Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    94s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/10/2024, 04:00

General

  • Target

    153d2f441f1fe87b7d429b3634ce85610aca133fc13ec92a2fcc3153ea127e4dN.exe

  • Size

    79KB

  • MD5

    2231283ea06343b4bc0118bf75c4bd40

  • SHA1

    64eb6057dff5baf2bbf39e28e2925a07d694ce92

  • SHA256

    153d2f441f1fe87b7d429b3634ce85610aca133fc13ec92a2fcc3153ea127e4d

  • SHA512

    c03961ad3740d356204a352b20ff032d777b030cbd1462fede0863af4010c89da9f6080d2561a72aa69998484fc1577b4e8e7e660d0688d4be3bf5255dfa3f46

  • SSDEEP

    1536:86RAo0ej2d6rnJwwvlNlIUBvsI7hrhEh9cpDN/qhAvP3OChhW4dI0h4HCIzhUvTD:xAo1lOwvlNlXBvsI7hrhEh9cpDN/qhAd

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\153d2f441f1fe87b7d429b3634ce85610aca133fc13ec92a2fcc3153ea127e4dN.exe
    "C:\Users\Admin\AppData\Local\Temp\153d2f441f1fe87b7d429b3634ce85610aca133fc13ec92a2fcc3153ea127e4dN.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1624
    • C:\Windows\microsofthelp.exe
      "C:\Windows\microsofthelp.exe"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      PID:2028

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\microsofthelp.exe

    Filesize

    80KB

    MD5

    670d5834a819a8e891f348a5f9e2b6d4

    SHA1

    92a8e6c875803e865d7725b16361653023c643c4

    SHA256

    de7d38fce9f9280d0607e4aecb82a136454300a33269e7a0e8d295f7219f47a4

    SHA512

    d0a7a142f38becf76cd6c65a36daddee125210041db32395adf38e11363bc4aa0bc30329bd32795089b74ac8ed35a1706f50ff409459874969f1ceaab3b93f81

  • memory/1624-0-0x0000000000400000-0x000000000040F000-memory.dmp

    Filesize

    60KB

  • memory/1624-5-0x0000000000400000-0x000000000040F000-memory.dmp

    Filesize

    60KB

  • memory/2028-6-0x0000000000400000-0x000000000040F000-memory.dmp

    Filesize

    60KB