Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250207-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250207-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/02/2025, 01:52

General

  • Target

    ee908628c2589347e6e05c66b5fdc200ba996efabbd1401f1c3c761fe2e2a616.exe

  • Size

    995KB

  • MD5

    c9cbedbddefc0242501c86d2481f7396

  • SHA1

    f2037325c8213bba65d2ca2e32fa1020e0bf12ee

  • SHA256

    ee908628c2589347e6e05c66b5fdc200ba996efabbd1401f1c3c761fe2e2a616

  • SHA512

    6b509ab586bf14e0ff34ce1ba0846c8256770089897a48660594dffaf99673ada2b7a92f9784aaa4cae2932c63da6be36091f10dac78dc9fd5990775e5924b33

  • SSDEEP

    12288:4jauDReW+A2xwaLhRe2OA6SwXmBXysCcVGRhcnw+UT+RiJ7OSnShaAd:4DDaAWZTcAldCqwxlOQeld

Malware Config

Signatures

  • Downloads MZ/PE file 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ee908628c2589347e6e05c66b5fdc200ba996efabbd1401f1c3c761fe2e2a616.exe
    "C:\Users\Admin\AppData\Local\Temp\ee908628c2589347e6e05c66b5fdc200ba996efabbd1401f1c3c761fe2e2a616.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4264
    • C:\ProgramData\wvuheu.exe
      "C:\ProgramData\wvuheu.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      PID:5028
  • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RTI0NThCQkQtNTRCNi00MjA1LTg2OEYtQzhCQzc4OTM3NzRGfSIgdXNlcmlkPSJ7REVEQjFEQTYtMzcxRi00MkY2LTk2Q0QtMTg3NkEyODBDRDY1fSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7RjQyRUQ5RkEtQUI0Ny00MjAxLUE2RUQtOUQzRTY5NkI0RUM0fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSI5IiBpbnN0YWxsZGF0ZXRpbWU9IjE3Mzg5NDU5ODUiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4MzQxODQ0NDQzNjAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MTA0MjA3NzA0Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
    1⤵
    • System Location Discovery: System Language Discovery
    • System Network Configuration Discovery: Internet Connection Discovery
    PID:3928

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Documents and Settings .exe

    Filesize

    995KB

    MD5

    e9cd29b3bcf6677f30590c90e05a9296

    SHA1

    8b23b33296faaafd45984271782bd6318964f4a8

    SHA256

    f367b6de457240311de655bc5cc4de6e1a478a2c119b25e22adc8b05a89ed714

    SHA512

    3e1e012bac9cf54db63e922711562c1187def0b68cfba8220b73194c2249bab8b4da5c211c5c0f14bdc4d9e2551e047424c7e70ddde93f87062a62642aaa8575

  • C:\ProgramData\Saaaalamm\Mira.h

    Filesize

    136KB

    MD5

    cb4c442a26bb46671c638c794bf535af

    SHA1

    8a742d0b372f2ddd2d1fdf688c3c4ac7f9272abf

    SHA256

    f8d2c17bdf34ccfb58070ac8b131a8d95055340101a329f9a7212ac5240d0c25

    SHA512

    074a31e8da403c0a718f93cbca50574d8b658921193db0e6e20eacd232379286f14a3698cd443dc740d324ad19d74934ae001a7ad64b88897d8afefbc9a3d4e3

  • C:\ProgramData\wvuheu.exe

    Filesize

    859KB

    MD5

    ff90da3c96f2cb9025a8ebd64d35db0f

    SHA1

    6ce7ccaccede229b20014712ca1e3c6f9d8f8cff

    SHA256

    4839ba013898ee9dbc9bafa8d803917966c28bf4b9b83f828b33f7f75a94cb98

    SHA512

    db6454d5b0d856226f4c37927b6c71a6156d871f2e92343861fb5cc0ce32ffe7e5cd39684bba71f5f256503aefa79665be5c728fc5f0bd12da758b82e1be9db5

  • memory/4264-0-0x0000000000400000-0x0000000000474000-memory.dmp

    Filesize

    464KB

  • memory/4264-1-0x0000000000400000-0x0000000000474000-memory.dmp

    Filesize

    464KB

  • memory/4264-9-0x0000000000400000-0x0000000000474000-memory.dmp

    Filesize

    464KB

  • memory/5028-66-0x0000000000400000-0x0000000000448000-memory.dmp

    Filesize

    288KB