Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/10/2024, 22:13

General

  • Target

    73d9ef62fbc6c13ddee9c88018cb482b60c6f5849e22e28cede11f9575b48bfc.exe

  • Size

    43KB

  • MD5

    bd0f98cedf8523a13f564ef30f38e1fa

  • SHA1

    11eead085df1a2271028552d2ea9cd79b8806243

  • SHA256

    73d9ef62fbc6c13ddee9c88018cb482b60c6f5849e22e28cede11f9575b48bfc

  • SHA512

    411d05cbc1a7d1c493cf203631bc2b64c10861a5d38b3c6545265c9f51ba2c7d3a4a6e330bae9afb4bb65b2944031112a3f3fb66b536b256021d42a210b74357

  • SSDEEP

    768:X6LsoEEeegiZPvEhHSG+gp/QtOOtEvwDpjBaac4HK/wSvuQTCyD/957sm:X6QFElP6n+gJQMOtEvwDpjBsYK/fbDFp

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\73d9ef62fbc6c13ddee9c88018cb482b60c6f5849e22e28cede11f9575b48bfc.exe
    "C:\Users\Admin\AppData\Local\Temp\73d9ef62fbc6c13ddee9c88018cb482b60c6f5849e22e28cede11f9575b48bfc.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:444
    • C:\Users\Admin\AppData\Local\Temp\asih.exe
      "C:\Users\Admin\AppData\Local\Temp\asih.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:548

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\asih.exe

    Filesize

    44KB

    MD5

    6f2368b7d74b57dbea6a735e6cd0f546

    SHA1

    9e169f99af1c73b1c38ec7e5a2af3af76c999700

    SHA256

    10a20331f92b950b78589c9120944b7f4d7b8a40979a152ee98ff68fc998e798

    SHA512

    55d7103df20c632f3d445a364063c0e29610bfec301245378c2cc11b1ec124215f7d3ff4a484129432984bdde68f78c694ce0b4ee4b4afa6b2eec5a7ca1ba470

  • memory/444-0-0x0000000000520000-0x0000000000526000-memory.dmp

    Filesize

    24KB

  • memory/444-1-0x0000000000520000-0x0000000000526000-memory.dmp

    Filesize

    24KB

  • memory/444-2-0x0000000000540000-0x0000000000546000-memory.dmp

    Filesize

    24KB

  • memory/548-17-0x0000000000630000-0x0000000000636000-memory.dmp

    Filesize

    24KB

  • memory/548-18-0x0000000000650000-0x0000000000656000-memory.dmp

    Filesize

    24KB