Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20250129-en -
resource tags
arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system -
submitted
02/02/2025, 02:26
Behavioral task
behavioral1
Sample
4d9947f580ce0254f3197e05a8247eaab30183ad8b292e6a16fb64701c9c77a9N.exe
Resource
win7-20240903-en
General
-
Target
4d9947f580ce0254f3197e05a8247eaab30183ad8b292e6a16fb64701c9c77a9N.exe
-
Size
629KB
-
MD5
2636e72056b9ee9495548eb46a3a93d0
-
SHA1
9b5cda0964ceb190487911bab16225d5a4ee63bf
-
SHA256
4d9947f580ce0254f3197e05a8247eaab30183ad8b292e6a16fb64701c9c77a9
-
SHA512
13b78f3360b657e0096e2c1e7b49e23d0a3470f4a04cb4a84a65ac3977a329e76751a3d7604ac4c0f9610036f124516315fe4d26a0ebdd57ead4672baa24066e
-
SSDEEP
6144:hmbmLppYOuakY1q5Q4XMxvQ4x1OpGcm9VQl0lM/oJ4/gupe10b:hma6id1Q8zzkGHVqoq/gI
Malware Config
Extracted
urelas
218.54.31.226
218.54.31.165
Signatures
-
Urelas family
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000\Control Panel\International\Geo\Nation 4d9947f580ce0254f3197e05a8247eaab30183ad8b292e6a16fb64701c9c77a9N.exe Key value queried \REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000\Control Panel\International\Geo\Nation hiakt.exe -
Executes dropped EXE 2 IoCs
pid Process 2480 hiakt.exe 4904 honow.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hiakt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language honow.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4d9947f580ce0254f3197e05a8247eaab30183ad8b292e6a16fb64701c9c77a9N.exe -
Suspicious behavior: EnumeratesProcesses 48 IoCs
pid Process 4904 honow.exe 4904 honow.exe 4904 honow.exe 4904 honow.exe 4904 honow.exe 4904 honow.exe 4904 honow.exe 4904 honow.exe 4904 honow.exe 4904 honow.exe 4904 honow.exe 4904 honow.exe 4904 honow.exe 4904 honow.exe 4904 honow.exe 4904 honow.exe 4904 honow.exe 4904 honow.exe 4904 honow.exe 4904 honow.exe 4904 honow.exe 4904 honow.exe 4904 honow.exe 4904 honow.exe 4904 honow.exe 4904 honow.exe 4904 honow.exe 4904 honow.exe 4904 honow.exe 4904 honow.exe 4904 honow.exe 4904 honow.exe 4904 honow.exe 4904 honow.exe 4904 honow.exe 4904 honow.exe 4904 honow.exe 4904 honow.exe 4904 honow.exe 4904 honow.exe 4904 honow.exe 4904 honow.exe 4904 honow.exe 4904 honow.exe 4904 honow.exe 4904 honow.exe 4904 honow.exe 4904 honow.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1256 wrote to memory of 2480 1256 4d9947f580ce0254f3197e05a8247eaab30183ad8b292e6a16fb64701c9c77a9N.exe 86 PID 1256 wrote to memory of 2480 1256 4d9947f580ce0254f3197e05a8247eaab30183ad8b292e6a16fb64701c9c77a9N.exe 86 PID 1256 wrote to memory of 2480 1256 4d9947f580ce0254f3197e05a8247eaab30183ad8b292e6a16fb64701c9c77a9N.exe 86 PID 1256 wrote to memory of 716 1256 4d9947f580ce0254f3197e05a8247eaab30183ad8b292e6a16fb64701c9c77a9N.exe 87 PID 1256 wrote to memory of 716 1256 4d9947f580ce0254f3197e05a8247eaab30183ad8b292e6a16fb64701c9c77a9N.exe 87 PID 1256 wrote to memory of 716 1256 4d9947f580ce0254f3197e05a8247eaab30183ad8b292e6a16fb64701c9c77a9N.exe 87 PID 2480 wrote to memory of 4904 2480 hiakt.exe 93 PID 2480 wrote to memory of 4904 2480 hiakt.exe 93 PID 2480 wrote to memory of 4904 2480 hiakt.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\4d9947f580ce0254f3197e05a8247eaab30183ad8b292e6a16fb64701c9c77a9N.exe"C:\Users\Admin\AppData\Local\Temp\4d9947f580ce0254f3197e05a8247eaab30183ad8b292e6a16fb64701c9c77a9N.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\hiakt.exe"C:\Users\Admin\AppData\Local\Temp\hiakt.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\honow.exe"C:\Users\Admin\AppData\Local\Temp\honow.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4904
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "2⤵
- System Location Discovery: System Language Discovery
PID:716
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
342B
MD5ab81a7cae5f3b4956a813b265151742e
SHA10912a00360776619b058187136f3d14420df14f3
SHA256ca2f14247effbc1b52a50c0763ce0d180d482399ee8f485c185a9a41afc3973f
SHA512ee0da9c1db68586c2d2a8b4bc8cecfd6cb6023445b38f1f765080c1438d09ed786493453fc16a62d070c8c375f0f0c1002e5ecc4027ed677c01116738abbcbf8
-
Filesize
512B
MD550baac52e02beb87483916c1f570c9a5
SHA1a7c19f6995814c94e8e66c7ac40e444e993154bd
SHA2564ae109436a52770067626b0a361f5613467319067e404e6df737321959a721e3
SHA512e912000292b2d62edfafb31c495d567751723703c44484a3adf3d5d9ab38ed2d61a9e0f50886e4fa659a14a04b161a4c2f14e93390f16b216a49982ce6179973
-
Filesize
629KB
MD5c6116c0203cb5b3159507b541bb7473c
SHA15223b49024cce8b7f1af0cd7cc7890966c8229ca
SHA25675ae2e58e927a7cc67e7985d9a491476ee175f9864efc99ff544abdb2a1b3c64
SHA512f458aefde1d38a68dc2a8a470c4e0f3c40cecd1e889de389c9606e26cb38dd904ad5fcc33e8db5f20d616aa223585a68af4070bfb2fd667f7fa0a56a4a8b8726
-
Filesize
203KB
MD58259f4cb5b72c4af3d736ba15ca06f73
SHA1292acd44bd6532842ee0751b9a78f7439b6c2d38
SHA256632e3f03aa284c2ea32cdf7e4007af3c025c86028c3af8b43ab6b2a48d46eda7
SHA512ad372912146fbdd6979370e445e14ca9991712143d5e5143f7b37ba3f21d9336783fea15c952cc667b0515fe6995fe0035e175ec6c31d0c3acb0a1654aeb589b