Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
93s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
06/12/2024, 02:09
Static task
static1
Behavioral task
behavioral1
Sample
1f4ffae1d208aa2da2fc5364702a0999f92db988820b695c723fd34fb514df7dN.exe
Resource
win7-20240903-en
General
-
Target
1f4ffae1d208aa2da2fc5364702a0999f92db988820b695c723fd34fb514df7dN.exe
-
Size
52KB
-
MD5
eb71479977873ddd18b7b92c961f5c90
-
SHA1
3beb9a164c32065d3c41572cfc7b0e0b7c8dccdc
-
SHA256
1f4ffae1d208aa2da2fc5364702a0999f92db988820b695c723fd34fb514df7d
-
SHA512
64fd33316114e8d3d1f74b7573b860f752659ae107b01ded4e2722927cd855824b64ba09f5ea284d4007ebc32f2c3afcf4aa7656a77d197b73f8df03989fc84d
-
SSDEEP
1536:vMcQYte55zs091Zw9FAGDdJYipvwGf9ogjrg1:vMhAe5Zs091KI+JYixw49XjrE
Malware Config
Extracted
urelas
218.54.47.76
218.54.47.77
218.54.47.74
Signatures
-
Urelas family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation 1f4ffae1d208aa2da2fc5364702a0999f92db988820b695c723fd34fb514df7dN.exe -
Executes dropped EXE 1 IoCs
pid Process 1312 biudfw.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1f4ffae1d208aa2da2fc5364702a0999f92db988820b695c723fd34fb514df7dN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language biudfw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4764 wrote to memory of 1312 4764 1f4ffae1d208aa2da2fc5364702a0999f92db988820b695c723fd34fb514df7dN.exe 84 PID 4764 wrote to memory of 1312 4764 1f4ffae1d208aa2da2fc5364702a0999f92db988820b695c723fd34fb514df7dN.exe 84 PID 4764 wrote to memory of 1312 4764 1f4ffae1d208aa2da2fc5364702a0999f92db988820b695c723fd34fb514df7dN.exe 84 PID 4764 wrote to memory of 212 4764 1f4ffae1d208aa2da2fc5364702a0999f92db988820b695c723fd34fb514df7dN.exe 85 PID 4764 wrote to memory of 212 4764 1f4ffae1d208aa2da2fc5364702a0999f92db988820b695c723fd34fb514df7dN.exe 85 PID 4764 wrote to memory of 212 4764 1f4ffae1d208aa2da2fc5364702a0999f92db988820b695c723fd34fb514df7dN.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\1f4ffae1d208aa2da2fc5364702a0999f92db988820b695c723fd34fb514df7dN.exe"C:\Users\Admin\AppData\Local\Temp\1f4ffae1d208aa2da2fc5364702a0999f92db988820b695c723fd34fb514df7dN.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\biudfw.exe"C:\Users\Admin\AppData\Local\Temp\biudfw.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1312
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "2⤵
- System Location Discovery: System Language Discovery
PID:212
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
52KB
MD55da77a40e3e0897d7a6f018e9f5caa1d
SHA1521266b36dde74467dce2156b86e265fd124afef
SHA2567a8cba4b3394d35fd5fc53cafae1342e876c8fb45830b71482cb11fe21227fac
SHA512173f2f6fffa3ee24b40c23ab6d4488d79cfeaabd418a3175a9eb20604976eddc1f444e324310ca21b2f18ca998c14de98f94e03b5bb9dc4d4b9ee64b31d2887c
-
Filesize
512B
MD5b4a86880004da8726288d7ec954885a8
SHA11bab1cfbdc2c540246210bc7852f8fe7e8357b31
SHA256c85016a9115aeb492bf116ab05791a9c3e6e30c39274767bd0476bd56a37db46
SHA51222758f6c6de591c99f8f9857c1b03e55c242f0a4987d376b08c30bc608027d1574a228a8230099ddac2a3214663396b016e85d085204155a5ec26f87a28496b4
-
Filesize
340B
MD53a261c304ad728005c2a56c0e6ea04a0
SHA16a4bf525414afe8d6557429cd023f9ab47ac32ce
SHA2569afcbec815edd595982554aa66d10d106546335bf9b5553db39415bd6f8485b9
SHA512a71aad635e5b2579373781be5f9396836495c17620173dd230a742b3211ad8ded422f4066f9f7385a15c19854f66b5bcc8c2cc6dc55835092760e8e808abc5ec