Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
95s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
21/09/2024, 14:39
Static task
static1
Behavioral task
behavioral1
Sample
ee9db91b16673e1ecf6f6b5348ddb408bca6ebf8f725d031d83cc24a2eef12edN.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ee9db91b16673e1ecf6f6b5348ddb408bca6ebf8f725d031d83cc24a2eef12edN.exe
Resource
win10v2004-20240802-en
General
-
Target
ee9db91b16673e1ecf6f6b5348ddb408bca6ebf8f725d031d83cc24a2eef12edN.exe
-
Size
73KB
-
MD5
37490e0ff6a2ffe69132728c295693c0
-
SHA1
8a8c2aa36d118f3e8d87bc07b9397f549f070f33
-
SHA256
ee9db91b16673e1ecf6f6b5348ddb408bca6ebf8f725d031d83cc24a2eef12ed
-
SHA512
885fbdab0572059fc6f5eeba83a77ad37c89cfe684193e2fb596ae2d010f3473d00c159bb3d159bcd066130d48a0f99a857a716a902487b3e5ef8e8a71d5d400
-
SSDEEP
1536:hba0sSg8NRTK5QPqfhVWbdsmA+RjPFLC+e5hM0ZGUGf2g:hmeTNRTNPqfcxA+HFshMOg
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 4932 [email protected] -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ee9db91b16673e1ecf6f6b5348ddb408bca6ebf8f725d031d83cc24a2eef12edN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language [email protected] Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4080 wrote to memory of 1332 4080 ee9db91b16673e1ecf6f6b5348ddb408bca6ebf8f725d031d83cc24a2eef12edN.exe 83 PID 4080 wrote to memory of 1332 4080 ee9db91b16673e1ecf6f6b5348ddb408bca6ebf8f725d031d83cc24a2eef12edN.exe 83 PID 4080 wrote to memory of 1332 4080 ee9db91b16673e1ecf6f6b5348ddb408bca6ebf8f725d031d83cc24a2eef12edN.exe 83 PID 1332 wrote to memory of 4932 1332 cmd.exe 84 PID 1332 wrote to memory of 4932 1332 cmd.exe 84 PID 1332 wrote to memory of 4932 1332 cmd.exe 84 PID 4932 wrote to memory of 4124 4932 [email protected] 85 PID 4932 wrote to memory of 4124 4932 [email protected] 85 PID 4932 wrote to memory of 4124 4932 [email protected] 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\ee9db91b16673e1ecf6f6b5348ddb408bca6ebf8f725d031d83cc24a2eef12edN.exe"C:\Users\Admin\AppData\Local\Temp\ee9db91b16673e1ecf6f6b5348ddb408bca6ebf8f725d031d83cc24a2eef12edN.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4080 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c [email protected]2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1332 -
C:\Users\Admin\AppData\Local\Temp\[email protected]3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 00.exe4⤵
- System Location Discovery: System Language Discovery
PID:4124
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\[email protected]
Filesize73KB
MD5d6e78512f4c747ad1d013155d3cfc94c
SHA1d182a394404c8ff838b5ec5af68f5a7d237deedc
SHA2564ed9e1895fd51cfdd61d7369abc2f7570baf6a9ede445d991925b4aad43fb5d8
SHA51252ddc9dc5216fab95a3da1c1944bb72bbb3090ac16643605821946dd0029ed5fd420bb3d1be5c282fd616867f3e515a33f4b10d606816d78d44a0d9bb62af2a4
-
Filesize
2KB
MD57b621943a35e7f39cf89f50cc48d7b94
SHA12858a28cf60f38025fffcd0ba2ecfec8511c197d
SHA256bef04c2f89dc115ce2763558933dba1767bf30cda6856d335ae68955923f9991
SHA5124169e664ad4e7e6891a05ceed78465e0ec44879b37fc0de97c014945e10c161f6bfb040efc24edc136e69bb115b2a1327b04cefb58141f712da856129872e8f1