Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
96s -
max time network
132s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
16/12/2024, 21:03
Static task
static1
Behavioral task
behavioral1
Sample
2c956dbbe6148be036c83f263c1dca1ccdfa889a493b924a53186eb0d72ed195.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2c956dbbe6148be036c83f263c1dca1ccdfa889a493b924a53186eb0d72ed195.exe
Resource
win10v2004-20241007-en
General
-
Target
2c956dbbe6148be036c83f263c1dca1ccdfa889a493b924a53186eb0d72ed195.exe
-
Size
133KB
-
MD5
d6fbe07dc4479b81cf3fcca659ecf7b5
-
SHA1
e4265d86d805795984b9bb8af92d19ec55dfbc21
-
SHA256
2c956dbbe6148be036c83f263c1dca1ccdfa889a493b924a53186eb0d72ed195
-
SHA512
719cf92bede2b306d6f8c4d31512428f68cf9178840a80322890f4761fae4c5d32a6453d9cf8274515e4c8622de5a906d8f7158e701df1e9ea8a1b4a44b02f43
-
SSDEEP
1536:ITHiPBX4nDzMyRXGHrc9YRHqbTypgpmb5Q+ZReSdhk/J+YLgD3mrxb53cSuYQjKX:xPd4n/M+WLcilrpgGH/GwY87mVmIXaW
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation 2c956dbbe6148be036c83f263c1dca1ccdfa889a493b924a53186eb0d72ed195.exe -
Executes dropped EXE 1 IoCs
pid Process 4768 wn2ra4ohzdr.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\raj4dkhhiap = "C:\\Users\\Admin\\AppData\\Roaming\\raj4dkhhiap\\wn2ra4ohzdr.exe" 2c956dbbe6148be036c83f263c1dca1ccdfa889a493b924a53186eb0d72ed195.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2c956dbbe6148be036c83f263c1dca1ccdfa889a493b924a53186eb0d72ed195.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wn2ra4ohzdr.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1048 wrote to memory of 4768 1048 2c956dbbe6148be036c83f263c1dca1ccdfa889a493b924a53186eb0d72ed195.exe 84 PID 1048 wrote to memory of 4768 1048 2c956dbbe6148be036c83f263c1dca1ccdfa889a493b924a53186eb0d72ed195.exe 84 PID 1048 wrote to memory of 4768 1048 2c956dbbe6148be036c83f263c1dca1ccdfa889a493b924a53186eb0d72ed195.exe 84 PID 4768 wrote to memory of 4876 4768 wn2ra4ohzdr.exe 93 PID 4768 wrote to memory of 4876 4768 wn2ra4ohzdr.exe 93 PID 4768 wrote to memory of 4876 4768 wn2ra4ohzdr.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\2c956dbbe6148be036c83f263c1dca1ccdfa889a493b924a53186eb0d72ed195.exe"C:\Users\Admin\AppData\Local\Temp\2c956dbbe6148be036c83f263c1dca1ccdfa889a493b924a53186eb0d72ed195.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Users\Admin\AppData\Roaming\raj4dkhhiap\wn2ra4ohzdr.exe"C:\Users\Admin\AppData\Roaming\raj4dkhhiap\wn2ra4ohzdr.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Users\Admin\AppData\Roaming\raj4dkhhiap\wn2ra4ohzdr.exe"C:\Users\Admin\AppData\Roaming\raj4dkhhiap\wn2ra4ohzdr.exe"3⤵PID:4876
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
133KB
MD5e35da73b5d3649858f234c4c93532237
SHA12d1427ebd89af6116a58781a3d8af8be3e229e47
SHA256bb868e884bc12ce72908f633511fbc26eb1edb665bfc2d6650a8156ce5ef3baf
SHA512eef9c358b377c9aa586f0abc42e66f7ace1e71b3cbb22c54b4b84453e5a2328299d5c20a11db719651c9b2c28ed5801a943d8e96e72a93830446b2a63ce82fbf