Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
38s -
max time network
111s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
20/02/2022, 00:20
Static task
static1
Behavioral task
behavioral1
Sample
f48c52b820c7ec36afb411dc052d83ced667db46d5b9b729748e73fb70cb1421.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
f48c52b820c7ec36afb411dc052d83ced667db46d5b9b729748e73fb70cb1421.exe
Resource
win10v2004-en-20220113
General
-
Target
f48c52b820c7ec36afb411dc052d83ced667db46d5b9b729748e73fb70cb1421.exe
-
Size
151KB
-
MD5
a0a2c05256ee2727a2dfade4dc7544d6
-
SHA1
fba2fbb09c96de73c903ab40894225cc235bdcfe
-
SHA256
f48c52b820c7ec36afb411dc052d83ced667db46d5b9b729748e73fb70cb1421
-
SHA512
48c10e276f2455a29b352db81e72fa1b7bbbe3ef46e8998e1e44900e97cc3fa5682e424fbb0680594dcc45b2003c20bae15fc46f2822001d7669d7b1b7335ddf
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation f48c52b820c7ec36afb411dc052d83ced667db46d5b9b729748e73fb70cb1421.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1232 f48c52b820c7ec36afb411dc052d83ced667db46d5b9b729748e73fb70cb1421.exe 1232 f48c52b820c7ec36afb411dc052d83ced667db46d5b9b729748e73fb70cb1421.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1232 f48c52b820c7ec36afb411dc052d83ced667db46d5b9b729748e73fb70cb1421.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1232 wrote to memory of 4852 1232 f48c52b820c7ec36afb411dc052d83ced667db46d5b9b729748e73fb70cb1421.exe 84 PID 1232 wrote to memory of 4852 1232 f48c52b820c7ec36afb411dc052d83ced667db46d5b9b729748e73fb70cb1421.exe 84 PID 1232 wrote to memory of 2296 1232 f48c52b820c7ec36afb411dc052d83ced667db46d5b9b729748e73fb70cb1421.exe 63 PID 4852 wrote to memory of 3760 4852 cmd.exe 86 PID 4852 wrote to memory of 3760 4852 cmd.exe 86 PID 1232 wrote to memory of 2348 1232 f48c52b820c7ec36afb411dc052d83ced667db46d5b9b729748e73fb70cb1421.exe 62 PID 1232 wrote to memory of 2464 1232 f48c52b820c7ec36afb411dc052d83ced667db46d5b9b729748e73fb70cb1421.exe 59 PID 1232 wrote to memory of 2964 1232 f48c52b820c7ec36afb411dc052d83ced667db46d5b9b729748e73fb70cb1421.exe 51 PID 1232 wrote to memory of 3244 1232 f48c52b820c7ec36afb411dc052d83ced667db46d5b9b729748e73fb70cb1421.exe 50
Processes
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3244
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:2964
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2464
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2348
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\f48c52b820c7ec36afb411dc052d83ced667db46d5b9b729748e73fb70cb1421.exe"C:\Users\Admin\AppData\Local\Temp\f48c52b820c7ec36afb411dc052d83ced667db46d5b9b729748e73fb70cb1421.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\f48c52b820c7ec36afb411dc052d83ced667db46d5b9b729748e73fb70cb1421.exe" /f2⤵
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\Windows\system32\reg.exeREG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\f48c52b820c7ec36afb411dc052d83ced667db46d5b9b729748e73fb70cb1421.exe" /f3⤵PID:3760
-
-