Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    110s
  • max time network
    94s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/10/2024, 03:06

General

  • Target

    911d2d604559e2da7e18f03c1d610fb759ba1d7d947ad844d1c0ef473fac750cN.exe

  • Size

    336KB

  • MD5

    18bce6958077daf445b4eb73e492c180

  • SHA1

    2b0f9d6e65dfa4aaa51d8106d7aad6582bb17c13

  • SHA256

    911d2d604559e2da7e18f03c1d610fb759ba1d7d947ad844d1c0ef473fac750c

  • SHA512

    2136ab61473432db9d91fb2af22943bb218d00f19d2e47e69b40fc0bc6f52dc3431f60a56db380f1629c6527ea6e65172e4a1df5d1f30ecf696157a2c8e78d41

  • SSDEEP

    6144:nyH7xOc6H5c6HcT66vlmaoqELocFeEx8rKCTH6kTWa:naxELocDIPTZT1

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • Drops file in Program Files directory 51 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\911d2d604559e2da7e18f03c1d610fb759ba1d7d947ad844d1c0ef473fac750cN.exe
    "C:\Users\Admin\AppData\Local\Temp\911d2d604559e2da7e18f03c1d610fb759ba1d7d947ad844d1c0ef473fac750cN.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3728
    • C:\Windows\svchost.exe
      "C:\Windows\svchost.exe" "C:\Users\Admin\AppData\Local\Temp\911d2d604559e2da7e18f03c1d610fb759ba1d7d947ad844d1c0ef473fac750cN.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2572
      • C:\Users\Admin\AppData\Local\Temp\911d2d604559e2da7e18f03c1d610fb759ba1d7d947ad844d1c0ef473fac750cN.exe
        "C:\Users\Admin\AppData\Local\Temp\911d2d604559e2da7e18f03c1d610fb759ba1d7d947ad844d1c0ef473fac750cN.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:4552
  • C:\Windows\svchost.exe
    C:\Windows\svchost.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Program Files directory
    PID:1456

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\911d2d604559e2da7e18f03c1d610fb759ba1d7d947ad844d1c0ef473fac750cN.exe

    Filesize

    300KB

    MD5

    da112b01ca1a498da4faa148f19dfd06

    SHA1

    621e1e0dd5af13a189d982b8eb23db142353c4d0

    SHA256

    8dce2756a77db5163c5d575c34750fc58119d5e1827108348a90f69015be8ca6

    SHA512

    9ddca81114443ee2299b6a3dc745cb37168402200ab77a178e3b5f32c263cdf22eeb879c560cd4dd1ee1ea9b90abd9632cf5ba45ae08933a48be372a33c32d29

  • C:\Windows\svchost.exe

    Filesize

    35KB

    MD5

    9e3c13b6556d5636b745d3e466d47467

    SHA1

    2ac1c19e268c49bc508f83fe3d20f495deb3e538

    SHA256

    20af03add533a6870d524a7c4753b42bfceb56cddd46016c051e23581ba743f8

    SHA512

    5a07ba8a7fcb15f64b129fada2621252b8bc37eb34d4f614c075c064f8ac0d367301eba0c32c5e28b8aa633f6ab604f0dfcc363b34734ce0207ef0d4e8817c4b

  • memory/1456-14-0x0000000000400000-0x000000000040D000-memory.dmp

    Filesize

    52KB

  • memory/1456-18-0x0000000000400000-0x000000000040D000-memory.dmp

    Filesize

    52KB

  • memory/1456-19-0x0000000000400000-0x000000000040D000-memory.dmp

    Filesize

    52KB

  • memory/2572-10-0x0000000000400000-0x000000000040D000-memory.dmp

    Filesize

    52KB

  • memory/3728-3-0x0000000000400000-0x000000000040F000-memory.dmp

    Filesize

    60KB