Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
100s -
max time network
103s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20/10/2024, 01:47
Static task
static1
Behavioral task
behavioral1
Sample
df3c55c2a7b88a0806ee417d666b169e623202ab41beb28f02775e7faad1d7cdN.exe
Resource
win7-20240903-en
General
-
Target
df3c55c2a7b88a0806ee417d666b169e623202ab41beb28f02775e7faad1d7cdN.exe
-
Size
79KB
-
MD5
b39589f9343b509a07a49f759cb71630
-
SHA1
918aecfca8251c09ed87ff918fe0b6e117be79f2
-
SHA256
df3c55c2a7b88a0806ee417d666b169e623202ab41beb28f02775e7faad1d7cd
-
SHA512
f3e0548dba15a50394bfad22347df3909eb0ede869c732a722b6b8c64355b300baf482711f268c95b3ea2ccd0d8f4e2581356a8aa14ef162058e5d43beb75ba3
-
SSDEEP
1536:ml531xxqA3zM9ttjtt574bbp8Fm43AOEI0QdeFUU8te5:4lnhYPlVMqmyAFIRRy
Malware Config
Extracted
urelas
112.175.88.208
112.175.88.207
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation df3c55c2a7b88a0806ee417d666b169e623202ab41beb28f02775e7faad1d7cdN.exe -
Executes dropped EXE 1 IoCs
pid Process 1972 huter.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language df3c55c2a7b88a0806ee417d666b169e623202ab41beb28f02775e7faad1d7cdN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language huter.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4344 wrote to memory of 1972 4344 df3c55c2a7b88a0806ee417d666b169e623202ab41beb28f02775e7faad1d7cdN.exe 89 PID 4344 wrote to memory of 1972 4344 df3c55c2a7b88a0806ee417d666b169e623202ab41beb28f02775e7faad1d7cdN.exe 89 PID 4344 wrote to memory of 1972 4344 df3c55c2a7b88a0806ee417d666b169e623202ab41beb28f02775e7faad1d7cdN.exe 89 PID 4344 wrote to memory of 2792 4344 df3c55c2a7b88a0806ee417d666b169e623202ab41beb28f02775e7faad1d7cdN.exe 90 PID 4344 wrote to memory of 2792 4344 df3c55c2a7b88a0806ee417d666b169e623202ab41beb28f02775e7faad1d7cdN.exe 90 PID 4344 wrote to memory of 2792 4344 df3c55c2a7b88a0806ee417d666b169e623202ab41beb28f02775e7faad1d7cdN.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\df3c55c2a7b88a0806ee417d666b169e623202ab41beb28f02775e7faad1d7cdN.exe"C:\Users\Admin\AppData\Local\Temp\df3c55c2a7b88a0806ee417d666b169e623202ab41beb28f02775e7faad1d7cdN.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\Users\Admin\AppData\Local\Temp\huter.exe"C:\Users\Admin\AppData\Local\Temp\huter.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1972
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "2⤵
- System Location Discovery: System Language Discovery
PID:2792
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
512B
MD5dd1155cbc9956e5dbeee97b18e3c4c5a
SHA1e5f61bc0d1bc9ad93206ea16ddefca0900ea780c
SHA25653be558f961cb503bea4e622d7833128bb01c698cc3cc6d3ec9b1cf1bafe72b7
SHA5121e384513a0d2bb4d797d714f93afdf69efb2be05217fd6b5f421fc3f776ec89431b20d5a82e731d7d78c7d4f8fae3ab49880b524844b3c5e16281fa83d00a1ce
-
Filesize
79KB
MD5aefd2d81217ad053a1896d5a8f4af79d
SHA18e41a5e334a0ce07d5468cdafc7ff8061cbd9147
SHA25662062c1a5b7195b3b0a570d60914df6306d2912333fc8fc20de74cf08b3c9fd8
SHA512a6ecfb986e5aae58c4a94c7cfd59d37c2e58539a21b3b17ba8c233a868340f0214e6fab21f8b3e4d5cf577b294cbaa58a68f6335218dee4846b991d817167d29
-
Filesize
340B
MD5d6b71bd88f9654567f0c65423b7d9a73
SHA19fff28cb119fba7d1b4402c354ec63083aff1270
SHA256cb16e3fe444d1fbe4891907cdd33a5b46389478d101f9772f84ed6c35407dd95
SHA5124082ba1d2eabecbccc618f08993bdd491fab02a7f58a268bd559002aa8114e8d303274f5cde2c3a8701244dbe8f59c4fff778b9df7fec21475c4ddd6726d87e1