Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    93s
  • max time network
    100s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/10/2024, 10:02

General

  • Target

    EnableLoopback.exe

  • Size

    82KB

  • MD5

    ea240c9d733ad54a79faaca19ba8d376

  • SHA1

    2c1d1b3aa6aec6e6e7af7f64637029971a37ba77

  • SHA256

    2c2aa55ab99b5a34eb78ded93e46c4d5fef44077847281e124473c20de5cf165

  • SHA512

    d3815bf7b5af7aa5dbf717f404bdac9538adeaff57cf6ec38c3724d7179fb1f31231009941a671bdd15516e47ff346afa8738bc399c4e57cb840def6821f6464

  • SSDEEP

    768:JyEI16zcI2eTcvE+m/ljPb0O7/Al25znrSh7A+g4CqnZ86qmmlk8x3Oqxf1mlZxd:K1H50wOLFzrSh7QwZhxmlk8xDfInfZ

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\EnableLoopback.exe
    "C:\Users\Admin\AppData\Local\Temp\EnableLoopback.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    PID:744

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/744-0-0x0000000074AAE000-0x0000000074AAF000-memory.dmp

    Filesize

    4KB

  • memory/744-1-0x0000000000360000-0x0000000000378000-memory.dmp

    Filesize

    96KB

  • memory/744-2-0x00000000053D0000-0x0000000005974000-memory.dmp

    Filesize

    5.6MB

  • memory/744-3-0x0000000004D40000-0x0000000004DD2000-memory.dmp

    Filesize

    584KB

  • memory/744-4-0x00000000052F0000-0x00000000052FA000-memory.dmp

    Filesize

    40KB

  • memory/744-5-0x0000000074AA0000-0x0000000075250000-memory.dmp

    Filesize

    7.7MB

  • memory/744-6-0x0000000074AA0000-0x0000000075250000-memory.dmp

    Filesize

    7.7MB

  • memory/744-7-0x0000000074AAE000-0x0000000074AAF000-memory.dmp

    Filesize

    4KB

  • memory/744-8-0x0000000074AA0000-0x0000000075250000-memory.dmp

    Filesize

    7.7MB