Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
161s -
max time network
124s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
01/02/2022, 10:29
Static task
static1
Behavioral task
behavioral1
Sample
45763478ad7f43aa83ebaaea28bafaac6835bec45bf8c6948cf5dd454b6e30c7.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
45763478ad7f43aa83ebaaea28bafaac6835bec45bf8c6948cf5dd454b6e30c7.exe
Resource
win10v2004-en-20220112
General
-
Target
45763478ad7f43aa83ebaaea28bafaac6835bec45bf8c6948cf5dd454b6e30c7.exe
-
Size
96KB
-
MD5
47c011a8f2bab4077182cff452c36608
-
SHA1
edbeed7e8b4f56502bd600d8770e786936e8e8d0
-
SHA256
45763478ad7f43aa83ebaaea28bafaac6835bec45bf8c6948cf5dd454b6e30c7
-
SHA512
2531647ab6aebf1c7d714225f3a724b875852ff9cf461eeb6be27ea6d7251f332edc2b2b1ce6907c6fa2f00a0e83c3f7ea27ea02f5c824f0dcd6efb313aa2e01
Malware Config
Extracted
buer
https://mesoplano.com/
https://banusle.top/
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\ProgramData\\8b92c1076888f9d43426\\gennt.exe\"" gennt.exe -
Buer Loader 2 IoCs
Detects Buer loader in memory or disk.
resource yara_rule behavioral1/memory/1112-60-0x0000000000260000-0x000000000026C000-memory.dmp buer behavioral1/memory/1368-62-0x0000000000250000-0x000000000025C000-memory.dmp buer -
Executes dropped EXE 1 IoCs
pid Process 1368 gennt.exe -
Deletes itself 1 IoCs
pid Process 1368 gennt.exe -
Loads dropped DLL 2 IoCs
pid Process 1112 45763478ad7f43aa83ebaaea28bafaac6835bec45bf8c6948cf5dd454b6e30c7.exe 1112 45763478ad7f43aa83ebaaea28bafaac6835bec45bf8c6948cf5dd454b6e30c7.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\O: gennt.exe File opened (read-only) \??\S: gennt.exe File opened (read-only) \??\T: gennt.exe File opened (read-only) \??\A: gennt.exe File opened (read-only) \??\B: gennt.exe File opened (read-only) \??\E: gennt.exe File opened (read-only) \??\G: gennt.exe File opened (read-only) \??\X: gennt.exe File opened (read-only) \??\Z: gennt.exe File opened (read-only) \??\H: gennt.exe File opened (read-only) \??\K: gennt.exe File opened (read-only) \??\M: gennt.exe File opened (read-only) \??\P: gennt.exe File opened (read-only) \??\Y: gennt.exe File opened (read-only) \??\F: gennt.exe File opened (read-only) \??\I: gennt.exe File opened (read-only) \??\L: gennt.exe File opened (read-only) \??\W: gennt.exe File opened (read-only) \??\U: gennt.exe File opened (read-only) \??\V: gennt.exe File opened (read-only) \??\J: gennt.exe File opened (read-only) \??\N: gennt.exe File opened (read-only) \??\Q: gennt.exe File opened (read-only) \??\R: gennt.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1368 gennt.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1112 wrote to memory of 1368 1112 45763478ad7f43aa83ebaaea28bafaac6835bec45bf8c6948cf5dd454b6e30c7.exe 29 PID 1112 wrote to memory of 1368 1112 45763478ad7f43aa83ebaaea28bafaac6835bec45bf8c6948cf5dd454b6e30c7.exe 29 PID 1112 wrote to memory of 1368 1112 45763478ad7f43aa83ebaaea28bafaac6835bec45bf8c6948cf5dd454b6e30c7.exe 29 PID 1112 wrote to memory of 1368 1112 45763478ad7f43aa83ebaaea28bafaac6835bec45bf8c6948cf5dd454b6e30c7.exe 29 PID 1368 wrote to memory of 1116 1368 gennt.exe 30 PID 1368 wrote to memory of 1116 1368 gennt.exe 30 PID 1368 wrote to memory of 1116 1368 gennt.exe 30 PID 1368 wrote to memory of 1116 1368 gennt.exe 30 PID 1368 wrote to memory of 1200 1368 gennt.exe 31 PID 1368 wrote to memory of 1200 1368 gennt.exe 31 PID 1368 wrote to memory of 1200 1368 gennt.exe 31 PID 1368 wrote to memory of 1200 1368 gennt.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\45763478ad7f43aa83ebaaea28bafaac6835bec45bf8c6948cf5dd454b6e30c7.exe"C:\Users\Admin\AppData\Local\Temp\45763478ad7f43aa83ebaaea28bafaac6835bec45bf8c6948cf5dd454b6e30c7.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\ProgramData\8b92c1076888f9d43426\gennt.exeC:\ProgramData\8b92c1076888f9d43426\gennt.exe "C:\Users\Admin\AppData\Local\Temp\45763478ad7f43aa83ebaaea28bafaac6835bec45bf8c6948cf5dd454b6e30c7.exe" ensgJJ2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Deletes itself
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Windows\SysWOW64\secinit.exeC:\ProgramData\8b92c1076888f9d43426\gennt.exe3⤵PID:1116
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" powershell.exe -Command "& {Add-MpPreference -ExclusionPath C:\ProgramData\8b92c1076888f9d43426}"3⤵PID:1200
-
-