Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
29/09/2024, 10:14
Static task
static1
Behavioral task
behavioral1
Sample
e3f05e5e4a6919772ce09a6c0ea6239c12a52224005faa00cd08de72f5d0cc3bN.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
e3f05e5e4a6919772ce09a6c0ea6239c12a52224005faa00cd08de72f5d0cc3bN.exe
Resource
win10v2004-20240802-en
General
-
Target
e3f05e5e4a6919772ce09a6c0ea6239c12a52224005faa00cd08de72f5d0cc3bN.exe
-
Size
64KB
-
MD5
48fb0dc2ac5b25a90d62a20483363f00
-
SHA1
32453f8ddd3b5f1642100d5a5d4e82f6253231ad
-
SHA256
e3f05e5e4a6919772ce09a6c0ea6239c12a52224005faa00cd08de72f5d0cc3b
-
SHA512
275bd6e431b1fc78a17575e1e0edc5766314ff0bff0ddb10d4ce7dd72ba43cbb001029228b5e3585e716904c55933439c4e3224b8ba94beef4d36c0fa94a68c9
-
SSDEEP
1536:gQTIubHy5wQkJAejpzkGdxDLw3qMnd1YzHgLj:R4wPZpzNdxDL25Ey
Malware Config
Extracted
Protocol: ftp- Host:
ftp.tripod.com - Port:
21 - Username:
onthelinux - Password:
741852abc
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation e3f05e5e4a6919772ce09a6c0ea6239c12a52224005faa00cd08de72f5d0cc3bN.exe -
Executes dropped EXE 1 IoCs
pid Process 4512 jusched.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\92afb21d\jusched.exe e3f05e5e4a6919772ce09a6c0ea6239c12a52224005faa00cd08de72f5d0cc3bN.exe File created C:\Program Files (x86)\92afb21d\92afb21d e3f05e5e4a6919772ce09a6c0ea6239c12a52224005faa00cd08de72f5d0cc3bN.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e3f05e5e4a6919772ce09a6c0ea6239c12a52224005faa00cd08de72f5d0cc3bN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jusched.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4512 jusched.exe 4512 jusched.exe 4512 jusched.exe 4512 jusched.exe 4512 jusched.exe 4512 jusched.exe 4512 jusched.exe 4512 jusched.exe 4512 jusched.exe 4512 jusched.exe 4512 jusched.exe 4512 jusched.exe 4512 jusched.exe 4512 jusched.exe 4512 jusched.exe 4512 jusched.exe 4512 jusched.exe 4512 jusched.exe 4512 jusched.exe 4512 jusched.exe 4512 jusched.exe 4512 jusched.exe 4512 jusched.exe 4512 jusched.exe 4512 jusched.exe 4512 jusched.exe 4512 jusched.exe 4512 jusched.exe 4512 jusched.exe 4512 jusched.exe 4512 jusched.exe 4512 jusched.exe 4512 jusched.exe 4512 jusched.exe 4512 jusched.exe 4512 jusched.exe 4512 jusched.exe 4512 jusched.exe 4512 jusched.exe 4512 jusched.exe 4512 jusched.exe 4512 jusched.exe 4512 jusched.exe 4512 jusched.exe 4512 jusched.exe 4512 jusched.exe 4512 jusched.exe 4512 jusched.exe 4512 jusched.exe 4512 jusched.exe 4512 jusched.exe 4512 jusched.exe 4512 jusched.exe 4512 jusched.exe 4512 jusched.exe 4512 jusched.exe 4512 jusched.exe 4512 jusched.exe 4512 jusched.exe 4512 jusched.exe 4512 jusched.exe 4512 jusched.exe 4512 jusched.exe 4512 jusched.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3660 wrote to memory of 4512 3660 e3f05e5e4a6919772ce09a6c0ea6239c12a52224005faa00cd08de72f5d0cc3bN.exe 82 PID 3660 wrote to memory of 4512 3660 e3f05e5e4a6919772ce09a6c0ea6239c12a52224005faa00cd08de72f5d0cc3bN.exe 82 PID 3660 wrote to memory of 4512 3660 e3f05e5e4a6919772ce09a6c0ea6239c12a52224005faa00cd08de72f5d0cc3bN.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\e3f05e5e4a6919772ce09a6c0ea6239c12a52224005faa00cd08de72f5d0cc3bN.exe"C:\Users\Admin\AppData\Local\Temp\e3f05e5e4a6919772ce09a6c0ea6239c12a52224005faa00cd08de72f5d0cc3bN.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3660 -
C:\Program Files (x86)\92afb21d\jusched.exe"C:\Program Files (x86)\92afb21d\jusched.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4512
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
13B
MD5f253efe302d32ab264a76e0ce65be769
SHA1768685ca582abd0af2fbb57ca37752aa98c9372b
SHA25649dca65f362fee401292ed7ada96f96295eab1e589c52e4e66bf4aedda715fdd
SHA5121990d20b462406bbadb22ba43f1ed9d0db6b250881d4ac89ad8cf6e43ca92b2fd31c3a15be1e6e149e42fdb46e58122c15bc7869a82c9490656c80df69fa77c4
-
Filesize
64KB
MD5f4c4e071721ef32c30aafe46b8798554
SHA1326039811028f98d8893ba5fb5f2ce8d08dd7fbe
SHA256101f31056174c2feb00675d02bd4d88ecbd8182d07af74a5a2c9b21cc1817df8
SHA512ea89464e426ab659b2f684c4a000659562228f0c12cd32001e1568ec7570a02fc2a0b73b83c128ace01cca16522d5a87539101a19ba11c21579cf39d10c2fe8f