Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    113s
  • max time network
    117s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/10/2024, 02:03

General

  • Target

    c0bcf1aa047d8b4a7cef9349faeb0fcba14550eb20819b2931ad6338e429f92bN.exe

  • Size

    1.2MB

  • MD5

    3f3a4a55b932ff8967ce6b044d80da40

  • SHA1

    03254a9ff7347d73605c96c542a22f4b92f51554

  • SHA256

    c0bcf1aa047d8b4a7cef9349faeb0fcba14550eb20819b2931ad6338e429f92b

  • SHA512

    74c19cb79d76faa9223db66b8fd5d5b3773009066da312db8e5579e68cb21770b23db3f0f43b6ecab80fcec8f1a6e2711824acf21460d0ea03b09b2c6e9a3ddb

  • SSDEEP

    24576:4y/4UiZTW//ao6BRm4hLKmVVTcBKo/KSg+yJJod3reFA6ymcLqS:4y/a1BRm4dKwVTUnsbod3apymcLv

Score
7/10

Malware Config

Signatures

  • ASPack v2.12-2.42 2 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Loads dropped DLL 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 62 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c0bcf1aa047d8b4a7cef9349faeb0fcba14550eb20819b2931ad6338e429f92bN.exe
    "C:\Users\Admin\AppData\Local\Temp\c0bcf1aa047d8b4a7cef9349faeb0fcba14550eb20819b2931ad6338e429f92bN.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    PID:736

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\94ED5B7D.nbp

    Filesize

    294KB

    MD5

    e5575e8d61ca62bdb7491b88df590ce3

    SHA1

    c0580f4d63298f508cc7a9b14d0e7477f5a4c27b

    SHA256

    df135026069742aba1b255b9bde400749359e1a821aee3799daf15e5c58872e5

    SHA512

    c423404cae5d90e5fe8d98cdf55a92bd815940128b9a7c8e647a36db02623f621fe7422bbe2e75009f33bf3b6229d1947c70776b042195cf747b5d14460a4a0c

  • C:\Users\Admin\AppData\Local\Temp\94ED5B7E.nbp

    Filesize

    422KB

    MD5

    2fd0836d049bdffdc11d76b36732f3fb

    SHA1

    e751066f381525a4e2b892450fc00d90c60bb271

    SHA256

    26977cf094ec15191beef7268a41281a1fa0f22221c485ea8ccad9f7142d4445

    SHA512

    802b1cb9d2a129fa36968dde62539d76a265470e8a1db68d08877e83ba5c1101a7d24ec09198316cd15c37d1e54452fa643fcb4689a37c1b1183940ab642a46b

  • memory/736-21-0x0000000000400000-0x00000000005C6000-memory.dmp

    Filesize

    1.8MB

  • memory/736-14-0x0000000000400000-0x00000000005C6000-memory.dmp

    Filesize

    1.8MB

  • memory/736-17-0x0000000002590000-0x0000000002591000-memory.dmp

    Filesize

    4KB

  • memory/736-16-0x0000000004380000-0x000000000446E000-memory.dmp

    Filesize

    952KB

  • memory/736-15-0x0000000002F10000-0x0000000002FA7000-memory.dmp

    Filesize

    604KB

  • memory/736-18-0x0000000000400000-0x00000000005C6000-memory.dmp

    Filesize

    1.8MB

  • memory/736-0-0x0000000002590000-0x0000000002591000-memory.dmp

    Filesize

    4KB

  • memory/736-24-0x0000000000400000-0x00000000005C6000-memory.dmp

    Filesize

    1.8MB

  • memory/736-27-0x0000000000400000-0x00000000005C6000-memory.dmp

    Filesize

    1.8MB

  • memory/736-30-0x0000000000400000-0x00000000005C6000-memory.dmp

    Filesize

    1.8MB

  • memory/736-34-0x0000000002F10000-0x0000000002FA7000-memory.dmp

    Filesize

    604KB

  • memory/736-35-0x0000000004380000-0x000000000446E000-memory.dmp

    Filesize

    952KB

  • memory/736-33-0x0000000000400000-0x00000000005C6000-memory.dmp

    Filesize

    1.8MB

  • memory/736-36-0x0000000000400000-0x00000000005C6000-memory.dmp

    Filesize

    1.8MB

  • memory/736-39-0x0000000000400000-0x00000000005C6000-memory.dmp

    Filesize

    1.8MB

  • memory/736-42-0x0000000000400000-0x00000000005C6000-memory.dmp

    Filesize

    1.8MB

  • memory/736-45-0x0000000000400000-0x00000000005C6000-memory.dmp

    Filesize

    1.8MB