Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    139s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250314-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/03/2025, 06:10

General

  • Target

    4bb452a3de5825053bceee8fd5ee6db144ef8c4615a71a8408ee7de4df789fa3.exe

  • Size

    579KB

  • MD5

    f26ad40d3a15fc5453456dc9047cabe6

  • SHA1

    0322588ead1761f11715a5723f15f391e9211617

  • SHA256

    4bb452a3de5825053bceee8fd5ee6db144ef8c4615a71a8408ee7de4df789fa3

  • SHA512

    438349889e6d27fd88e9c62d015b74e55dcd78d1d720c1b9b8e3e18c45a19bbe338ea9da58ca729221facaca22cdf54c808a127524aa73bb445145f7bba72333

  • SSDEEP

    12288:YbD5arFJwK6hMJ6ZzHFZfc28beMGTfZuqb7q:rBJwdhMJ6ZzHrfcsMGTfZ5Pq

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4bb452a3de5825053bceee8fd5ee6db144ef8c4615a71a8408ee7de4df789fa3.exe
    "C:\Users\Admin\AppData\Local\Temp\4bb452a3de5825053bceee8fd5ee6db144ef8c4615a71a8408ee7de4df789fa3.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1348
    • C:\Users\Admin\AppData\Roaming\Webdevelop\Webfrequency.exe
      "C:\Users\Admin\AppData\Roaming\Webdevelop\Webfrequency.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4076
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        3⤵
          PID:4288

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\Webdevelop\Webfrequency.exe

      Filesize

      579KB

      MD5

      1dd0b3f102c6109ead2eb64d37d86f2f

      SHA1

      77ac0c672cd8b5472bd50b7091ec0920347d592d

      SHA256

      f5ec76337fe8f1583399829b93250d89bbcd8ccd5638181b0bff7a7272a2d748

      SHA512

      52d791c27525e17537cb58113b16d4e558a7c2c6cd54c9e9a600dbeb52ca643d965fb207b4cfaac57e08b8de086752ebd2ac90fb61736ddabc07dd82618b548f

    • memory/1348-8-0x0000000074AF0000-0x00000000752A0000-memory.dmp

      Filesize

      7.7MB

    • memory/1348-0-0x0000000074AFE000-0x0000000074AFF000-memory.dmp

      Filesize

      4KB

    • memory/1348-3-0x0000000005A20000-0x0000000005AB2000-memory.dmp

      Filesize

      584KB

    • memory/1348-4-0x0000000074AF0000-0x00000000752A0000-memory.dmp

      Filesize

      7.7MB

    • memory/1348-5-0x00000000059D0000-0x00000000059DA000-memory.dmp

      Filesize

      40KB

    • memory/1348-6-0x00000000059C0000-0x00000000059CA000-memory.dmp

      Filesize

      40KB

    • memory/1348-2-0x0000000005F30000-0x00000000064D4000-memory.dmp

      Filesize

      5.6MB

    • memory/1348-1-0x0000000000F40000-0x0000000000FD4000-memory.dmp

      Filesize

      592KB

    • memory/1348-7-0x0000000074AFE000-0x0000000074AFF000-memory.dmp

      Filesize

      4KB

    • memory/1348-23-0x0000000074AF0000-0x00000000752A0000-memory.dmp

      Filesize

      7.7MB

    • memory/4076-22-0x0000000074AF0000-0x00000000752A0000-memory.dmp

      Filesize

      7.7MB

    • memory/4076-24-0x0000000074AF0000-0x00000000752A0000-memory.dmp

      Filesize

      7.7MB

    • memory/4076-25-0x0000000074AF0000-0x00000000752A0000-memory.dmp

      Filesize

      7.7MB

    • memory/4076-26-0x0000000074AF0000-0x00000000752A0000-memory.dmp

      Filesize

      7.7MB

    • memory/4076-28-0x0000000074AF0000-0x00000000752A0000-memory.dmp

      Filesize

      7.7MB