Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    111s
  • max time network
    116s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/10/2024, 09:56

General

  • Target

    68479ac6edefe00caf0b1c82370ae3622c92a2e78fc1b6c8f78a806717be16beN.exe

  • Size

    36KB

  • MD5

    1442ad89c8e4112b1acf90b177f9d5d0

  • SHA1

    534d4ed1e550012c325e3d2ea518f5b8241892b2

  • SHA256

    68479ac6edefe00caf0b1c82370ae3622c92a2e78fc1b6c8f78a806717be16be

  • SHA512

    af6e0263c5fbab7f29e2cea7dcf03fcbe017e1c639cc1660cb8d99b062f2fcbee6fe8d56233cb355dadb7ae3e7baecca735caa185c004ece736257b56d96cc95

  • SSDEEP

    768:b7o/2n1TCraU6GD1a4Xt9bRU6zA6oTy4JG:bc/y2lLRU6zA6clG

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\68479ac6edefe00caf0b1c82370ae3622c92a2e78fc1b6c8f78a806717be16beN.exe
    "C:\Users\Admin\AppData\Local\Temp\68479ac6edefe00caf0b1c82370ae3622c92a2e78fc1b6c8f78a806717be16beN.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4588
    • C:\Users\Admin\AppData\Local\Temp\rewok.exe
      "C:\Users\Admin\AppData\Local\Temp\rewok.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1600

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\rewok.exe

    Filesize

    36KB

    MD5

    f86d3aaf85da0911678b29a895a23934

    SHA1

    34da85a21b58e52f7ee5c152ca6144b74217d718

    SHA256

    ee4b96c0d018ae3f1678e40351403d695c6ad4c4c6a38bdfb4728b809a3bb960

    SHA512

    12d2626f20bf9498f13df9f47d107a034cf5936b5cc9677cce7be6fe281ddffbf6e04714f94a79c7615941f16e4729fa03a19cb66e20dc2b6423d918ac96b640

  • memory/1600-25-0x0000000000600000-0x0000000000606000-memory.dmp

    Filesize

    24KB

  • memory/4588-0-0x0000000002EA0000-0x0000000002EA6000-memory.dmp

    Filesize

    24KB

  • memory/4588-1-0x0000000002EA0000-0x0000000002EA6000-memory.dmp

    Filesize

    24KB

  • memory/4588-2-0x0000000000400000-0x0000000000406000-memory.dmp

    Filesize

    24KB