Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    93s
  • max time network
    96s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/02/2025, 20:49

General

  • Target

    b9bb76541f3c548e1e70bf01fefd8b1fd2c4f2d325de10283af87533db2cc38eN.exe

  • Size

    1.1MB

  • MD5

    2ddecd87d762859b672331da8204fc90

  • SHA1

    2d3a57a8a1cd8a766980d3883325e67b51da5e5c

  • SHA256

    b9bb76541f3c548e1e70bf01fefd8b1fd2c4f2d325de10283af87533db2cc38e

  • SHA512

    abbb378266bd4f64d3d3ba0448a87a175278fc0b01d30a1fb6bf57b248966592b09845f4c949a5926c474c846d947290239271b2176d455c4123f07af240bf5f

  • SSDEEP

    24576:iLOsDFncLmKDZOSz1FO5+H35DMw2n/qIjtAT3GiJJNK/Ry5V:QEzD35DMnCIjtAyiJJ8y5V

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b9bb76541f3c548e1e70bf01fefd8b1fd2c4f2d325de10283af87533db2cc38eN.exe
    "C:\Users\Admin\AppData\Local\Temp\b9bb76541f3c548e1e70bf01fefd8b1fd2c4f2d325de10283af87533db2cc38eN.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4068
    • C:\Users\Admin\AppData\Local\Temp\b9bb76541f3c548e1e70bf01fefd8b1fd2c4f2d325de10283af87533db2cc38eN.exe
      "C:\Users\Admin\AppData\Local\Temp\b9bb76541f3c548e1e70bf01fefd8b1fd2c4f2d325de10283af87533db2cc38eN.exe" -burn.unelevated BurnPipe.{33DA11E8-8784-4561-9F34-5D05CEEEEA06} {48DAEAC0-B615-4056-9E1D-7A9C9E32D512} 4068
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:2816

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\{f65db027-aff3-4070-886a-0d87064aabb1}\.ba1\logo.png

    Filesize

    1KB

    MD5

    d6bd210f227442b3362493d046cea233

    SHA1

    ff286ac8370fc655aea0ef35e9cf0bfcb6d698de

    SHA256

    335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef

    SHA512

    464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b

  • C:\Users\Admin\AppData\Local\Temp\{f65db027-aff3-4070-886a-0d87064aabb1}\.ba1\wixstdba.dll

    Filesize

    117KB

    MD5

    a52e5220efb60813b31a82d101a97dcb

    SHA1

    56e16e4df0944cb07e73a01301886644f062d79b

    SHA256

    e7c8e7edd9112137895820e789baaaeca41626b01fb99fede82968ddb66d02cf

    SHA512

    d6565ba18b5b9795d6bde3ef94d8f7cd77bf8bb69ba3fe7adefb80fc7c5d888cdfdc79238d86a0839846aea4a1e51fc0caed3d62f7054885e8b15fad9f6c654e