Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
18/10/2024, 04:01
General
-
Target
e2e80b0741c2d200a8225fe4fa63baf39f32316ddf709822b3dfd4cf3e411c7d.exe
-
Size
88KB
-
MD5
3354ada9a255b76ec79474e6f3ccd42f
-
SHA1
85a9fcc5b96b71868e84541dca479347ad1efe30
-
SHA256
e2e80b0741c2d200a8225fe4fa63baf39f32316ddf709822b3dfd4cf3e411c7d
-
SHA512
0c572608d58e9496b656f3988e92c445ea70bc0c15880d4b421348b399361829ae79bacf7d38b860cea4d9f55d8d59a1d83c65b9e5182c618f2ac3b3e67e206f
-
SSDEEP
1536:ahUDofByDJWbMGcEFLPEPKOJUsy1+VMA:aIofBHbKMP0PvMA
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 4 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Suspicious use of SetThreadContext 4 IoCs
-
UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 39 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e2e80b0741c2d200a8225fe4fa63baf39f32316ddf709822b3dfd4cf3e411c7d.exe"C:\Users\Admin\AppData\Local\Temp\e2e80b0741c2d200a8225fe4fa63baf39f32316ddf709822b3dfd4cf3e411c7d.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e2e80b0741c2d200a8225fe4fa63baf39f32316ddf709822b3dfd4cf3e411c7d.exe"C:\Users\Admin\AppData\Local\Temp\e2e80b0741c2d200a8225fe4fa63baf39f32316ddf709822b3dfd4cf3e411c7d.exe"2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TUGMT.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Video Driver" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\config\explorer.exe" /f4⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\config\explorer.exe"C:\Users\Admin\AppData\Roaming\config\explorer.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\config\explorer.exe"C:\Users\Admin\AppData\Roaming\config\explorer.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Roaming\config\explorer.exe"C:\Users\Admin\AppData\Roaming\config\explorer.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\config\explorer.exe"C:\Users\Admin\AppData\Roaming\config\explorer.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
294B
MD59bc6670ed8778d28e792cc0279bb7f78
SHA18a81490af6f1f605724f25e8053eedc1ffe2ec3b
SHA2561b7e22850bfbfdf60a4b2bea5beb76845918141c3d366d08ecaa17d3392957ae
SHA5127892bd64c576540ff9fdfdbac05afa36765798f3e8403e5271b96026f72e44c053fc2561d0a838f9f43421c4b6db2dd0ac075c15a3af76bc2f867e9c365ac5e0
-
Filesize
149B
MD5fc1798b7c7938454220fda837a76f354
SHA1b232912930b2bc24ff18bf7ecd58f872bbe01ea0
SHA2567f0a5917b5aca9c5beb153aad0ef95bf0aeafb83768da5b086c3f029ba42d7c8
SHA512d1abdd45a8e5d33893b9d19424174a07feed145d2e6b4be318ab5fde503f850579a4a101a010f30e16ecde2c7123f45357a8341214655321ee0f0097ca911331
-
Filesize
88KB
MD585dc557b37a02788eb24aec8bf1abaa2
SHA1b622e2eada0111d09375e97177990c86ed50e1e2
SHA2565f577e536824561fe1e59c6fdd27731d35a35c6ab923bb6e3585c4549f487fe3
SHA51210edd56a6906fcf48c7e0de2e5881f05debe528da775cb24b2f69679848ea509f572ae2b2f2749a79e93607be863e83bab84e1095a04d95d8aaad8378bc1fc38
-
Filesize
16KB
-
Filesize
16KB
-
Filesize
16KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
88KB
-
Filesize
88KB
-
Filesize
88KB
-
Filesize
88KB
-
Filesize
12KB
-
Filesize
12KB
-
Filesize
12KB
-
Filesize
12KB
-
Filesize
12KB