Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
05/10/2024, 01:05
Static task
static1
Behavioral task
behavioral1
Sample
999fa14f19d0882319f62ccabfcb92a9de1c098f3625316081a920df49fb5a52.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
999fa14f19d0882319f62ccabfcb92a9de1c098f3625316081a920df49fb5a52.exe
Resource
win10v2004-20240802-en
General
-
Target
999fa14f19d0882319f62ccabfcb92a9de1c098f3625316081a920df49fb5a52.exe
-
Size
46KB
-
MD5
b71825b72e712c35abad5bd272fccbbb
-
SHA1
f981e3296242b0af200d098b89f9a25e102c1cce
-
SHA256
999fa14f19d0882319f62ccabfcb92a9de1c098f3625316081a920df49fb5a52
-
SHA512
e825434f76279b273fb4d3459258a47af22397f67bb8558ac8a8a95a3cea6b40ff9a3fcd6fca2a30fd068c3e484ffa9c5d5ca964fcf3d1bcf7f1998502d59f05
-
SSDEEP
768:ueKHbBtL8FFswCSpj2/sWYOh5Ti9to8Qm/O+3yVX7DvQzTGfLE:y7BtLsFrC0jVhOK9VV2/fQn
Malware Config
Extracted
Protocol: ftp- Host:
ftp.tripod.com - Port:
21 - Username:
onthelinux - Password:
741852abc
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation 999fa14f19d0882319f62ccabfcb92a9de1c098f3625316081a920df49fb5a52.exe -
Executes dropped EXE 1 IoCs
pid Process 396 jusched.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\1591eaf6\jusched.exe 999fa14f19d0882319f62ccabfcb92a9de1c098f3625316081a920df49fb5a52.exe File created C:\Program Files (x86)\1591eaf6\1591eaf6 999fa14f19d0882319f62ccabfcb92a9de1c098f3625316081a920df49fb5a52.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Tasks\Update23.job 999fa14f19d0882319f62ccabfcb92a9de1c098f3625316081a920df49fb5a52.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 999fa14f19d0882319f62ccabfcb92a9de1c098f3625316081a920df49fb5a52.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jusched.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3532 wrote to memory of 396 3532 999fa14f19d0882319f62ccabfcb92a9de1c098f3625316081a920df49fb5a52.exe 89 PID 3532 wrote to memory of 396 3532 999fa14f19d0882319f62ccabfcb92a9de1c098f3625316081a920df49fb5a52.exe 89 PID 3532 wrote to memory of 396 3532 999fa14f19d0882319f62ccabfcb92a9de1c098f3625316081a920df49fb5a52.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\999fa14f19d0882319f62ccabfcb92a9de1c098f3625316081a920df49fb5a52.exe"C:\Users\Admin\AppData\Local\Temp\999fa14f19d0882319f62ccabfcb92a9de1c098f3625316081a920df49fb5a52.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3532 -
C:\Program Files (x86)\1591eaf6\jusched.exe"C:\Program Files (x86)\1591eaf6\jusched.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:396
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=1284,i,7447299413640964517,4240724842020506306,262144 --variations-seed-version --mojo-platform-channel-handle=4408 /prefetch:81⤵PID:2436
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
17B
MD52130fee70fc3f7c10d5279f96f98ad1e
SHA14307cef89171fa230048ea22546802198d888780
SHA2563506e286f6223ccaf1665d4e457b712abeb527266ff28327ce60e37b9fbeb404
SHA51267fa1bb31028ff3ba125f184207499b9205f58c9eef2ac948f5824475515c396b3d5f93e207cb96deffe1aedb286b1f935cc689c5d84449e51c517da1cffe2e5
-
Filesize
46KB
MD50edd73ff15b39b60eb84459402f88d59
SHA173f0967c36e5d022b06b2bb1f2d4796da9a4af05
SHA256cf9da9cc513dd36056c547a33caf38e6cc1fc16c40a5a905f3680c359cd1c859
SHA51220c5568b7092013a5f4133471530209601bf113085689c8f40ee2770f157ad7b09c2c4b8f1c5066ab44a6c50d5f3673bfff7e7ac8ba692eeddec3f4fbf4a6f5a