Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20250128-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20250128-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
30/01/2025, 04:35
General
-
Target
Drunkdeer (3).exe
-
Size
667KB
-
MD5
dd7527eb0b3ed22e909068cbb53ddbb2
-
SHA1
2a1c2e9f0a0840d6e438e2fc277232d12556c9dd
-
SHA256
56e9238e93542c952ac6688e6b0da86ef001bffb11666eec3d128538b0113c34
-
SHA512
ea6d928554c357042161520e2ed494ba6127f91019e2dcb9d725c5fd7b0920d222d8ea283c963ee422f401c581deb58f4fff6294e568a5191003cb2cd82d558e
-
SSDEEP
12288:paoZmL+EP8YPEVHdmOhlU9va6vspHdOisdeT6DsHgD:prI8iEVHdmOhlU9va6vsZdOiIeWsi
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral1/memory/4900-1-0x0000000000E30000-0x0000000000EDA000-memory.dmp family_umbral -
Detect Xworm Payload 1 IoCs
resource yara_rule behavioral1/memory/4900-1-0x0000000000E30000-0x0000000000EDA000-memory.dmp family_xworm -
Umbral family
-
Xworm family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Drunkdeer (3).exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4900 Drunkdeer (3).exe