Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
93s -
max time network
115s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09/10/2024, 20:14
Static task
static1
Behavioral task
behavioral1
Sample
e8b2c3eacfb05fce45a86afaba952cead9cc0bd933dd2cacd96ee8a444842d3a.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
e8b2c3eacfb05fce45a86afaba952cead9cc0bd933dd2cacd96ee8a444842d3a.exe
Resource
win10v2004-20241007-en
General
-
Target
e8b2c3eacfb05fce45a86afaba952cead9cc0bd933dd2cacd96ee8a444842d3a.exe
-
Size
10.3MB
-
MD5
2c6e28a55e0519914599ebf0f3bfa096
-
SHA1
618df8384bf14cb25af29c1f194fce1fc20cc304
-
SHA256
e8b2c3eacfb05fce45a86afaba952cead9cc0bd933dd2cacd96ee8a444842d3a
-
SHA512
d31f00c5feaf6accbb3a5579090b7ad9f79f057e6e9a409cac5df1d83b7be69b84b939230b337d717389193b74ed31de05ec5a8e80dc7f5407f8e11f5f1e76ca
-
SSDEEP
196608:dXHSVf+6b9oDdh0qTRxa8z1sULDSe9a+5crvT9YqS4lU4I4:dXHuf+6poDjBTRxa8psYSUa+arvSP0z
Malware Config
Signatures
-
Downloads MZ/PE file
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e8b2c3eacfb05fce45a86afaba952cead9cc0bd933dd2cacd96ee8a444842d3a.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1716 e8b2c3eacfb05fce45a86afaba952cead9cc0bd933dd2cacd96ee8a444842d3a.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e8b2c3eacfb05fce45a86afaba952cead9cc0bd933dd2cacd96ee8a444842d3a.exe"C:\Users\Admin\AppData\Local\Temp\e8b2c3eacfb05fce45a86afaba952cead9cc0bd933dd2cacd96ee8a444842d3a.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1716
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6KB
MD5b1e11d348ed71a6d880f4380099489a9
SHA19f5a1520ba842a6617741afaa53abdddb4687d96
SHA2565bf6309a84ea3eef8e6a5fb8bfebd382858c232bf0d175195c8e3dd010dc55f3
SHA512a990b3800c0f482f6e3b6442cc670cdf9f68dba91f2f193e25ee72c0eac8907d5c864d1bf22c7f8e0b20207c1bdaadca2335029da0ce939a2e8b1cdfdacd930e
-
Filesize
6KB
MD549468bf44e98cf16afe25e7b771bb5c6
SHA1c6f7f58adac614542b29028061805da023f82fc7
SHA256a48294bb2266f2efe520e5201227935cc5fca567dfb2cd551930002c9b6bddfa
SHA512f836c73db5e8a080a268ce85e707bed318b75f04d29c168d8b6709a0093198ffae8fadf4bcc6968bd4b26780594b76b355abafbb5946695234a080e1ccfb302e
-
Filesize
38B
MD56508d209a4df9e49f892899390255d05
SHA149f985a4f25bf70b260707de2a4b22b21d769816
SHA256ab6edb1e3eeb82bebf88f1f87d4a2af7b91679331b239cddfd3d3692b0bb0f85
SHA512d65d1f9ed1ba10c1b914d7d7af4273ddccb7d5c3ef1b7fea5cc1368d5eccd744b8d312fd388b7c065cf2d34efdb8e15c97c2fb52460d632cbede251e7ac56dc4