5d92c38d69be51e10e3e8bbcd250a483f4b3d3707f8a47c593523b6fc21896a06cb36df7654532504416a9f889

  • SSDEEP

    1536:86RAo0ej2d6rnJwwvlNlIUBvsI7hrhEh9cpDN/qhAvP3OChhW4dI0h4HCIzhUvTJ:xAo1lOwvlNlXBvsI7hrhEh9cpDN/qhA/

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\19b2698fa39c941ea15aca963f5c44d7ebef4efde59ba6bc1797bfbf03b63a2bN.exe
    "C:\Users\Admin\AppData\Local\Temp\19b2698fa39c941ea15aca963f5c44d7ebef4efde59ba6bc1797bfbf03b63a2bN.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:696
    • C:\Windows\microsofthelp.exe
      "C:\Windows\microsofthelp.exe"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      PID:4664

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\microsofthelp.exe

    Filesize

    78KB

    MD5

    38efc5ca6c6497163aa3aa16205cf08b

    SHA1

    76d2180fec1a82662211ad310301d36c0c5a3c48

    SHA256

    04519f0fe1816438a9ae2f63cb8d07447238d52564406203c56dad085fcb9ce3

    SHA512

    c28c76d86a01ed05dc292cf5a8d81010156f92cb1249d6ad9b35f71db47cf9cd1e8b7876c871eb05acb65c1ba1a2d9cd850062664c105034c11e520d0a3f22b3

  • memory/696-0-0x0000000000400000-0x000000000040F000-memory.dmp

    Filesize

    60KB

  • memory/696-5-0x0000000000400000-0x000000000040F000-memory.dmp

    Filesize

    60KB

  • memory/4664-6-0x0000000000400000-0x000000000040F000-memory.dmp

    Filesize

    60KB

  • memory/4664-7-0x0000000000400000-0x000000000040F000-memory.dmp

    Filesize

    60KB