Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
43s -
max time network
91s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
20/02/2022, 07:47
Static task
static1
Behavioral task
behavioral1
Sample
478990938b7cae1f3266d232993c12265e8c8dcd4382ea381cf1e6cf6d21b350.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
478990938b7cae1f3266d232993c12265e8c8dcd4382ea381cf1e6cf6d21b350.exe
Resource
win10v2004-en-20220113
General
-
Target
478990938b7cae1f3266d232993c12265e8c8dcd4382ea381cf1e6cf6d21b350.exe
-
Size
149KB
-
MD5
5aeb82aba635623d8f0ff2536e0d1df2
-
SHA1
bebe20f6aa1a0645575c67193de244976386536f
-
SHA256
478990938b7cae1f3266d232993c12265e8c8dcd4382ea381cf1e6cf6d21b350
-
SHA512
5c3339617780faaabae21efae457c6275345ade7b1c5d9f199f37fd23a107f2b92d34e7fe6f8d2baed8ddbb38a356e9416426bbe27f205b4bb2f9269593f3e37
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation 478990938b7cae1f3266d232993c12265e8c8dcd4382ea381cf1e6cf6d21b350.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchos = "C:\\Users\\Admin\\AppData\\Local\\Temp\\478990938b7cae1f3266d232993c12265e8c8dcd4382ea381cf1e6cf6d21b350.exe" reg.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run reg.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1436 478990938b7cae1f3266d232993c12265e8c8dcd4382ea381cf1e6cf6d21b350.exe 1436 478990938b7cae1f3266d232993c12265e8c8dcd4382ea381cf1e6cf6d21b350.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1436 478990938b7cae1f3266d232993c12265e8c8dcd4382ea381cf1e6cf6d21b350.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1436 wrote to memory of 1868 1436 478990938b7cae1f3266d232993c12265e8c8dcd4382ea381cf1e6cf6d21b350.exe 83 PID 1436 wrote to memory of 1868 1436 478990938b7cae1f3266d232993c12265e8c8dcd4382ea381cf1e6cf6d21b350.exe 83 PID 1436 wrote to memory of 2280 1436 478990938b7cae1f3266d232993c12265e8c8dcd4382ea381cf1e6cf6d21b350.exe 72 PID 1868 wrote to memory of 3976 1868 cmd.exe 85 PID 1868 wrote to memory of 3976 1868 cmd.exe 85 PID 1436 wrote to memory of 2312 1436 478990938b7cae1f3266d232993c12265e8c8dcd4382ea381cf1e6cf6d21b350.exe 71 PID 1436 wrote to memory of 2432 1436 478990938b7cae1f3266d232993c12265e8c8dcd4382ea381cf1e6cf6d21b350.exe 70 PID 1436 wrote to memory of 744 1436 478990938b7cae1f3266d232993c12265e8c8dcd4382ea381cf1e6cf6d21b350.exe 62 PID 1436 wrote to memory of 3252 1436 478990938b7cae1f3266d232993c12265e8c8dcd4382ea381cf1e6cf6d21b350.exe 38
Processes
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3252
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:744
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2432
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2312
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2280
-
C:\Users\Admin\AppData\Local\Temp\478990938b7cae1f3266d232993c12265e8c8dcd4382ea381cf1e6cf6d21b350.exe"C:\Users\Admin\AppData\Local\Temp\478990938b7cae1f3266d232993c12265e8c8dcd4382ea381cf1e6cf6d21b350.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1436 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\478990938b7cae1f3266d232993c12265e8c8dcd4382ea381cf1e6cf6d21b350.exe" /f2⤵
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\Windows\system32\reg.exeREG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\478990938b7cae1f3266d232993c12265e8c8dcd4382ea381cf1e6cf6d21b350.exe" /f3⤵
- Adds Run key to start application
PID:3976
-
-