Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
93s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26/12/2024, 15:33
Static task
static1
Behavioral task
behavioral1
Sample
04fd676dc283bde1035f4efe3fc3ae0daa0419b27155638d835f402fabb0845a.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
04fd676dc283bde1035f4efe3fc3ae0daa0419b27155638d835f402fabb0845a.exe
Resource
win10v2004-20241007-en
General
-
Target
04fd676dc283bde1035f4efe3fc3ae0daa0419b27155638d835f402fabb0845a.exe
-
Size
416KB
-
MD5
9a053bdd101822ef22da12f1599bc851
-
SHA1
d15f7bce51bafba6b7b029a0820e15d0a7f60813
-
SHA256
04fd676dc283bde1035f4efe3fc3ae0daa0419b27155638d835f402fabb0845a
-
SHA512
d36fd6aee178185f5490822befbad3f7690daa2d321e789c07ab7c9cd7dc9c9bfcf6b62b9c862b95da1e4ac787de84e94e37acc27c3896f7a9dad3d44426ea4b
-
SSDEEP
6144:ITNE3ZRrnaBVlvphVxmP+6CiejgcME1cwYfU+va+RU7P:ITNYrnE3bm/CiejewY5vg
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation 04fd676dc283bde1035f4efe3fc3ae0daa0419b27155638d835f402fabb0845a.exe -
Executes dropped EXE 1 IoCs
pid Process 3796 ximo2ubzn1i.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\c5e4gxfvd4v = "C:\\Users\\Admin\\AppData\\Roaming\\c5e4gxfvd4v\\ximo2ubzn1i.exe" 04fd676dc283bde1035f4efe3fc3ae0daa0419b27155638d835f402fabb0845a.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 04fd676dc283bde1035f4efe3fc3ae0daa0419b27155638d835f402fabb0845a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ximo2ubzn1i.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3636 wrote to memory of 3796 3636 04fd676dc283bde1035f4efe3fc3ae0daa0419b27155638d835f402fabb0845a.exe 82 PID 3636 wrote to memory of 3796 3636 04fd676dc283bde1035f4efe3fc3ae0daa0419b27155638d835f402fabb0845a.exe 82 PID 3636 wrote to memory of 3796 3636 04fd676dc283bde1035f4efe3fc3ae0daa0419b27155638d835f402fabb0845a.exe 82 PID 3796 wrote to memory of 1408 3796 ximo2ubzn1i.exe 83 PID 3796 wrote to memory of 1408 3796 ximo2ubzn1i.exe 83 PID 3796 wrote to memory of 1408 3796 ximo2ubzn1i.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\04fd676dc283bde1035f4efe3fc3ae0daa0419b27155638d835f402fabb0845a.exe"C:\Users\Admin\AppData\Local\Temp\04fd676dc283bde1035f4efe3fc3ae0daa0419b27155638d835f402fabb0845a.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3636 -
C:\Users\Admin\AppData\Roaming\c5e4gxfvd4v\ximo2ubzn1i.exe"C:\Users\Admin\AppData\Roaming\c5e4gxfvd4v\ximo2ubzn1i.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3796 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"3⤵PID:1408
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
416KB
MD55105a9428fc1d2257af999552a65f5d1
SHA1871a2afcf07d731234f288006aedb4a6b75bebd8
SHA256a80ad5d63750cadbc611681ed5918c7750f5cc4e5815b6db0e469ea8ef82d79f
SHA512e99f75b3b0189f88cf0194049cd5988b4cacc19eaed5f86a237b50d94b3bcecae1c7bdb9fcbe8c98d50c5875242091f2b319431f71260dd2a114a418ebe73d3f