Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    114s
  • max time network
    120s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/09/2024, 10:04

General

  • Target

    8f47732a54d94ad426705cd83814d99a736ec97c4b25d850d0b306a257c686fcN.exe

  • Size

    83KB

  • MD5

    ed8ff0b389fdfb0bdc33ca158595c510

  • SHA1

    e4cfb802d3478463b29a7ff62b0101f7f4745ab6

  • SHA256

    8f47732a54d94ad426705cd83814d99a736ec97c4b25d850d0b306a257c686fc

  • SHA512

    add85433c6514d72d207fbf4f9e37f701cab1f06327a2080c4b50119346646ced16a82cf4fe549aa598ee441ccfd39c262e372a134e1c9d67f96ef443779e010

  • SSDEEP

    1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+FK:LJ0TAz6Mte4A+aaZx8EnCGVuF

Score
5/10

Malware Config

Signatures

  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\8f47732a54d94ad426705cd83814d99a736ec97c4b25d850d0b306a257c686fcN.exe
    "C:\Users\Admin\AppData\Local\Temp\8f47732a54d94ad426705cd83814d99a736ec97c4b25d850d0b306a257c686fcN.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    PID:1384
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4008,i,10065386245627775856,6567048529106473151,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:8
    1⤵
      PID:4216

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\rifaien2-Gfp0jLcwIxIMX69T.exe

      Filesize

      83KB

      MD5

      6902e574190f76106656ea3e6f2f4599

      SHA1

      0cbc2335f52640d0c98d1e7b48fef745a31f8135

      SHA256

      9e7c07e987702af49cac4fe34fedfc903ebe0511c0283074f8b82df1527e4ddd

      SHA512

      9ebf3fbe46e04a447e70b12cad6574519f0fd4ef2f7d6883f5b7c003d332890a64f1df45d59fd61bc66b1cf6c8808d8401045c28de2d85617be769aef6b4fc6d

    • memory/1384-0-0x0000000000400000-0x000000000042A000-memory.dmp

      Filesize

      168KB

    • memory/1384-1-0x0000000000400000-0x000000000042A000-memory.dmp

      Filesize

      168KB

    • memory/1384-4-0x0000000000400000-0x000000000042A000-memory.dmp

      Filesize

      168KB

    • memory/1384-8-0x0000000000400000-0x000000000042A000-memory.dmp

      Filesize

      168KB

    • memory/1384-11-0x0000000000400000-0x000000000042A000-memory.dmp

      Filesize

      168KB

    • memory/1384-15-0x0000000000400000-0x000000000042A000-memory.dmp

      Filesize

      168KB

    • memory/1384-22-0x0000000000400000-0x000000000042A000-memory.dmp

      Filesize

      168KB