Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
06/12/2024, 02:09
Static task
static1
Behavioral task
behavioral1
Sample
1f4ffae1d208aa2da2fc5364702a0999f92db988820b695c723fd34fb514df7dN.exe
Resource
win7-20240903-en
General
-
Target
1f4ffae1d208aa2da2fc5364702a0999f92db988820b695c723fd34fb514df7dN.exe
-
Size
52KB
-
MD5
eb71479977873ddd18b7b92c961f5c90
-
SHA1
3beb9a164c32065d3c41572cfc7b0e0b7c8dccdc
-
SHA256
1f4ffae1d208aa2da2fc5364702a0999f92db988820b695c723fd34fb514df7d
-
SHA512
64fd33316114e8d3d1f74b7573b860f752659ae107b01ded4e2722927cd855824b64ba09f5ea284d4007ebc32f2c3afcf4aa7656a77d197b73f8df03989fc84d
-
SSDEEP
1536:vMcQYte55zs091Zw9FAGDdJYipvwGf9ogjrg1:vMhAe5Zs091KI+JYixw49XjrE
Malware Config
Extracted
urelas
218.54.47.76
218.54.47.77
218.54.47.74
Signatures
-
Urelas family
-
Deletes itself 1 IoCs
pid Process 2928 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 2788 biudfw.exe -
Loads dropped DLL 1 IoCs
pid Process 1388 1f4ffae1d208aa2da2fc5364702a0999f92db988820b695c723fd34fb514df7dN.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1f4ffae1d208aa2da2fc5364702a0999f92db988820b695c723fd34fb514df7dN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language biudfw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1388 wrote to memory of 2788 1388 1f4ffae1d208aa2da2fc5364702a0999f92db988820b695c723fd34fb514df7dN.exe 31 PID 1388 wrote to memory of 2788 1388 1f4ffae1d208aa2da2fc5364702a0999f92db988820b695c723fd34fb514df7dN.exe 31 PID 1388 wrote to memory of 2788 1388 1f4ffae1d208aa2da2fc5364702a0999f92db988820b695c723fd34fb514df7dN.exe 31 PID 1388 wrote to memory of 2788 1388 1f4ffae1d208aa2da2fc5364702a0999f92db988820b695c723fd34fb514df7dN.exe 31 PID 1388 wrote to memory of 2928 1388 1f4ffae1d208aa2da2fc5364702a0999f92db988820b695c723fd34fb514df7dN.exe 32 PID 1388 wrote to memory of 2928 1388 1f4ffae1d208aa2da2fc5364702a0999f92db988820b695c723fd34fb514df7dN.exe 32 PID 1388 wrote to memory of 2928 1388 1f4ffae1d208aa2da2fc5364702a0999f92db988820b695c723fd34fb514df7dN.exe 32 PID 1388 wrote to memory of 2928 1388 1f4ffae1d208aa2da2fc5364702a0999f92db988820b695c723fd34fb514df7dN.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\1f4ffae1d208aa2da2fc5364702a0999f92db988820b695c723fd34fb514df7dN.exe"C:\Users\Admin\AppData\Local\Temp\1f4ffae1d208aa2da2fc5364702a0999f92db988820b695c723fd34fb514df7dN.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1388 -
C:\Users\Admin\AppData\Local\Temp\biudfw.exe"C:\Users\Admin\AppData\Local\Temp\biudfw.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2788
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:2928
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
512B
MD5b4a86880004da8726288d7ec954885a8
SHA11bab1cfbdc2c540246210bc7852f8fe7e8357b31
SHA256c85016a9115aeb492bf116ab05791a9c3e6e30c39274767bd0476bd56a37db46
SHA51222758f6c6de591c99f8f9857c1b03e55c242f0a4987d376b08c30bc608027d1574a228a8230099ddac2a3214663396b016e85d085204155a5ec26f87a28496b4
-
Filesize
340B
MD53a261c304ad728005c2a56c0e6ea04a0
SHA16a4bf525414afe8d6557429cd023f9ab47ac32ce
SHA2569afcbec815edd595982554aa66d10d106546335bf9b5553db39415bd6f8485b9
SHA512a71aad635e5b2579373781be5f9396836495c17620173dd230a742b3211ad8ded422f4066f9f7385a15c19854f66b5bcc8c2cc6dc55835092760e8e808abc5ec
-
Filesize
52KB
MD52c5810f8d70faf1a7a82d9e1b3accb2f
SHA16d52b5fb324623d66bcee1b14b2efd7900bbb51a
SHA2561aa02f23be30aee41ac9763bfe421ec443295566a8991519fe2b58dc4fdd1912
SHA512e839465ffe0e12b339e8a710bf31ae65cd62fa1570d7291a32f270531c29bd753f4c99f34604b412e4043be9f53b7bcc903954fa63a851373c49b80355bcc3a0