Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
06/12/2024, 17:42
Behavioral task
behavioral1
Sample
17334752451c3a43189360a7e5b86f13b5ea7a6044304256a8f4c49ad5d5bd4831e72ee12e792.dat-decoded.exe
Resource
win7-20240708-en
General
-
Target
17334752451c3a43189360a7e5b86f13b5ea7a6044304256a8f4c49ad5d5bd4831e72ee12e792.dat-decoded.exe
-
Size
469KB
-
MD5
7f2ebe83b860a8de1f3ce798c79b5935
-
SHA1
3fbea97a5aa637271311851fd152ee37e813c44f
-
SHA256
fd125d03b2bc8512a9a5dcc6df9ca5045208442bc047af50b5f0a359103c1ba8
-
SHA512
38645cfa1e5826f06c21c09ba3a3fd11447abea0e66bd281722e9987ea501848086a87e327f689e1282b8532589c75fab182a6777f286030dd5231627038555c
-
SSDEEP
12288:umnk7iLJbpIpiRL6I2WhSKQ9ZsfZQSln9:WiLJbpI7I2WhQqZ7l9
Malware Config
Signatures
-
Remcos family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 17334752451c3a43189360a7e5b86f13b5ea7a6044304256a8f4c49ad5d5bd4831e72ee12e792.dat-decoded.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3820 17334752451c3a43189360a7e5b86f13b5ea7a6044304256a8f4c49ad5d5bd4831e72ee12e792.dat-decoded.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\17334752451c3a43189360a7e5b86f13b5ea7a6044304256a8f4c49ad5d5bd4831e72ee12e792.dat-decoded.exe"C:\Users\Admin\AppData\Local\Temp\17334752451c3a43189360a7e5b86f13b5ea7a6044304256a8f4c49ad5d5bd4831e72ee12e792.dat-decoded.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3820
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
144B
MD545b5bd597632220dab6c05e6326d7702
SHA1897771db4aec71c161b4bba4d60437a56051f9d4
SHA256b3409e294ec1a6c63b0bac9be10b5b8a75e89528ad4516fb06772b4bef8b8086
SHA512f9c1951d24e6ecb16b0f68ab5932f52e6c8ca27e73aa783fd3c6332654099e76618135f4166850ee92eaebbcd02751ff0de1ba0d9c2dba329fe2a97270ad4c89