Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    92s
  • max time network
    94s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/09/2024, 21:24

General

  • Target

    19aedf18d48b973d9859dfb5547568a71d71255a5404bafc1d328b269f30ec25N.exe

  • Size

    40KB

  • MD5

    bc8fa93d6e599119ebfdce3fc70edd00

  • SHA1

    b24f296f5eb991c2db8ff2113d8371ff8a8ec569

  • SHA256

    19aedf18d48b973d9859dfb5547568a71d71255a5404bafc1d328b269f30ec25

  • SHA512

    6e78ab50278fdefe9c0fc3f5d1e8a2a67602f83ddf4d4ad7e02fead71ba4f9b9104394475b7d435b431621e6370844997142c3adbcc370b6dd4b7b84eeb319c4

  • SSDEEP

    384:MApc8m4e0LvQac4JI341CNabnkIU0Sq0yDAYe:MApQr0LvddJI34nTkIU0EyTe

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\19aedf18d48b973d9859dfb5547568a71d71255a5404bafc1d328b269f30ec25N.exe
    "C:\Users\Admin\AppData\Local\Temp\19aedf18d48b973d9859dfb5547568a71d71255a5404bafc1d328b269f30ec25N.exe"
    1⤵
    • Checks computer location settings
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3308
    • C:\windows\SysWOW64\sal.exe
      "C:\windows\system32\sal.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:3192

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\sal.exe

    Filesize

    40KB

    MD5

    f862c5f436e7a06413361fe39a5d1265

    SHA1

    b7f7f57b7391bb59be4dee385c0bed8eff7ee416

    SHA256

    bf005a5100aadc0d150fa11ff91d5574c11a3fabfc3aef58bdbb823f8a03cba8

    SHA512

    03197311f835b49d1e1980c2f5198e01e3fc7821c807beb9f70732999eff457342145d7c5ac92ff56a1d72e0c78df40d66cdd9243b9804f0c716244aed760c2b

  • memory/3192-10-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

  • memory/3308-0-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

  • memory/3308-9-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB