Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    93s
  • max time network
    95s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/12/2024, 15:33

General

  • Target

    04fd676dc283bde1035f4efe3fc3ae0daa0419b27155638d835f402fabb0845a.exe

  • Size

    416KB

  • MD5

    9a053bdd101822ef22da12f1599bc851

  • SHA1

    d15f7bce51bafba6b7b029a0820e15d0a7f60813

  • SHA256

    04fd676dc283bde1035f4efe3fc3ae0daa0419b27155638d835f402fabb0845a

  • SHA512

    d36fd6aee178185f5490822befbad3f7690daa2d321e789c07ab7c9cd7dc9c9bfcf6b62b9c862b95da1e4ac787de84e94e37acc27c3896f7a9dad3d44426ea4b

  • SSDEEP

    6144:ITNE3ZRrnaBVlvphVxmP+6CiejgcME1cwYfU+va+RU7P:ITNYrnE3bm/CiejewY5vg

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\04fd676dc283bde1035f4efe3fc3ae0daa0419b27155638d835f402fabb0845a.exe
    "C:\Users\Admin\AppData\Local\Temp\04fd676dc283bde1035f4efe3fc3ae0daa0419b27155638d835f402fabb0845a.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3636
    • C:\Users\Admin\AppData\Roaming\c5e4gxfvd4v\ximo2ubzn1i.exe
      "C:\Users\Admin\AppData\Roaming\c5e4gxfvd4v\ximo2ubzn1i.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3796
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
        3⤵
          PID:1408

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\c5e4gxfvd4v\ximo2ubzn1i.exe

      Filesize

      416KB

      MD5

      5105a9428fc1d2257af999552a65f5d1

      SHA1

      871a2afcf07d731234f288006aedb4a6b75bebd8

      SHA256

      a80ad5d63750cadbc611681ed5918c7750f5cc4e5815b6db0e469ea8ef82d79f

      SHA512

      e99f75b3b0189f88cf0194049cd5988b4cacc19eaed5f86a237b50d94b3bcecae1c7bdb9fcbe8c98d50c5875242091f2b319431f71260dd2a114a418ebe73d3f

    • memory/3636-6-0x0000000005BB0000-0x0000000005BEC000-memory.dmp

      Filesize

      240KB

    • memory/3636-2-0x0000000005F30000-0x00000000064D4000-memory.dmp

      Filesize

      5.6MB

    • memory/3636-3-0x0000000005A20000-0x0000000005AB2000-memory.dmp

      Filesize

      584KB

    • memory/3636-4-0x0000000074B00000-0x00000000752B0000-memory.dmp

      Filesize

      7.7MB

    • memory/3636-5-0x00000000059E0000-0x00000000059EA000-memory.dmp

      Filesize

      40KB

    • memory/3636-0-0x0000000074B0E000-0x0000000074B0F000-memory.dmp

      Filesize

      4KB

    • memory/3636-1-0x0000000000F70000-0x0000000000FDE000-memory.dmp

      Filesize

      440KB

    • memory/3636-21-0x0000000074B00000-0x00000000752B0000-memory.dmp

      Filesize

      7.7MB

    • memory/3796-20-0x0000000074B00000-0x00000000752B0000-memory.dmp

      Filesize

      7.7MB

    • memory/3796-22-0x0000000074B00000-0x00000000752B0000-memory.dmp

      Filesize

      7.7MB

    • memory/3796-23-0x0000000074B00000-0x00000000752B0000-memory.dmp

      Filesize

      7.7MB

    • memory/3796-25-0x0000000074B00000-0x00000000752B0000-memory.dmp

      Filesize

      7.7MB