Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
101s -
max time network
102s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19/10/2024, 02:38
Static task
static1
Behavioral task
behavioral1
Sample
784818a96bcc2823b6460484e4d3e352c54369edf9d8c4b066a04f6b580173c0N.exe
Resource
win7-20240903-en
General
-
Target
784818a96bcc2823b6460484e4d3e352c54369edf9d8c4b066a04f6b580173c0N.exe
-
Size
61KB
-
MD5
00db57ed96fd2098d9a862cdeb6a6d10
-
SHA1
7a6cac4a0c84b8b1bc2db6d978b8ecb2f9d10873
-
SHA256
784818a96bcc2823b6460484e4d3e352c54369edf9d8c4b066a04f6b580173c0
-
SHA512
34d6ac1f5f31c6d27c6a7d2f9731e8c903e87f78681488bb84ad0653b079370e553bddf99ba8abd95919495d753e9c4fb237bdb3aa732ab752d7fa2db753ec36
-
SSDEEP
768:n5mhew0GpSyMe6hwUkdwJzh+qciaQRENEzxZbARtR06g2wqp4YPeznellmqGwxPA:nK0GjMeQG3iaQREuVZ6ro29p4YxbKdT
Malware Config
Extracted
urelas
218.54.47.76
218.54.47.77
218.54.47.74
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation 784818a96bcc2823b6460484e4d3e352c54369edf9d8c4b066a04f6b580173c0N.exe -
Executes dropped EXE 1 IoCs
pid Process 732 biudfw.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 784818a96bcc2823b6460484e4d3e352c54369edf9d8c4b066a04f6b580173c0N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language biudfw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4664 wrote to memory of 732 4664 784818a96bcc2823b6460484e4d3e352c54369edf9d8c4b066a04f6b580173c0N.exe 87 PID 4664 wrote to memory of 732 4664 784818a96bcc2823b6460484e4d3e352c54369edf9d8c4b066a04f6b580173c0N.exe 87 PID 4664 wrote to memory of 732 4664 784818a96bcc2823b6460484e4d3e352c54369edf9d8c4b066a04f6b580173c0N.exe 87 PID 4664 wrote to memory of 4444 4664 784818a96bcc2823b6460484e4d3e352c54369edf9d8c4b066a04f6b580173c0N.exe 88 PID 4664 wrote to memory of 4444 4664 784818a96bcc2823b6460484e4d3e352c54369edf9d8c4b066a04f6b580173c0N.exe 88 PID 4664 wrote to memory of 4444 4664 784818a96bcc2823b6460484e4d3e352c54369edf9d8c4b066a04f6b580173c0N.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\784818a96bcc2823b6460484e4d3e352c54369edf9d8c4b066a04f6b580173c0N.exe"C:\Users\Admin\AppData\Local\Temp\784818a96bcc2823b6460484e4d3e352c54369edf9d8c4b066a04f6b580173c0N.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\biudfw.exe"C:\Users\Admin\AppData\Local\Temp\biudfw.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:732
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "2⤵
- System Location Discovery: System Language Discovery
PID:4444
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
61KB
MD58203d978b55b4678cb7e314de3309e74
SHA189c02310c957af30dea92a201e228cf4bf10d203
SHA2562497680781781b2e15bbe95e0c703107cceff48e329efab22ab22b7d0ad66556
SHA512d7a30080e6b1639054cd48021f42ac33a6786b2cdc4423cb035d869073605ccdf03e2ec24f74411b850552e93915c1dd612f1a6e8e307d6c0ed21fcfd1dca19f
-
Filesize
512B
MD555e10a9af74d3f3fa5ae3cb7ff5ad9d4
SHA1449221fd8d7196a54de2bd583625d8d1b64db56a
SHA256a945a44cfe50423c01f26a16445ed177a347052e791364a9cb7de6bcaa18f3c1
SHA5124af5ba74467b4c61302ea9571f19346c05f911843f2c6153fcd9a7340f9bc6e1f8867cdb72ec7ba0dc4930199aa5c302711ad5da9fd35241839418f6e70a515a
-
Filesize
340B
MD545a59f0569903e12dc89a26469adf588
SHA1e1c609dfe1cbdac61eb2956549acdf4d2125b09d
SHA2562bb681dab9b2a8ba2f2bb683fe62bf7e6e0c6ae0ffa5d8fef540a793d02fecfe
SHA512c0141710a2446c855ae1846b29d08f8d24c9cfb310c2c9f6dd4e8d070834b9db4f1aa3fc2f0e45c020e3308172fe12b7b8f85264cfde309a01a2a18c976b6799