Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    96s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/09/2024, 06:12

General

  • Target

    e02b99313c8bdf525b920628455535f14f0b6a82b00465d078c7861924f4ee73N.exe

  • Size

    49KB

  • MD5

    97771931504fe5074df1df3133e72910

  • SHA1

    080da69b1efdf0562a634c66d934d0732f9301e8

  • SHA256

    e02b99313c8bdf525b920628455535f14f0b6a82b00465d078c7861924f4ee73

  • SHA512

    310e45c8649f19f19d15a793f430aa957c2cdffbb15745d88e604861f053e4fe4889c66c21b50e10482a5180177a6256e7042fa9cb15297a7d57fbdfe9e8a00f

  • SSDEEP

    1536:DqMA6C1VqaqhtgVRNToV7TtRu8rM0wYVFl2g5u58dO0xXHQEyYfdhNhFO5h3xhIR:+MA6C1VqaqhtgVRNToV7TtRu8rM0wYVr

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e02b99313c8bdf525b920628455535f14f0b6a82b00465d078c7861924f4ee73N.exe
    "C:\Users\Admin\AppData\Local\Temp\e02b99313c8bdf525b920628455535f14f0b6a82b00465d078c7861924f4ee73N.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2888
    • C:\Windows\microsofthelp.exe
      "C:\Windows\microsofthelp.exe"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:868

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\microsofthelp.exe

    Filesize

    49KB

    MD5

    8ddbeb86f5927a9c477d15abcb3fcd3e

    SHA1

    7bc3fb5b732de6645f5af3ca917f0d7e5ba79a57

    SHA256

    bdb33936bc8c84c14021efb77cd0c68696992c21273a11381e2ee7ceb5c87b18

    SHA512

    461c493b439cf3120a4632ac68332f6036c1879e99bc01587ca1f8071a3a96eef9e69a4971dc1720f6f3b0c7656e2441dd56e65be61b3f3f1a52c433a2d8cfe9

  • memory/868-6-0x0000000000400000-0x0000000000403000-memory.dmp

    Filesize

    12KB

  • memory/868-7-0x0000000000400000-0x0000000000403000-memory.dmp

    Filesize

    12KB

  • memory/2888-0-0x0000000000400000-0x0000000000403000-memory.dmp

    Filesize

    12KB

  • memory/2888-5-0x0000000000400000-0x0000000000403000-memory.dmp

    Filesize

    12KB