Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    94s
  • max time network
    95s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/11/2024, 22:40

General

  • Target

    38fca4a6387b2d872476cb68f354ee54d9d611348d50af95c1ec8e5f63977d5a.exe

  • Size

    217KB

  • MD5

    5a1af007c61a3d5684de7b79fc286a6f

  • SHA1

    f646f3c891354831b479895434d9567f897b3137

  • SHA256

    38fca4a6387b2d872476cb68f354ee54d9d611348d50af95c1ec8e5f63977d5a

  • SHA512

    176156876a5f3593a2152360b1d871c0a7430b44780e6aad3078f360bcba1434d95e5fb80a8fdec48d180e87036972234165d529f24c15adc820b2acf81930cc

  • SSDEEP

    1536:hNSXbc74YTOnlNSUL09atT0mBBA7aKSvIYFwAfdvoKQO51weQ01:hEo75OnPSI09qgmBBAGKSvwovoK9bwC1

Score
10/10

Malware Config

Extracted

Credentials

  • Protocol:
    ftp
  • Host:
    ftp.tripod.com
  • Port:
    21
  • Username:
    onthelinux
  • Password:
    741852abc

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\38fca4a6387b2d872476cb68f354ee54d9d611348d50af95c1ec8e5f63977d5a.exe
    "C:\Users\Admin\AppData\Local\Temp\38fca4a6387b2d872476cb68f354ee54d9d611348d50af95c1ec8e5f63977d5a.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2376
    • C:\Program Files (x86)\aedeb402\jusched.exe
      "C:\Program Files (x86)\aedeb402\jusched.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:4508

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\aedeb402\aedeb402

    Filesize

    17B

    MD5

    3330ebaaa7e9f4630f4ad4c156be59d8

    SHA1

    40375cf8e68671e0100e725de5cd5c6657b9f722

    SHA256

    2c8451d5dca9e68ec3af7f318c5d874fbdfea9e89e7b5f9922b4dbd65f027e15

    SHA512

    b7631f9685bac9f81aa6bf53afd839910773e108989bbb79ba39cafabbe6b6994ed2fde44911c9f7f24b45c9745d6e80cd9f01975bfb765561df4881f7dad696

  • C:\Program Files (x86)\aedeb402\jusched.exe

    Filesize

    217KB

    MD5

    8a8571baa720df1657ed7fb985698dca

    SHA1

    c7f12c29bba2a735280747809dacfeef34bb5473

    SHA256

    639f964a8629e704598bebabb343014f9f2745fc2aa18002e655473c98775e1e

    SHA512

    79bab5b1d5f4fa7e828c9f21efe321d3a763bfa0fb4496f84352a70aa92baba1d910f360a5555ce4cac43312ce59610b8a9ece91c3d59de45990ab0e9bb47dcf

  • memory/2376-0-0x0000000000400000-0x0000000000449000-memory.dmp

    Filesize

    292KB

  • memory/2376-15-0x0000000000400000-0x0000000000449000-memory.dmp

    Filesize

    292KB

  • memory/4508-13-0x0000000000400000-0x0000000000449000-memory.dmp

    Filesize

    292KB

  • memory/4508-16-0x0000000000400000-0x0000000000449000-memory.dmp

    Filesize

    292KB