Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
114s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
27/09/2024, 10:04
Behavioral task
behavioral1
Sample
8f47732a54d94ad426705cd83814d99a736ec97c4b25d850d0b306a257c686fcN.exe
Resource
win7-20240903-en
General
-
Target
8f47732a54d94ad426705cd83814d99a736ec97c4b25d850d0b306a257c686fcN.exe
-
Size
83KB
-
MD5
ed8ff0b389fdfb0bdc33ca158595c510
-
SHA1
e4cfb802d3478463b29a7ff62b0101f7f4745ab6
-
SHA256
8f47732a54d94ad426705cd83814d99a736ec97c4b25d850d0b306a257c686fc
-
SHA512
add85433c6514d72d207fbf4f9e37f701cab1f06327a2080c4b50119346646ced16a82cf4fe549aa598ee441ccfd39c262e372a134e1c9d67f96ef443779e010
-
SSDEEP
1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+FK:LJ0TAz6Mte4A+aaZx8EnCGVuF
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/1384-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1384-1-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1384-4-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1384-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1384-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/files/0x00080000000235af-12.dat upx behavioral2/memory/1384-15-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1384-22-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8f47732a54d94ad426705cd83814d99a736ec97c4b25d850d0b306a257c686fcN.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8f47732a54d94ad426705cd83814d99a736ec97c4b25d850d0b306a257c686fcN.exe"C:\Users\Admin\AppData\Local\Temp\8f47732a54d94ad426705cd83814d99a736ec97c4b25d850d0b306a257c686fcN.exe"1⤵
- System Location Discovery: System Language Discovery
PID:1384
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4008,i,10065386245627775856,6567048529106473151,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:81⤵PID:4216
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
83KB
MD56902e574190f76106656ea3e6f2f4599
SHA10cbc2335f52640d0c98d1e7b48fef745a31f8135
SHA2569e7c07e987702af49cac4fe34fedfc903ebe0511c0283074f8b82df1527e4ddd
SHA5129ebf3fbe46e04a447e70b12cad6574519f0fd4ef2f7d6883f5b7c003d332890a64f1df45d59fd61bc66b1cf6c8808d8401045c28de2d85617be769aef6b4fc6d